Manage Groups with Okta

Coverity on Polaris
Version
latest
This example shows how to integrate Coverity on Polaris with Okta as the SAML identity provider. This is useful when you want to manage your Coverity on Polaris groups through Okta, for example when Okta is already in use as your SSO solution.

In the following example, we assume you already have an active account with the identity provider.

  1. In Coverity on Polaris, go to MY ORGANIZATION > SAML 2.0.
  2. Click Download in the Download Service Provider Metadata section.
    You will receive an XML file.
  3. Use a text editor to examine the file. You will use some of its values later.
  4. In Okta, sign in and click Admin, then Add Application, then Create New App.
  5. Choose Web and SAML 2.0, then click Create.

    The modal form for creating an app.
  6. Fill in a name and click Next.

    On the General Settings form, enter an app name in the first field.
  7. For Single sign on URL, look in the XML file for <md:AssertionConsumerService>. Use the value of the @Location attribute from that element.

    The SAML Settings form.
  8. For Audience URI (SP Entity ID), look in the XML file for <md:EntityDescriptor> and use the value of the @entityID attribute.
  9. In the Name ID format field, select EmailAddress
  10. In the Application username field, select Email
  11. If encryption is required, click Show Advanced Settings and set Assertion Encryption field to Encrypted.
    Upload a .pem certificate file from Coverity on Polaris.
    1. In Coverity on Polaris Web UI, go to MyOrganization > SAML 2.0.
    2. In the Certificate area of the page, select Options > Download Current Self-Signed Certificate as Certificate File.
    3. Upload the certificate to Okta using the Encryption Certificate field.
  12. If you want to provision groups, go to the Group Attribute Statement section, near the bottom of the form and set up a group attribute statement with the name Groups.

    The Group Attribute Statement section of the SAML form.
    Note: If you manage groups with Okta, you will not be able to create groups by using the Coverity on Polaris Web UI.
  13. Click Next.
  14. Click I’m an Okta customer adding an internal app, then click Finish.
  15. In Okta, go to Applications > Applications in the menu.
  16. Locate the new application. The search bar is helpful. Click on your new application to see its details.
  17. Click the Sign On tab.
  18. Click View Setup Instructions. You will use some values from this page later.
  19. In Coverity on Polaris, click +Add, then use the following steps to complete the form.

    This form must be completed to add a SAML account.
  20. For Single Sign-On URL, use the Identity Provider Single Sign-On URL from the Okta setup instructions.
  21. Leave Single Log-Out URL blank.
  22. For Identity Provider Issuer, use the Identity Provider Issuer value from the Okta setup instructions.
  23. Check the box if you want Coverity on Polaris to inherit groups from your SAML provider.

    When this option is checked in the form described above, you will rely on your SAML provider as the source of truth for group membership. Therefore, this option could override any groups created in Coverity on Polaris UI. The default state for this feature is "on".


    Check the box to sync with your SAML provider.

    Please note that when inheritance is checked "on":

    • Users will be removed from groups, if they were not added through your SAML identity provider.
    • Groups created in Coverity on Polaris will become empty as soon as Coverity on Polaris communicates with the identity provider, whether they were created before or after inheritance was turned on.
  24. For Organization Email Domain, fill in the email domain (which must be unique on this Coverity on Polaris instance).
  25. For Signature Algorithm, choose SHA256 (matches the Okta application settings, in the General tab).
  26. For Public Vendor Certificate, paste in the X.509 Certificate block of text from the Okta setup instructions.
  27. Click Save.
    Note: After enabling SSO between Coverity on Polaris and Okta, remember to set up People and Groups in Okta to grant access to the Coverity on Polaris application, otherwise no one will be able to sign into Coverity on Polaris.