10/16/2024

User Manual: SAML Setup Using OKTA

Introduction
This manual provides step-by-step instructions on how to configure Single Sign-On (SSO) for
CoLOS applications using OKTA. The integration allows secure authentication of users and
groups in the CoLOS system via OKTA
.

Pre-requisites:
l Ensure WebAPI, PUI, and CAT security are configured using HTTPS.
l Set CoLOS security level to medium or high before proceeding.

Setting Up an OKTA Developer Account

1. Navigate to the OKTA developer sign-up page: OKTA Developer.

2. Enter the required information and click Sign up. You will receive the verification email,
Click Active.

3. Follow the instructions to create new password and click Reset Password.
4. Click Setup and verify your password.

2/75
 5. Download and install the Okta verify app on your mobile device.

6. Set up your account in the app and enter the verification code. Click Verify.

7. The OKTA home page opens.

Managing Users
Adding a New User
1. Log in to the OKTA portal.
2. Go to Directory People.
3. Click Add person.
4. Enter the required user details.
5. Click Save.

3/75
 Result: The new user is created in the directory.

Groups
Creating a Group
1. Go to Directory Groups.
2. Click Add group.
3. Enter the required information for the group. Use the following format for group names:
OKTA-COLOS<Role Name> (e.g., OKTA-COLOS_Administrator).
4. Click Save.

Result: The user is created in the directory.

Adding Users to a Group

1. Go to Directory Groups.
2. Click the appropriate group name from the list to expand the details pane and to add
users.

4/75
 3. Click the Assign people tab and Select + next to the user to add them to the group.

Configuring Applications in OKTA

Predefined CoLOS Applications:
Use the following application names during integration:
l CoLOS Administrator: CoLOSAdministrator

l CoLOS Designer: CoLOSDesigner

l CoLOS OEE: OEE

l CoLOS PUI: PUI

l CoLOS Application Toolkit: cat

l CoLOS Data Management: CoLOSDataManagement

l CoLOS Design Control: DesignControl

Adding CoLOS Administrator Application in OKTA

1. Log in to the OKTA portal using an account with administrative rights (https://okta-
devok12.okta.com/).
2. Go to the Applications tab and click Create App Integration.

5/75
3. Select SAML 2.0 as the sign-in method, then click Next.

4. On General settings page, enter the app name (e.g., CoLOS Administrator (SAML).

6/75
5. On Configure SAML Page, In SAML settings, enter:
o The Signle Sign-on URL- https:/Server-
name:9340/UserAuthApi/SamlLoginResponse.

Replace Servername with your actual server name.

o Audience URI - http://www.okta.com/Audience

o Default RelayState - App=Applictation name (Refer to App names)

6. In Group Attribute Statements (optional), set the attributes to:

n Name: Groups
n Filter: Start with

7/75
 n Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is OKTA-COLOS_Admin-
istrator, then the group prefix is OKTA-CoLOS_)

Leave the Group prefix field blank if the group name doesn’t have
a prefix (e.g., group name: Administrator).

7. Select " It's required to contact the vendor to enable SAML" radio button. Click Finish

8/75
 Result: The CoLOS Administrator application is added to OKTA.

8. Go to specifc application, navigate to Sign On tab. Click View SAML setup instruc-
tions to download the certificate.

9. Note the Identity Provider Single Sign-On URL and Identity Provider Issuer and
download the certificate.

9/75
Assigning App to the Groups
1. Go to the Applications tab, Select the application, then navigate to the Assign-
ments tab.
2. Click Assign and select Assign to Groups.
3. Choose the desired group from the list, then click Assign andDone.

Result: The application is assigned to the group.

10/75
 Assigning App to the Users
1. Go to the Applications tab, Select the application, then navigate to the Assign-
ments tab.
2. Click Assign and select Assign to People.
3. Choose the users to assign, then click Assign and Done.

Result: The application is assigned to the selected users.

