Signing in with Okta | Dropzone AI Documentation

Configuring Okta SAML for Authentication with Dropzone

This document details configuring Okta SAML for authentication with Dropzone. This is more advanced than using federated buttons such as "Log in with Google" and "Log in with Microsoft" but offers more customization, especially useful for customers with more than one Dropzone environment.

Enabling SAML with Okta

Enabling SAML with Okta involves the following steps:

There are multiple ways you can configure Okta successfully with Dropzone AI; we show the simplest version here. However you are welcome to use whatever works best. Perhaps you wish to set the user.dropzone_role via the Application profile, or via Okta Expression Language with custom logic. See Advanced Okta for possibilities.

As long as the values come down where we expect them, in the correct form, the "how" is up to you.

Create the Dropzone Role on User Profile

Dropzone needs to know which role a user should receive when logging into your tenant. There are multiple ways you can configure this, but the most common is to add a field to the user profile or to the Okta application profile.

Here we show you how to add the field to the user Okta profile.

If you store the role somewhere other than the Okta profile then you will need to adjust the SAML attribute value user.dropzone_role to match.

  1. Go to Directory > Profile Editor
  2. Select the "User (default)" profile
  3. Click the "Add Attribute" button
  4. Set the values as follows:
    • Data type: string
    • Display name: dropzone_role
    • Variable name: dropzone_role
    • Description: Dropzone AI Access Level
    • Select the Enum "Define enumerated list of values" checkbox

You may choose a different "Variable Name", but later in this document when you specify SAML attributes you'll need to adjust from user.dropzone_role to the name you used here.

  1. In the "Attribute Members" section, create the following new values:
Display Name Value
admin admin
member member
restricted-read-only restricted-read-only

Be sure the "Values" of the attributes match exactly admin, member, and restricted-read-only. The "Display Name" may be something more descriptive if you wish.

  1. Click Save

Assign Dropzone Role Attributes to Users

Next, set the dropzone_role profile value for users who will have access to the Dropzone AI platform.

  1. Go to Directory > People

  2. Select a person

  3. Select "Profile"

  4. Click Edit

  5. Scroll to the bottom of the screen and find dropzone_role and select the access level for this user

  6. Set the user's dropzone_role value

  7. Click Save

  8. Repeat for all users who should have Dropzone access

Create the Okta Application

  1. Go to Applications > Applications
  2. Click Create App Integration
  3. Select SAML 2.0
  4. In General Settings, set:

Be sure you do not enable an Okta tile (application icon) for this Application. Dropzone AI does not support IDP-initiated login flows, so the tile will not function properly.

However you can make an Okta "Bookmark Application" that will enable single-click logins to your Dropzone tenant - see Direct Login Links for details.

  1. Click Next

  2. Enter values in the "SAML Settings" section of the "Create SAML Integration" page:

    • Single sign-on URL: If you have received a "Dropzone SAML ACS Url" from Dropzone, paste it here
    • Audience URI: If you have received a "Dropzone SAML Entity ID" from Dropzone, paste it here
    • Default RelayState: leave blank
    • Name ID format: EmailAddress
    • Application Username: Email
      • If you wish to use a different field such as Okta Username, or if you have a custom value for this, select it instead
    • Leave all values in "advanced" as-is

  3. Enter values in the "Attribute Statements" section of the "Create SAML Integration" page:

    • You must create attributes for first_name, last_name, and dropzone_role
    • If you've applied the role to the user's profile then these values will be as follows:
Name Value
first_name user.firstName
last_name user.lastName
full_name user.fullName
dropzone_role user.dropzone_role

If you chose a different "Variable Name" on the user profile, or are using a different field entirely, update user.dropzone_role to match.

  1. Click Next
  2. On the next page, click "This is an internal app we have created"
  3. Click Finish

Assign Users to the Dropzone Application

Configure which users are allowed to log into Dropzone.

  1. Go to the newly created application in Okta
  2. Click on the "Assignments" tab at the top
  3. Click "Assign" and then the "Assign to People" or "Assign to Groups" button as appropriate
  4. Repeat until you've added all the people/groups who should have access

Gather Application Data for Dropzone

Dropzone needs two pieces of information from your Okta environment to enable the SAML trust.

  1. Go to the newly created application in Okta
  2. Click on the "Sign On" tab at the top
  3. Click on the "View SAML setup instructions" on the right

Find the following two pieces of information:

Copy IDP details Provide these to your Dropzone support representative. (Typically this is done via the Dropzone SAML Request form.)

Update Your SAML Application

Dropzone will enable SAML and provide you two values to add to the "SAML Settings" in the "General" tab of your SAML app:

Update these values in your Okta Application and save.

Set Legacy Configuration on your app

In addition to setting the roles as custom profile attributes, on the app itself: Navigate to Sign On > Show Legacy Configuration > Profile attribute statements Set dropzone_role equal to appuser.dropzone_role

Advanced Okta

Okta has powerful configuration capabilities, including Okta Expression Language which can be used to simplify your Dropzone role provisioning, as an alternative to manually setting roles on a user's profile directly.

This section is here as a reference, not a requirement. Use whatever method you're most comfortable with that balances your administration duties and meets your security standards.

Advanced Okta - Dropzone Role via Group Membership

Some customers use Okta Groups coupled with Okta Expression Language to populate the dropzone_role attribute automatically. As an example, say you had the following groups:

You could use the following:

user.isMemberOfGroupName("access-dropzone-admin") ? "admin" :
user.isMemberOfGroupName("access-dropzone-member") ? "member" :
user.isMemberOfGroupName("access-dropzone-read-only") ? "restricted-read-only" :
null

The values (e.g. admin, member, restricted-read-only on the right side above) must match exactly the values we expect, however the groups can be anything that matches your internal naming standards.

Getting Help

If you have any errors or questions, engage your Dropzone AI support representative.