Skip to content

single-sign-on-sso.md

Latest commit

 

History

History
175 lines (113 loc) · 6.57 KB

single-sign-on-sso.md

File metadata and controls

175 lines (113 loc) · 6.57 KB
description This page describes how to set up SSO with the Duplicati Console, using Okta as an example

Single Sign-On (SSO)

For this guide we will be looking at setting up an application and also possibly configuring an access policy for the authorization server in Okta. While this guide is using Okta as an example, other OIDC or SAML2 providers, including Azure, can be used as well.

{% hint style="info" %} SSO is an additional Enterprise feature. Contact Duplicati sales or support if you need SSO enabled for your license or trial {% endhint %}

Create a Duplicati application in Okta

  1. Sign in to your Okta account.
  2. Navigate to the Admin page.
  3. In the left menu, select Applications.

{% hint style="info" %} Ensure you have an Okta account available with super admin rights. {% endhint %}

Choose sign-in method and application type

In the daiglog for creating the application, choose these two options:

  • Sign-in method: OIDC - OpenID Connect
  • Application type: Web Application

Then click Next.

Configure the Duplicati application in Okta

  1. Choose a suitable application name, such as Duplicati.
  2. Note that Sign-in redirect URIs must be provided later — leave it at default for now.
  3. Set controlled access, preferably limiting access to selected groups for better control.

Configure Access Policies for the Duplicati application in Okta

  1. Go to Security → API.
  2. Here you can:
    • Retrieve the Metadata URI needed for SSO configuration in Duplicati.
    • Verify existing access policies.

If no access policies are present, or you want another one:

  1. Click Add New Access Policy.
  2. Configure it to match your security requirements.

Add Okta SSO to Duplicati

  1. In the Duplicati Console, go to the Settings page.
  2. Click the SSO tab.
  3. The bold SSO name (example shown as “SSO Demo”) is case-sensitive and is required later at login.
  4. Click New SSO Configuration and choose Add OIDC.

{% hint style="info" %} If the SSO tab is not visible, SSO may not be enabled for your organization; contact Duplicati sales or support. {% endhint %}

Configure the OIDC connection in Duplicati Console

To configure OIDC, fill in values from the Okta application.

  • Name: Used to identify the login method for users. A suggested name is Okta.
  • Notes: Free text, only used in this dialog.
  • Default security group:
    New users must be assigned to a group to join the organization.
    Select the standard owner group created with the organization.

{% hint style="info" %} The default group affects only users who have not yet logged in to Duplicati Console. It will not change the group(s) of existing users. {% endhint %}

Enter Client ID, Client Secret, and Metadata URI

  1. In Okta, open your application page.
  2. Copy:
    • Client Id
    • Client secret
  3. Paste both into the Duplicati Console OIDC dialog.

Metadata URI

  1. In Okta, go to Security → API → Settings.
  2. Copy the Metadata URI and paste into the metadata address field in Duplicati.

If Metadata URI is not shown (some Okta plans):

Use your Okta domain (from the Okta URL or Issuer field) in:

https://{yourOktaDomain}/.well-known/openid-configuration

Initial configured OIDC dialog

Your configuration should look similar to the example shown in the guide once the fields are filled.

Updating Okta for the connection

When creating the Okta app earlier, the redirect URI was left at default because it wasn’t available yet. Now we will update it.

Obtain the redirect URI

  1. In Duplicati Console, open the SSO configuration list.
  2. For the relevant SSO configuration, open the action menu.
  3. Click the copy button to copy the redirect URI.

Configure redirect URI in Okta

  1. In Okta, open your application front page.
  2. Scroll to General Settings.
  3. Click Edit.
  4. Paste the redirect URI into Sign-in redirect URIs.
  5. Click Save.

Sign in with Okta SSO

Once configured, you can log in with Okta.

Add Okta login to your existing account

  1. In Duplicati Console, go to your Account page.
  2. Click Add login account.
  3. Choose the new Okta integration.

This allows your current account to be accessed with either login method.

New users logging in with Okta

  1. Log out of Duplicati Console.
  2. On the login screen, choose Sign in with SSO.
  3. Enter your organization’s SSO name (case-sensitive).
    • The name appears on the SSO configuration page.
    • If not, obtain it from Duplicati Inc.
  4. After entering a valid name, you’ll see available login options.
    • Typically there is one option, but multiple can be configured.
  5. Click the login button to be redirected to Okta and complete sign-in.