Integrating Identity Platform with CoLOS:

1. To import the certificate
l Go to System Properties Certificate Management. Select Import next to
CoLOS Administrator SAML.
l Click the three-dot menu next to Certificate file and choose all files. Select the file
and Click Open. Click Apply.

2. Go to Search bar and type Services. Search for Markem-imaje Connectivity, right click
and Select Restart.

11/75
 3. Go to Security Level, Select High Security. Choose SAML 2.0 - XML Based
Authentication from the Protocol drop down. Click Configure.

Select Medium Security if the High Security option is not available to

you.

Integrating CoLOS applications (SAML 2.0) with OKTA:

1. On the Apps section, expand the section for the application and enter the following:

l Destination URL: Identity Provider Single Sign-On URL from OKTA

l Issuer: Identity Provider Issuer in OKTA.

2. On the General section, fill in the following mandatory fields:

l Audience URL: http://www.provider.com/Audience

This is same for all CoLOS applications. You must configure

CoLOS Administrator before configuring any other
CoLOS applications.

l Group Attribute: Groups

12/75
 l Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is CoLOS_Administrator,
then the group prefix is CoLOS_).

Leave the Group prefix field blank if the group name doesn’t have
a prefix (e.g., group name: Administrator

3. Click Test, enter your credentials and click Sign on.

Authentication needs to be successful in Test Information

4. Restart the CoLOS application, then log in using your OKTA credentials.

Click CoLOS User Login to login with your CoLOS login credentials.

13/75
Adding CoLOS Designer Application in OKTA
1. Log in to the OKTA portal using an account with administrative rights (https://okta-
devok12.okta.com/).
2. Go to the Applications tab.
3. Click Create App Integration.

4. Select SAML 2.0 as the sign-on method, then click Next.

5. On General settings page, enter the app name e.g., "CoLOS Designer (SAML)".

14/75
6. In Configure SAML Page,
o The Signle Sign-on URL - https://Server-
name:9340/UserAuthApi/SamlLoginResponse

Replace Servername with your actual server name.

o Audience URI - http://www.okta.com/Audience

o Default RelayState - App=Applictation name (Refer to App names)

7. In Group Attribute Statements (optional):

n Name: Groups
n Filter: Start with
n Group Prefix: OKTA-COLOS_

15/75
 The Group prefix is the prefix of CoLOS groups created in the
identity platform (e.g., If the group name is OKTA-COLOS_Admin-
istrator, then the group prefix is OKTA-CoLOS_)

Leave the Group Prefix field blank if there is no prefix. (e.g., group
name: Administrator).

8. Select the radio button " It's required to contact the vendor to enable SAML", then click
Finish

16/75
 Result: The app is created.

9. Go to specifc application, navigate to Sign On tab. Click View SAML setup instruc-
tions to download the certificate.

10. Note the Identity Provider Single Sign-On URL and Identity Provider Issuer and
download the certificate.

17/75
Assigning CoLOS Designer App to the Groups
1. Go to the Applications tab, Select the application adn navigate to the Assignments
tab.
2. Select Assign and click Assign to Groups.
3. Select the group from the list and click Assign and Done.

Result: The application is assigned to the group.

18/75
Assigning App to the Users
1. Go to the Applications tab , Select the application and navigate to the Assignments
tab.
2. Select Assign and Click Assign to People.
3. Choose the users to assign, then click Assign and Done.

Result:The application is assigned to the user.

Repeat the above procedure to integrate other CoLOS applications with Iden-
tity platform.

Integrating an identity platform with CoLOS:

Configure SAML certificates with applications:
1. To import the certificate
l Go to System Properties Certificate Management. Select Import next to
CoLOS Administrator SAML.
l Click the three-dot menu next to Certificate file and choose all files. Select the file
and Click Open. Click Apply.

19/75
 2. Go to Search bar and type Services. Search for Markem-imaje Connectivity, right click
and Select Restart.

3. Go to Security Level, Select High Security. Choose SAML 2.0 - XML Based
Authentication from the Protocol drop down. Click Configure.

