Configure Okta SAML Single Sign-On for ScreenMeet
Overview
This article explains how to configure Okta as a SAML identity provider for the ScreenMeet Agent Portal. It is written for Okta administrators who are setting up ScreenMeet single sign-on for the first time.
Configuration happens in two places. You complete the Okta side yourself, then send three values to ScreenMeet Support so a SAMLConnector can be created for your organization. Single sign-on does not function until both sides are in place.
Prerequisites
- Administrator access to your Okta tenant
- The ScreenMeet SAML encryption certificate,
screenmeet.cert, available from ScreenMeet Support
Step 1: Install the ScreenMeet Okta application
- Sign in to your Okta Admin Console as an administrator.
- Go to Applications and then Browse App Catalog.
- Search for ScreenMeet and select the ScreenMeet integration.
- Click Add Integration, then click Done on the General Settings screen.
Step 2: Upload the ScreenMeet encryption certificate
The Okta application requires a service provider encryption certificate before it can build a SAML assertion for ScreenMeet. Without it, single sign-on fails at Okta with a 400 Bad Request error.
- Go to Applications, select ScreenMeet, and open the Sign On tab.
- Click Edit in the Settings section.
- Locate the Encryption Certificate field and click Browse.
- Select
screenmeet.cert, then click Upload. - Confirm the field displays
screenmeet.cert (CN=*.screenmeet.com).
*.screenmeet.com. The same certificate applies to every ScreenMeet customer. Request it from ScreenMeet Support if you do not already have it.Step 3: Configure the Roles attribute
The Okta application must be configured to pass a role value in the SAML assertion. Leave this set to None and single sign-on will fail even when the encryption certificate is present.
- In the same Sign On edit view, locate the Roles field.
- Open the dropdown and select Matches Regex.
- In the adjacent text field, enter
.*without quotation marks. - Click Save.
400 Bad Request error at sign-in.Step 4: Create groups and assign the application
Assign the ScreenMeet application to Okta groups rather than to individual users. With group-based assignment, adding a user to a group grants ScreenMeet access automatically, with no per-user assignment step.
Create the groups
Go to Directory, then Groups, and create the following groups.
| Group | Purpose | Naming requirement |
|---|---|---|
OrgAdmin | Administrators who manage ScreenMeet settings and can view and edit other users | Exact name required |
Supervisor | Users who can view other users in the organization | Exact name required |
Agent group, for example SM Agents | Standard agents who need ScreenMeet access without elevated permissions | Any name |
OrgAdmin and Supervisor group names from the SAML assertion to grant elevated permissions in the Agent Portal. The agent group name carries no special meaning to ScreenMeet; it exists only to manage application assignment in Okta.Assign the application to the groups
- Open the Assignments tab on the ScreenMeet application.
- Click Assign and select Assign to Groups.
- Assign the application to
OrgAdmin,Supervisor, and your agent group.
Provision users
Add each administrator to the OrgAdmin group. Add standard agents to your agent group, either individually or through automation.
- Manual: Open the group in Directory, then Groups, and add members directly.
- Automated: Use Okta group rules (Directory, Groups, Rules) or an existing directory integration to place users into the group automatically based on attributes such as department or title.
A user who is not assigned the application, directly or through a group, generates an unauthorized access failure in the Okta System Log when they click the ScreenMeet tile.
Step 5: Send your identity provider values to ScreenMeet
- Go to Applications, select ScreenMeet, open the Sign On tab, and click View SAML setup instructions.
- Record the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 Certificate.
- Email all three values, along with the name of your organization, to support@screenmeet.com.
ScreenMeet creates a SAMLConnector that accepts authentication requests from your Okta tenant. Sign-in attempts fail until this is complete.
Step 6: Grant elevated permissions
Elevated permissions in the Agent Portal come from membership in the OrgAdmin and Supervisor groups created in Step 4. Add users who need those permissions to the appropriate group.
| Group name | Permission granted |
|---|---|
OrgAdmin | Can view and edit other users in the organization |
Supervisor | Can view other users in the organization |
Verification
- Open a private browsing window and sign in to your Okta portal as an assigned user.
- Confirm the ScreenMeet tile appears on the dashboard.
- Click the tile and confirm you reach the ScreenMeet Agent Portal without an error page.
- For a user in the
OrgAdminorSupervisorgroup, confirm the additional portal functionality is present.
Troubleshooting
400 Bad Request at sign-in
Okta cannot build the SAML assertion for ScreenMeet. Confirm the encryption certificate is uploaded (Step 2) and the Roles field is set to Matches Regex with a value of .* (Step 3). Both settings must be in place.
Unauthorized access failure in the Okta System Log
The user is not assigned the ScreenMeet application. Add the user to a group that has the application assigned, or assign the application to the user directly (Step 4).
Sign-in fails for all users after previously working
A new SAML signing certificate was likely generated in Okta. Send the current X.509 Certificate to support@screenmeet.com so the SAMLConnector can be updated (Step 5).
Elevated permissions do not appear
Confirm the user is in the OrgAdmin or Supervisor group with the exact group name, then have the user sign out of ScreenMeet and sign back in (Step 6).