OpenID Connect (OIDC) Setup for Okta

1. In Security, select Authentication.

2. Under New single sign-on (SSO) on the Authentication settings page, select Manage SSO settings.

3. On the Single sign-on page, select OIDC.

4. Under Claim your email domains, select Claim domains or Edit claimed domains and specify the email domains that your organization uses. This allows you to recognize and redirect members to your IdP when they sign in. For instructions, see Claimed Email Domains.

1. Under Configure your connection on the Authentication settings page, select Get started or Edit connection.

2. On the Configure OIDC connection screen, enter a name to identify your organization's connection in the Connection name field.

3. In a different browser tab, sign in to your Okta account as an administrator to create an app integration.

   1. In your dashboard, select Applications, Applications.

      

   2. On the Applications page, select Create App Integration.

   3. On the Create a new app integration screen, select OIDC - OpenID Connect in the Sign-in method section.

      

   4. In the Application type section that appears, select Web Application.

   5. Select Next.

4. On the New Web App Integration page, configure your integration.

   1. Under General Settings, enter a unique name to identify your application in the App integration name field.

      

   2. Under Sign-in redirect URIs, add Blackbaud's callback URL: https://id.blackbaud.com/bbid.onmicrosoft.com/oauth2/authresp.

      

   3. Under Assignments, select Allow everyone in your organization to access beside Controlled access. Then when Enable immediate access appears, select Enable immediate access with Federation Broker Mode.

      Tip: This lets everyone at your organization sign in with Blackbaud ID on your SSO connection, but it doesn't provide authorization to access Blackbaud solutions because you manage that access within the solutions themselves. By providing all users with access to your SSO connection, you reduce overhead within the IdP. You can then provision users within your Blackbaud solutions.

      

   4. Select Save.

5. Return to Blackbaud's Configure OIDC connection screen, and in the Metadata URL field, enter the URL for the OIDC metadata document that contains information that is required during sign-in, such as the URLs to use and the location of the service's public signing keys. The metadata document is always located at an endpoint that ends in ".well-known/openid-configuration."

6. In the Response Type field, select the "Code" response type that passes a code to be exchanged for a token. This is the only available response type when you use Okta. This response type doesn't handle the client secret generation, so you'll need to provide the client secret during configuration and then remember to update it before it expires.

7. In the Client ID field, enter the client ID for your Okta application. In your Okta account, you can copy the value from the application's General tab in the Client ID field.

8. In the Client secret field, enter the client secret for your Okta application. In your Okta account, you can copy and generate client secrets from on the application's General tab in the Client Secrets section.

9. In the fields under Confirm how your IdP identifies the following, specify where you store the data that your IdP uses to identify your organization's users. These values must match the mapping values you entered when you created the Okta application.

   Warning: You can only pass mapping fields if they are included under "claims_supported" in the OIDC metadata document that you provided in the Metadata URL field. That document, which ends in ".well-known/openid-configuration," contains information that is required during sign-in, such as the fields where you store data that identifies your users.

   1. In the NameID field, specify where you store the unique IDs that your IdP uses to identify your users. The field for this data varies depending on your IdP, but the values are typically not email addresses or employee IDs. Instead, the values should be unique IDs that your IdP creates to distinguish users across all accounts.

      The common claim name for this field for Okta is "sub." Okta generates this subject identifier to uniquely identify individuals, and we recommend using it for your nameID to avoid possible re-naming issues.

      We also recommend against using email addresses to identify users. If you identify users by email address and need to change a user's email address, then you must re-invite the user at the new email address, which means you lose all history associated with the original one.

   2. In the Email address field, specify where you store user email addresses. The common claim name for this field for Okta is "email."

      For successful connections, email addresses must be unique.

   3. In the First name field, specify where you store first names. The common claim name for this field for Okta is "given_name."

   4. In the Last name field, specify where you store last names. The common claim name for this field is for Okta "family_name."

10. Select the checkbox that acknowledges the need to wait before testing your SSO connection.

    • If you are setting up SSO for the first time, select I acknowledge these settings require 24 hours to take effect. A notification will let you know when your SSO connection is ready to test.

    • If you are editing an existing SSO connection, select I acknowledge these changes can take up to 30 minutes to take effect. We recommend waiting 30 minutes before you test the connection.

11. Select Save.

Tip: For more information about how to set up an Okta application, see Build a Single Sign-On (SSO) integration.

When you save your configuration settings, test mode is turned on automatically. At least one user must successfully sign in using test mode before you can enable your SSO connection.

To verify that your organization can use your identity provider (IdP) to sign in to Blackbaud solutions, select Learn about testing SSO under Test connection. Copy the URL under Blackbaud ID redirect and then test your connection in a private or incognito browser. For more information, see Test Mode.

Note: If a consent screen appears in test mode, then that means your IdP is configured to require admin approval before users authenticate. This consent screen is for the Blackbaud SSO application and is not requesting new permissions or access. It is seeking read-access to the user information that you already configured as part of your SSO setup. To proceed, follow the instructions on your IdP's consent screen.

To complete the connection to your IdP, select Turn on SSO under Turn on. Then on the Connect your OIDC SSO screen, select Connect with OIDC.

After you turn on SSO, users are redirected to your IdP when they sign in to their Blackbaud IDs with one of your claimed domains. After they authenticate through your IdP, their Blackbaud IDs:

• Automatically redirect them to your organization's login for future sign-ins.

  After users sign in through your organization's login, they are redirected to their Blackbaud ID profiles unless you edit the redirect to specify a Blackbaud solution. For more information, see Redirect Settings.

  Tip: Don't forget that if your users use an app in your IdP's portal to connect to Blackbaud solutions, then you must configure that app to use the redirect URL for your live connection. For information about the redirect URL, see Redirect Settings.

• Use your IdP for password updates, lockouts, and other authentication management.

Note: After you enable SSO, resend any pending invitations.