Select Medium Security if the High Security option is not available to

you.

Integrating CoLOS applications (SAML 2.0) with OKTA:

1. On the Apps section, expand the section for the application and enter the following:

l Destination URL: Identity Provider Single Sign-On URL in OKTA

l Issuer: Identity Provider Issuer in OKTA.

2. On the General section, fill in the following mandatory fields:

20/75
 l Audience URL: http://www.provider.com/Audience

It is same for all CoLOS applications. You must configure

CoLOS Administrator before configuring any other
CoLOS applications.

l Group Attribute: Groups

l Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is CoLOS_Administrator,
then the group prefix is CoLOS_).

Leave this blank if the group name does not have a prefix.

3. Click Test, enter your credentials, Click Sign on.

21/75
 Authentication needs to be successful in Test Information

4. Restart the CoLOS application, then log in using your OKTA credentials.

Click CoLOS User Login to login with your CoLOS login credentials.

Adding CoLOS Design Control Application in OKTA

1. Log in to the OKTA portal using an account with administrative rights (https://okta-
devok12.okta.com/).
2. Go to the Applications tab.
3. Click Create App Integration.

4. Select SAML 2.0 as the sign-on method, then click Next.

22/75
5. On theGeneral settings page enter the app name, e.g., "CoLOS Design Control
SAML".

6. In the Configure SAML Page,

o The Signle Sign-on URL - https://Server-
name:9340/UserAuthApi/SamlLoginResponse

Replace Servername with your actual server name.

o Audience URI - http://www.okta.com/Audience

o Default RelayState - App=Applictation name (Refer to App names)

23/75
7. In Group Attribute Statements (optional):
n Name: Groups
n Filter: Start with
n Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is OKTA-COLOS_Admin-
istrator, then the group prefix is OKTA-CoLOS_)

Leave the Group Prefix field blank if there is no prefix.

24/75
8. Select the radio button " It's required to contact the vendor to enable SAML", then click
Finish

Result: The app is created.

9. Go to specifc application, navigate to Sign On tab. Click View SAML setup instruc-
tions to download the certificate.

25/75
10. Note the Identity Provider Single Sign-On URL and Identity Provider Issuer and
download the certificate.

Assigning CoLOS Design Control App to the Groups

1. Go to Applications tab, Select the application, and navigate to the Assignments tab.
2. Select Assign then Click Assign to Groups.
3. Select the group from the list and click Assign and Done.

26/75
 Result: The application is assigned to the group.
Assigning App to the Users
1. Go to Applications tab, Select the application, and navigate to the Assignments tab.
2. Select Assign, then ClickAssign to People.
3. Choose the users to assign, then click Assign and Done.

Result: The application is assigned to the selected users.

Repeat the above procedure to integrate other CoLOS applications with Iden-
tity platform.

27/75
Integrating an Identity Platform with CoLOS:
Configure SAML certificates with applications:
1. To import the certificate
l Go to System Properties Certificate Management. Select Import next to
CoLOS Administrator SAML.
l Click the three-dot menu next to Certificate file and choose all files. Select the file
and Click Open. Click Apply.

2. Go to Search bar and type Services. Search for Markem-imaje Connectivity, right click
and Select Restart.

3. Go to Security Level, Select High Security. Choose SAML 2.0 - XML Based
Authentication from the Protocol drop down. Click Configure.

28/75
 Select Medium Security if the High Security option is not available to
you.

Repeat same steps for other applications and select the respective OKTA
certs for apps.

Integrating CoLOS applications (SAML 2.0) with OKTA:

1. On the Apps section, expand the section for the application and enter the following:

l Destination URL: Identity Provider Single Sign-On URL in OKTA

l Issuer: Identity Provider Issuer in OKTA.

2. On the General section, fill in the following mandatory fields:

l Audience URL: http://www.provider.com/Audience

It is same for all CoLOS applications. You must configure

CoLOS Administrator before configuring any other
CoLOS applications.

l Group Attribute: Groups

l Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is CoLOS_Administrator,
then the group prefix is CoLOS_).

