Joget DX 8 Stable Released
The stable release for Joget DX 8 is now available, with a focus on UX and Governance.
The 'SAML Service Provider Directory Manager' plugin facilitates effortless Single Sign-On (SSO) integration with Joget by enabling compatibility with various Identity Providers (IdPs). With this plugin, users can seamlessly authenticate and access Joget through their chosen IdP, enhancing the user experience and security of the platform.
Plugin Available in the Bundle:
SAML Service Provider Directory Manager
This plugin bundle is compatible with Joget DX 8.
To successfully perform Single Sign On (SSO) to Joget using Identity Provider (IDP). For this article we are using OKTA as Identity Provider.
The prerequisite for this plugin is to have a account with desired Identify Provider (IDP) and setup the App integration and obtain the IDP metadata and certificate. In this article we will using OKTA as the Identity Provider.
Please refer to following to read and understand more on Okta.
To ensure the successful operation of this plugin, it is essential to whitelist the domains or IP addresses of the host. Typically, this involves adding the IP address or domain name of your Joget application server to the whitelist. To access this section of Joget, go to Settings → General Settings and scroll down till you see API Domain/IP Whitelist section.
Figure 1: API Domain/IP Whitelist
|API Domain Whitelist (Separated by ';')|
Domain whitelist to allow API calls to Joget Workflow. Separated by semicolon.
"localhost;www.joget.org;dev.joget.org”, or "*" to allow from everywhere.
In a production environment, do not use "*".
Doing so will allow anyone to call all JSON APIs from the Joget server.
|API IP Whitelist (Separated by ';')|
Please review the Licensed Users in the License section of Joget. If you surpass the allowed user limit, you won't be able to log in to Joget following the Single Sign-On (SSO) process.
Figure 2: Licensed Users
Create Developer Account at https://developer.okta.com/signup/ and compete the signup process. For this the setup in this article, we will be using Workforce Identify Cloud Account.
Figure 3: Okta Developer Account Sign up
Login at https://developer.okta.com/login/
Go to your Okta developer account, and navigate to Applications > Create App Integration.
Figure 4: Okta Developer Dashboard - Creating App Integration
Figure 5: App Integration - SAML 2.0
After selecting SAML 2.0, pick a meaningful app name to represent Joget.
You may click on "Do not display application icon to users" if you do not want this app to appear in Okta's end user interfaces.
Figure 6: General Settings
In the next screen, we will be required to provide SSO URL and SP Entity ID.
Figure 7: SAML Settings
Here we will need Single sign-on URL & Audience URI (SP Entity ID). Please key in the following in both the fields
Replace the server and port with actual server credentials. For example localhost:8080
For this article we are using localhost as server and 9443 as port, e.g.
** Only change the server and port setting.
Change Name ID format onto EmailAddress.
Figure 8: SAML Setting (General)
Scroll down to Attribute Statements (optional) and fill up the attribute mappings. The mappings are needed to identify the users that will be logging in.
Figure 9: Attribute Statements
Click Add Another to create an extra attribute statements.
Complete the rest of the steps by clicking on Next and Finish. You may choose "I'm an Okta customer adding an internal app" for your testing purpose.
In this, we will get IDP Metadata and Certificate.
IDP Metadata and Certificate
We will need IDP Metadata and Certificate to configure this plugin in later steps.
Edit the app integration that we have just created on Okta.
Figure 10: Obtaining Metadata
Copy the Metadata URL and open it in a new window. Copy the entire content.
Figure 11: Metadata
Scroll down to look for SHA-2 cert and download certificate.
Figure 12: Download Certificate
Figure 13: Okta Certificate
We will need to assign user(s) to the app. Navigate to Applications > Assignments > Assign.
Figure 14: Assign Users to App
Once assigned, the selected users are now able to SSO into Joget using their identity in Okta.
We are done with setting up OKTA Developer Account and obtains the required items such as IDP Metadata and Certificate. We will not proceed to setup this plugin in Joget.
Get the plugin jar file from https://github.com/jogetoss/sp-saml-directory-manager
Upload the plugin jar file in Joget by going to Settings → Manage Plugins → Upload Plugin
Once the plugin in uploaded, go to Settings → Directory Manager Settings → choose SAML Service Provider Directory Manager - 8.0.0 and click Select.
Figure 15: Select Plugin
Open the certificate with your text editor and copy the value and paste it into Joget.
Figure 16: Paste the Cert Content
Paste the content into Metadata in Joget.
Figure 17: Paste Metadata
You may want to check on User Provisioning Enabled so that if it is the first time an user SSO into Joget, an user account would be created in Joget and the user would be able to continue to log in to Joget.
Configure the user attributes.
Figure 18: Configure User Attributes
Configure User Attributes based on the mappings below.
First Name Attribute
Last Name Attribute
The "Value" here corresponds with "Name" column that we have declared in Figure 6 earlier.
Configure the Login Button. This login button will be shown at the Joget Login Screen to enable use to perform Single Sign On (SSO) using OKTA.
Figure 19: Configure Login Button
Up to this point, we have successfully created app integration in Okta and configured the SAML Service Provider Directory Manager - 8.0.0 plugin in Joget.
To login using this plugin, you have to logout from Joget. Go to Joget Login Page, you will see the following login screen with the login button to perform SSO using OKTA.
Login screen may differ as show below depending on the App Center but login button will be shown.
Figure 20: Joget Login screen
Upon clicking on the blue login button, the user will be redirected to Okta.
Figure 21: OKTA Login Screen
Upon successfully login in Okta with your registered email you would be redirected back to Joget and will be logged in.