Single Sign-On with Okta

This guide provides step-by-step instructions on setting up Okta as a SAML IdP for your Cloudsmith Organization.

Adding Cloudsmith to Okta

Cloudsmith is not yet an integrated application in Okta. You'll have to add Cloudsmith manually so you can configure SSO.

Step1

Log into Okta and click "Applications" and then "Create App Integration"

1588

You will then see a modal window pop up where you define the application details

Step2

Select SAML 2.0 and click next:

948
Step3

On the next screen (General Settings), enter the App name as "Cloudsmith". (You can optionally add the Cloudsmith logo too for easier visibility, you can find hi-res versions of the logo here):

1043
Step4

Next, we'll configure SAML settings. To determine your Single sign on URL use the following format:

https://cloudsmith.io/orgs/{ACCOUNT}/saml/acs/

Where {ACCOUNT} is your Cloudsmith organization identifier (slug).

We use the same URL for the Audience URI value.

For Name ID Format choose "EmailAddress"
For Application username choose "Email".

2036
Step5

Next, we'll configure Okta to also send the user's first and last names during sign-in:

1434

Then click the blue Next button at the bottom of the page.

Step6

Fill out the Feedback section on the next page and click the blue Finish button:

2084
Step7

Your application is now configured on Okta and you can add users and groups as required using the Assignments tab of your application management screen:

1530

Providing configuration to Cloudsmith

Once configured as above, you'll need to provide metadata to Cloudsmith to connect to your newly configured IdP.

In the Sign On tab of your application management screen, you can see a link to view the IdP metadata (under SAML Signing Certificates):

2008

Copy this metadata and add it to your Cloudsmith organization SAML settings as Inline XML.

You can then enable SAML authentication in your Cloudsmith organization, and you can use Okta to begin logging in straight away.

You'll be able to access the landing page of your organization at the following URL:

https://cloudsmith.io/orgs/{ACCOUNT}/saml/login/

Where {ACCOUNT} is your organization's slug/identifier (what you would normally see in the URL when accessing your organization within Cloudsmith). If you're unsure what this is, please just contact us!

You can also optionally set up SAML Group Sync mappings to automatically map OKTA groups to teams in your Cloudsmith organization, and SCIM de-provisioning to remove users.

SAML Group Sync

Once SAML has been setup, group sync can then be configured in order to automatically assign teams from your OKTA directory to Cloudsmith.

In order to get started, go to your Cloudsmith application in OKTA and click on the General tab:

Under SAML Settings click Edit:

Click Next to proceed to step 2 and under A section on the very bottom (Group Attribute Statements) insert the name of the group from Okta along with the valid filter, for example, a group called "Dev" in OKTA will look like this:

The attribute for the group:

Once all desired groups are inserted, on Cloudsmith, the name and value will be the same as the group attribute created in OKTA:

📘

To test SAML Group Sync, the user must re-log for the sync to apply.

SCIM De-provisioning

You can use SCIM to automatically de-provision users from your Cloudsmith organization whenever you remove a user assignment for the Cloudsmith application in Okta

To set this up, you first enable SCIM for the Cloudsmith application in Okta on the "General" tab:

1087

Okta Enable SCIM

You then use the "Provisioning" tab to configure SCIM as follows:

1055

Okta Configure SCIM

SCIM Connector base URLhttps://api.cloudsmith.io/scim/v2
Unique Identifier for usersemail
Supported provisioning actionsPush Profile Updates
Authentication ModeBasic Auth
Basic Auth Usernametoken
Basic Auth PasswordPlease see your Organization Account Settings on Cloudsmith for your SCIM password.

Then test and save the configuration. Once saved, you can then enable the "Deactivate Users" functionality via the "Provisioning" tab:

Okta is now configured to de-provision users from your Cloudsmith organization when you remove the application assignment for them in Okta.


Cloudsmith is the new standard in Package / Artifact Management and Software Distribution

With support for all major package formats, you can trust us to manage your software supply chain.


Start My Free Trial Now
Cookie Declaration (Manage Cookies)