Leave this blank if the group name does not have a prefix.

29/75
 3. Click Test, enter your credentials, Click Sign on.

Authentication needs to be successful in Test Information

4. Restart the CoLOS application, then log in using your OKTA credentials.

Click CoLOS User Login to login with your CoLOS login credentials.

Adding CoLOS Data Management Application in OKTA

1. Log in to the OKTA portal using an account with administrative rights (https://okta-
devok12.okta.com/).
2. Go to the Applications tab.

30/75
3. Click Create App Integration.

4. Select SAML 2.0 as the sign-on method, then click Next.

5. On theGeneral settings page enter the app name, e.g., "CoLOS Data Management
(SAML)".

31/75
6. In the Configure SAML Page, In SAML settings,
o The Signle Sign-on URL - https://Server-
name:9340/UserAuthApi/SamlLoginResponse

Replace Servername with your actual server name.

o Audience URI - http://www.okta.com/Audience

o Default RelayState - App=Applictation name (Refer to App names)

7. In Group Attribute Statements (optional):

n Name: Groups
n Filter: Start with
n Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is OKTA-COLOS_Admin-

32/75
 istrator, then the group prefix is OKTA-CoLOS_)

Leave the Group Prefix field blank if there is no prefix.

8. Select the radio button " It's required to contact the vendor to enable SAML", then Click
Finish.

33/75
 Result: The app is created.

9. Go to the specifc application, navigate to the Sign On tab and click View SAML setup
instructions to download the certificate.

10. Note the Identity Provider Single Sign-On URL and Identity Provider Issuer and
download the certificate.

34/75
Assigning CoLOS Data Management App to Groups
1. Go to Applications, Select the application, and navigate to the Assignments tab.
2. Select Assign, then click Assign to Groups.
3. Select the group from the list and click Assign and Done.

Result: The application is assigned to the group.

35/75
Assigning CoLOS Data Management App to the Users
1. Goto Applications, Select the App, navigate to the Assignments tab.
2. Select Assign and ClickAssign to People.
3. Choose the users to assign, then click Assign and Done.

Result: The application is assigned to the selected users.

Integrating an Identity Platform with CoLOS:

Configure SAML certificates with applications:
1. To import the certificate
l Go to System Properties Certificate Management. Select Import next to
CoLOS Administrator SAML.
l Click the three-dot menu next to Certificate file and choose all files. Select the file
and Click Open. Click Apply.

2. Go to Search bar and type Services. Search for Markem-imaje Connectivity, right click
and Select Restart.

36/75
 3. Go to Security Level, Select High Security. Choose SAML 2.0 - XML Based
Authentication from the Protocol drop down. Click Configure.

Select Medium Security if the High Security option is not available to

you.

Integrating CoLOS applications (SAML 2.0) with OKTA:

1. On the Apps section, expand the section for the application and enter the following:

l Destination URL: Identity Provider Single Sign-On URL in OKTA

l Issuer: Identity Provider Issuer in OKTA.

2. On the General section, fill in the following mandatory fields:

l Audience URL: http://www.provider.com/Audience

It is same for all CoLOS applications. You must configure

CoLOS Administrator before configuring any other
CoLOS applications.

l Group Attribute: Groups

37/75
 l Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is CoLOS_Administrator,
then the group prefix is CoLOS_).

Leave this blank if the group name does not have a prefix.

3. Click Test, enter your credentials, Click Sign on.

38/75
 Authentication needs to be successful in Test Information

4. Restart the CoLOS application, then log in using your OKTA credentials.

Click CoLOS User Login to login with your CoLOS login credentials.

Adding CoLOS Data Management Application in OKTA

1. Log in to the OKTA portal using an account with administrative rights (https://okta-
devok12.okta.com/).
2. Go to the Applications tab.
3. Click Create App Integration.

