Skip to main content

Configuring Okta as an Identity Provider Enterprise

note

This page describes how to use the new Dremio Cloud application to configure OIDC SSO in Okta. For information about the former method using a custom application, read Okta Custom Application Workflow.

Dremio supports Okta as an enterprise identity provider. Okta administrators can use the Dremio Cloud application to enable single sign-on (SSO) authentication and allow users to log in to Dremio using Okta as the trusted third party.

Prerequisites​

Configuring OIDC SSO in Okta requires:

Supported Features​

Dremio supports the following Okta SSO features:

  • Service provider-initiated (SP-initiated) SSO: Dremio uses the Open ID Connect (OIDC) protocol for SP-initiated SSO. When users provide their email address to log in to Dremio, Dremio sends an authentication request to Okta. Okta then authenticates the user's identity and the user is logged in to Dremio.
note

Dremio also allows you to take advantage of Okta's System for Cross-domain Identity Management (SCIM) provisioning feature and manage Dremio user access from Okta. After you configure Okta for OIDC SSO in this guide, see SCIM with Okta to configure SCIM provisioning.

Configure OIDC SSO​

To configure Okta OIDC SSO for Dremio users:

  1. In Okta, navigate to Applications > Applications and click the Browse App Catalog button.

  2. Type Dremio in the search field and select Dremio Cloud in the list of search results.

  3. Click the Add Integration button.

  4. (Optional) Type a custom label in the Application label field.

  5. Select your Dremio control plane region from the Region dropdown menu: US or EU.

  6. Click Done. Okta creates the Dremio Cloud application and displays the application's Assignments tab.

  7. Click the Sign On tab.

  8. Copy and save the client ID and client secret listed under OpenID Connect. The client ID and client secret are sensitive information and should be kept somewhere private. You will use them to configure authentication in Dremio later in this procedure.

  9. Click the OpenID Provider Metadata link to open the OpenID configuration for the application.

  10. Copy and save the URL value for the issuer key at the top of the OpenID configuration. You will use it to configure authentication in Dremio later in this procedure.

  11. In Dremio, on the organization page, click the Settings Gear icon that represents the Organization settings. icon next to the organization name.

  12. Click the Authentication tab in the left sidebar.

  13. In the Enterprise section, click Add Provider to open the Add Provider dialog.

  14. In Step 1, select Okta in the dropdown menu.

  15. In Step 3, enter the issuer URL, client ID, and client secret information that you copied from Okta in the corresponding fields.

  16. Click Add. After the page loads, you should see Okta as an authentication provider in the Enterprise section.

  17. Click the Enabled toggle to activate the Okta authentication provider.

Okta is now configured as an enterprise authentication provider. The Log in with Okta button appears in the list of log-in options for your Dremio users.

Assign People and Groups to the Dremio Cloud Application​

Follow the instructions in the Okta documentation to assign people or assign groups to the Dremio Cloud application to ensure that users can use Okta for SSO log-in. The users you assign, whether individually or through their membership in an assigned group, can use the Log in with Okta button immediately.

Use privileges and roles to manage user access to objects in Dremio.

Use Okta SSO to Log in to Dremio​

Any Okta user who is assigned to the Dremio Cloud application can log in with Okta immediately. To use Okta SSO to log in to Dremio:

  1. Open the Dremio login page.

  2. Type your email address in the Email field and click Continue.

  3. Click the Log in with Okta button.

  4. When you are redirected to the Okta website for authentication, enter your Okta username and password and click Sign In.

Okta authenticates your identity and redirects you to Dremio, which then logs you in.

note

To configure Okta's SCIM provisioning feature and use Okta to manage access for Dremio users, see SCIM with Okta.

Revoke Okta SSO Login for a User or Group​

To revoke users' access to Okta SSO login for Dremio:

  1. In your Dremio Cloud application in Okta, click the Assignments tab.

  2. In the left menu, under Filters, select People to deactivate a user or Groups to deactivate a group of users.

  3. Find the row for the user or group you want to deactivate and click the X on the right side of the row.

  4. In the confirmation dialog that appears, click OK.

Starting immediately, the deactivated users cannot use Okta OIDC SSO to log in to Dremio.

caution

To completely delete Dremio users, you must also manually remove their user accounts in Dremio.

Troubleshooting​

This section describes some things to keep in mind about OIDC SSO in Okta.

  • To add the Dremio Cloud application in Okta and configure OIDC SSO, you must be a super administrator in the Okta organization.

  • If you revoke a user's access to use Okta SSO login in Okta, the user can still log in to Dremio with their Dremio username and password. To completely delete the user so that they cannot log in to Dremio at all, you must manually remove their user accounts in Dremio.

If you have other issues when configuring OIDC SSO in Okta with the Dremio Cloud application, contact Support.