4. Select SAML 2.0 as the sign-on method, then click Next.

5. On theGeneral settings page, enter the app name e.g., "CoLOS Data Management
(SAML)".

39/75
6. In Configure SAML Page, In SAML settings,
o The Signle Sign-on URL - https://Server-
name:9340/UserAuthApi/SamlLoginResponse

Replace Servername with your actual server name.

o Audience URI - http://www.okta.com/Audience

o Default RelayState - App=Applictation name (Refer to App names)

7. In Group Attribute Statements (optional):

n Name: Groups
n Filter: Start with
n Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is OKTA-COLOS_Admin-

40/75
 istrator, then the group prefix is OKTA-CoLOS_)

Leave the Group Prefix field blank if there is no prefix.

8. Select the radio button " It's required to contact the vendor to enable SAML", then Click
Finish

41/75
 Result: The app is created.

9. Go to the specifc application, navigate to the Sign On tab and click View SAML setup
instructions to download the certificate.

10. Note the Identity Provider Single Sign-On URL and Identity Provider Issuer and
download the certificate.

42/75
Assigning CoLOS Data Management App to the Groups
1. Go to Applications tab, Select the application, then navigate to the Assignments tab.
2. Select Assign and Click Assign to Groups.
3. Select the Group from the list and Click Assignand Done.

Result: The application is assigned to the group.

43/75
Assigning CoLOS Data Management App to the Users
1. Go to Applications tab, Select the application, then navigate to the Assignments tab.
2. Select Assign and Click Assign to People.
3. Choose the users to assign, then click Assign and Done.

Result: The application is assigned to the selected users.

Integrating an Identity Platform with CoLOS:

Configure SAML certificates with applications:
1. To import the certificate
l Go to System Properties Certificate Management. Select Import next to
CoLOS Administrator SAML.
l Click the three-dot menu next to Certificate file and choose all files. Select the file
and Click Open. Click Apply.

2. Go to Search bar and type Services. Search for Markem-imaje Connectivity, right click
and Select Restart.

44/75
 3. Go to Security Level, Select High Security. Choose SAML 2.0 - XML Based
Authentication from the Protocol drop down. Click Configure.

Select Medium Security if the High Security option is not available to

you.

Repeat same steps for other applications and select the respective OKTA
certs for apps.

Integrating CoLOS applications (SAML 2.0) with OKTA:

1. On the Apps section, expand the section for the application and enter the following:

l Destination URL: Identity Provider Single Sign-On URL in OKTA

l Issuer: Identity Provider Issuer in OKTA.

2. On the General section, fill in the following mandatory fields:

45/75
 l Audience URL: http://www.provider.com/Audience

It is same for all CoLOS applications. You must configure

CoLOS Administrator before configuring any other
CoLOS applications.

l Group Attribute: Groups

l Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is CoLOS_Administrator,
then the group prefix is CoLOS_).

Leave the Group Prefix field blank if there is no prefix.

3. Click Test, enter your credentials, Click Sign on.

46/75
 Authentication needs to be successful in Test Information

4. Restart the CoLOS application, then log in using your OKTA credentials.

Click CoLOS User Login to login with your CoLOS login credentials.

Adding CoLOS PUI Application in OKTA

1. Log in to the OKTA portal using an account with administrative rights (https://okta-
devok12.okta.com/).
2. Go to the Applications tab.
3. Click Create App Integration.

4. Select SAML 2.0 as the sign-on method, then click Next.

47/75
5. On theGeneral settings page enter the app name, e.g., "CoLOS PUI (SAML)".

6. In the Configure SAML Page, In SAML settings,

o The Signle Sign-on URL - https://Server-
name:9340/UserAuthApi/SamlLoginResponse

Replace Servername with your actual server name.

o Audience URI - http://www.okta.com/Audience

o Default RelayState - App=Applictation name (Refer to App names)

48/75
7. In Group Attribute Statements (optional):
n Name: Groups

n Filter: Start with

n Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is OKTA-COLOS_Admin-
istrator, then the group prefix is OKTA-CoLOS_)

Leave the Group Prefix field blank if there is no prefix.

49/75
 8. Select the radio button " It's required to contact the vendor to enable SAML", then click
Finish

Result: The app is created.

9. Go to specifc application, navigate to Sign On tab. Click View SAML setup instruc-
tions to download the certificate.

10. Note the Identity Provider Single Sign-On URL and Identity Provider Issuer and
download the certificate.

50/75
Assigning CoLOS PUI App to the Groups
1. Goto Applications, Select the App, navigate to the Assignments tab.
2. Select Assign and Click Assign to Groups.
3. Select the Group from the list and Click Assign and Done.

Result: The application is assigned to the group.

51/75
Assigning CoLOS PUI App to the Users
1. Goto Applications, Select the App, navigate to the Assignments tab.
2. Select Assign and Click Assign to People.
3. Choose the users to assign, then click Assign and Done.

Result:The application is assigned to the selected users.

Integrating an Identity Platform with CoLOS:

Configure SAML certificates with applications:
1. To import the certificate
l Go to System Properties Certificate Management. Select Import next to
CoLOS Administrator SAML.
l Click the three-dot menu next to Certificate file and choose all files. Select the file
and Click Open. Click Apply.

2. Go to Search bar and type Services. Search for Markem-imaje Connectivity, right click
and Select Restart.

52/75
 3. Go to Security Level, Select High Security. Choose SAML 2.0 - XML Based
Authentication from the Protocol drop down. Click Configure.

Select Medium Security if the High Security option is not available to

you.

Integrating CoLOS applications (SAML 2.0) with OKTA:

1. On the Apps section, expand the section for the application and enter the following:

l Destination URL: Identity Provider Single Sign-On URL in OKTA

l Issuer: Identity Provider Issuer in OKTA. (Refer to URL and Issuer)

2. On the General section, fill out the following mandatory fields:

l Audience URL: http://www.provider.com/Audience

It is same for all CoLOS applications. You must configure

CoLOS Administrator before configuring any other
CoLOS applications.

l Group Attribute: Groups

53/75
 l Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is CoLOS_Administrator,
then the group prefix is CoLOS_).

Leave the Group Prefix field blank if there is no prefix.

3. Click Test, enter your credentials, Click Sign on.

Authentication needs to be successful in Test Information

4. Restart the CoLOS application, then log in using your OKTA credentials.

Click CoLOS User Login to login with your CoLOS login credentials.

54/75
Adding CoLOS OEE Application in OKTA
1. Log in to the OKTA portal using an account with administrative rights (https://okta-
devok12.okta.com/).
2. Go to the Applications tab.
3. Click Create App Integration.

4. Select SAML 2.0 as the sign-on method, then click Next.

5. In General settings page, enter the app name, e.g., "CoLOS PUI (SAML)".

55/75
6. In Configure SAML Page, In SAML settings,
o The Signle Sign on URL - https://Server-
name:9340/UserAuthApi/SamlLoginResponse

Replace Servername with your actual server name.

o Audience URI - http://www.okta.com/Audience

o Default RelayState - App=Applictation name (Refer to App names)

7. In Group Attribute Statements (optional):

n Name: Groups
n Filter: Start with
n Group Prefix: OKTA-COLOS_

56/75
 The Group prefix is the prefix of CoLOS groups created in the
identity platform (e.g., If the group name is OKTA-COLOS_Admin-
istrator, then the group prefix is OKTA-CoLOS_)

Leave the Group Prefix field blank if there is no prefix.

8. Select the radio button " It's required to contact the vendor to enable SAML", then click
Finish.

57/75
 Result: The app is created.

9. Go to specifc application, navigate to Sign On tab. Click View SAML setup instruc-
tions to download the certificate.

10. Note the Identity Provider Single Sign-On URL and Identity Provider Issuer and
download the certificate.

58/75
Assigning CoLOS PUI App to the Groups
1. Go to Applications tab, Select the application, and navigate to the Assignments tab.
2. Select Assign and Click Assign to Groups.
3. Select the Group from the list and Click Assign and Done.

Result: The application is assigned to the group.

59/75
Assigning CoLOS PUI App to the Users
1. Go to Applications tab, Select the application, and navigate to the Assignments tab.
2. Select Assign and Click Assign to People.
3. Choose the users to assign, then click Assign and Done.

Result: The application is assigned to the selected users.

Integrating an identity platform account with CoLOS:

Configure SAML certificates with applications:
1. To import the certificate
l Go to System Properties Certificate Management. Select Import next to
CoLOS Administrator SAML.
l Click the three-dot menu next to Certificate file and choose all files. Select the file
and Click Open. Click Apply.

2. Go to Search bar and type Services. Search for Markem-imaje Connectivity, right click
and Select Restart.

60/75
 3. Go to Security Level, Select High Security. Choose SAML 2.0 - XML Based
Authentication from the Protocol drop down. Click Configure.

Select Medium Security if the High Security option is not available to

you.

Repeat same steps for other applications and select the respective OKTA
certs for apps.

Integrating CoLOS applications (SAML 2.0) with OKTA:

1. On the Apps section, expand the section for the application and enter the following:

l Destination URL: Identity Provider Single Sign-On URL in OKTA

l Issuer: Identity Provider Issuer in OKTA.

2. On the General section, fill in the following mandatory fields:

61/75
 l Audience URL: http://www.provider.com/Audience

It is same for all CoLOS applications. You must configure

CoLOS Administrator before configuring any other
CoLOS applications.

l Group Attribute: Groups

l Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is CoLOS_Administrator,
then the group prefix is CoLOS_).

Leave the Group Prefix field blank if there is no prefix.

3. Click Test, enter your credentials, Click Sign on.

62/75
 Authentication needs to be successful in Test Information

4. Restart the CoLOS application, then log in using your OKTA credentials.

Click CoLOS User Login to login with your CoLOS login credentials.

Adding CoLOS CAT Application in OKTA

1. Log in to the OKTA portal using an account with administrative rights (https://okta-
devok12.okta.com/).
2. Go to the Applications tab.
3. Click Create App Integration.

4. Select SAML 2.0 as the sign-on method, then click Next.

63/75
5. On the General settings page, enter the app name, e.g., "CoLOS CAT

6. In Configure SAML Page, In SAML settings,

o The Signle Sign-on URL - https://Server-
name:8084/UserAuthApi/SamlLoginResponse

Replace Servername with your actual server name.

o Audience URI - http://www.okta.com/Audience

o Default RelayState - App=Applictation name (Refer to App names)

64/75
7. In Group Attribute Statements (optional):
n Name: Groups
n Filter: Start with
n Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is OKTA-COLOS_Admin-
istrator, then the group prefix is OKTA-CoLOS_)

Leave the Group Prefix field blank if there is no prefix.

65/75
8. Select the radio button " It's required to contact the vendor to enable SAML". Click Fin-
ish.

Result: The app is created.

9. Go to specifc application, navigate to Sign On tab. Click View SAML setup instruc-
tions to download the certificate.

66/75
10. Note the Identity Provider Single Sign-On URL and Identity Provider Issuer and
download the certificate.

67/75
Assigning CoLOS PUI App to Groups
1. Go to Applications, Select the application, navigate to the Assignments tab.
2. Select Assign and Click Assign to Groups.
3. Select the group from the list and Click Assign and Click Done.

Result: The application is assigned to the group.

Assigning CoLOS CAT App to Users

1. Go to Applications tab, Select the application, navigate to the Assignments tab.
2. Select Assign and Click Assign to People.
3. Choose the users to assign, then click Assign and Done.

Result: The application is assigned to the selected users.

68/75
Integrating an Identity Platform with CoLOS:
Configure SAML certificates with applications:
1. Open SQL and add the following details in scUser table.
Refer to the following figure.

o scName - username
o scRole - groupname
o scStation - Profiles created in Toolkit

2. Open Toolkit, navigate to Configuration Security and then change the Security
Mode: to User Log On . Click the check box to enable User Defines Station, and Use
authentication modes configured in CoLOS Enterproise other than LDAP .

3. To add a role , Click and enter the Role Name same as OKTA groupname. Click
Save and deploy the project.

4. To import the OKTA certificate

l Go to System Properties Certificate Management. Select Import next to
CoLOS Operator Panel SAML.

69/75
 l Click the three-dot menu next to Certificate file and choose all files. Select the file
and Click Open. Click Apply.

5. To Import CoLOS Toolkit certificate

l Go to System Properties Certificate Management. Select Import next to
CAT.
l Click the three-dot menu next to Certificate file and choose all files. Select the file
and Click Open. Click Apply.

6. Go to Search bar and type Services. Search for Markem-imaje Connectivity, right click
and Select Restart.

70/75
 7. Go to Security Level, Select High Security. Choose SAML 2.0 - XML Based
Authentication from the Protocol drop down. Click Configure.

Select Medium Security if the High Security option is not available to

you.

Integrating CoLOS applications (SAML 2.0) with OKTA:

1. On the Apps section, expand the section for the application and enter the following:

l Destination URL: Identity Provider Single Sign-On URL in OKTA

l Issuer: Identity Provider Issuer in OKTA. (Refer to URL and Issuer)

2. On the General section, fill out the following mandatory fields:

l Audience URL: http://www.provider.com/Audience

It is same for all CoLOS applications. You must configure

CoLOS Administrator before configuring any other
CoLOS applications.

l Group Attribute: Groups

71/75
 l Group Prefix: OKTA-COLOS_

The Group prefix is the prefix of CoLOS groups created in the

identity platform (e.g., If the group name is CoLOS_Administrator,
then the group prefix is CoLOS_).

Leave the Group Prefix field blank if there is no prefix.

3. Click Test, enter your credentials, Click Sign on.

72/75
 Authentication needs to be successful in Test Information

4. Restart the CoLOS application, then log in using your OKTA credentials.

Click CoLOS User Login to login with your CoLOS login credentials.

The below section explains the standard procedures for logging into applications via OKTA
tiles, as well as the methods to launch applications with specific parameters.

Using OKTA Tiles for Application Access

Accessing the OKTA End USer Dashboard
To view and launch applications configured with OKTA, follow these steps:
1. Log in to the OKTA portal using your credentials.

2. Click the End User Dashboard button at the top- right corner of the page .

Result: The OKTA End User Dashboard opens, displaying all active apps configured
with OKTA for your account.

To launch the CoLOS Administrator app:

3. From the End User Dashboard Click CoLOS Administrator tile.

4. A new browser tab will open, prompting you to click the Open button.

73/75
 Result: The CoLOS Administrator application will be invoked, and you can begin using
the app.

To launch the CoLOS Administrator app:

To launch any other web application, such as PUI, follow these steps:
5. Click the appropriate app tile (e.g., PUI) from the OKTA End User Dashboard.

Result: The application will open in a new browser tab without requiring additional cre-
dentials.

The roles and permissions assigned within each application will be the
same as the roles configured for the logged-in user in OKTA.

Launch Web app using parameters

In certain cases, you may need to launch a web application with specific parameters, such as
station, language, or touchscreen settings. Follow these steps:
1. Go to the OKTA End User Dashboard Click on Add Apps button.

.
2. In the Search bar, type Bookmark, then click Bookmark button that apperas in the
search results.

74/75
 3. Add the required URL and app name. For example
o (https://Servername:8084/?Language=XLanguage)
o App name= CAT_XLanguage
Click Add bookmark.

Result: A new shortcut will appear as an OKTA tile in your dashboard. Clicking this tile
will launch the application with the parameters specified in the URL.

This document outlines the step-by-step process for integrating CoLOS applications with
OKTA using SAML 2.0, ensuring proper configuration and assignment of certificates, groups,
and users and standard procedures for logging into applications via OKTA tiles, as well as the
methods to launch applications with specific parameters

75/75