Ideagen Luminate logo Ideagen Luminate logo
Navigation
Need help?
Send feedback
Sign in
This page does not meet FedRAMP security standards. Please avoid entering sensitive or classified information. Learn more
Learn more
Learn more

Looking for help?

Common queries

View all

Send us feedback

Megaphone illustration

Before you start

This form is for Ideagen Luminate feedback only. Your submission will not receive a response.

Looking for support? Select the solution you need help with and open a ticket with us.
New article Recently updated

[Example] Configuring Okta for Single Sign-On (SSO)

By Alan Blair
  • Last updated
⌘ K
Search this article
Print this article
Who is this article for?

IT Administrators implementing Single Sign-On (SSO).

IQM v7.6.1 and IQM Mobile v2.6.0 are required.

Ideagen Quality Management Single Sign-On (SSO) allows end users to authenticate with Windows and Web clients via Single Sign-On with Okta.

This article outlines the steps required to configure Okta for Ideagen Quality Management Single Sign-On (SSO). Please select a tab to walk through the steps for each.

We do not directly support he configuration of Okta. These steps are provided as a guide only to assist in the configuration. Before you begin please ensure your Ideagen Quality Management is using SSL for secure connections.

We are aware of an incompatibility requiring access to the Okta API Admin feature to set up the provider.
We are working on a fix in future releases, 7.6.2 (December 2024) and 7.7.1 (TBC), to remove this requirement.

1. Overview

In version 7.6.1 and above, you will be asked to enter Scope information into the system when configuring the Single Sign-On options. Below is a table listing the different scopes for different parts of the application.
Application openid email profile userinfo offline_access User.Read
Web ✓ ✓ ✓   ✓  
Windows Client ✓ ✓ ✓   ✓  
Mobile ✓ ✓ ✓   ✓  
Scopes are case sensitive and need to be separated by a space when entered into the system (e.g. openid email profile)

2. Creating a scope

To create a scope:

  1. Log in to Okta.
  2. Select Security.

Click 'Security'

  1. Navigate to API settings.

Click 'API'

  1. Select the Default option.

Click 'default'

  1. Switch to the Scopes tab.

Click 'Scopes'

  1. Click Add Scope.

Click 'Add Scope'

  1. Enter a Name, Display Phrase, and Description.
    In this example, we used userinfo.

Example

  1. Tick Include in public metadata.

Click 'Include in public metadata'

  1. Click Create.

Click 'Create'

  1. Switch to the Claims tab.

Click 'Claims'

  1. Click Add Claim.

Click 'Add Claim'

  1. Enter the Name as upn.

Fill 'upn'

  1. Set the Value to appuser.email.

Click 'Value'

  1. Click Create.

Click 'Create'

  1. Click Add Claim.

Click 'Add Claim'

  1. Enter the Name as email.
  2. Set the Value to appuser.email.
  3. Click Create.

Click 'Create'

  1. Click Add Claim.

Click 'Add Claim'

  1. Enter the Name as given_name.
  2. Set the Value to appuser.given_name.
  3. Click Create.
  4. Click Add Claim.

Click 'Add Claim'

  1. Enter the Name as family_name.
  2. Set the Value to appuser.family_name.
  3. Click Create.

1. Integrating for Web

To integrate Okta for Web:

  1. Log in to Okta.
  2. Select Applications.

Click 'Applications'

  1. Click Create App Integration.

Click 'Create App Integration'

  1. Select OIDC - Open ID Connect.

Enable 'OIDC - OpenID ConnectToken-based OAuth 2.0 authentication for Single Sign-On (SSO) through API endpoints. Recommended if you intend to build a custom app integration with the Okta Sign-In Widget.'

  1. Choose Web Application for the Application type for server-side handling of authentication.

Enable 'Web ApplicationServer-side applications where authentication and tokens are handled on the server (for example, Go, Java, ASP.Net, Node.js, PHP)'

  1. Click Next.
  2. Enter App integration name as IQMP Web Application.

Fill in the appropriate application name

  1. Tick Refresh Token under Grant type.

Enable 'Refresh Token'

  1. Expand Advanced.

Expand advanced options

  1. Tick Implicit (hybrid).

Enable 'Implicit (hybrid)'

  1. Set Controlled access to Allow everyone in your organization to access.

Enable 'Allow everyone in your organization to access'

  1. Tick Enable immediate access with Federation Broker Mode.

Ensure 'Enable immediate access with Federation Broker Mode' is enabled

  1. Click Save.
  2. Access General Settings.

Click 'General Settings'

  1. Click Edit.

Click 'Edit'

  1. Tick Allow wildcard in login URI redirect.

Click 'Allow wildcard in login URI redirect.'

  1. Set the Sign-in redirect URIs to the address of your Web interface.
    This is usually in the format of http://servername/qpulse.

Replace the field with QPulse Web Application URI

  1. Click Add URI.

Click 'Add URI'

  1. Enter the Web interface address with the name of your database as a sub-domain.
    It should look like http://default.servername/qpulse.

Fill in QPulse website URI with the database name. Replace value where necessary. e.g.: 'https://{databaseName}.{domainName}/QPulse/'

  1. Click Add URI.

Click 'Add URI'

  1. Enter the Web interface base URI with Authenticate.aspx appended at the end.

Fill in QPulse application authenticate URI. Replace value where necessary. e.g.: 'https://{domainName}/QPulse/Authenticate.aspx'

  1. Set the Sign out redirect URI to the following, replacing value where necessary: https://{domainName}/QPulseIdentityServer/identity/auth/databaseselection?langCd={langCode}.

Fill in QPulse application sign out redirect URI. Replace value where necessary. e.g.: 'https://{domainName}/QPulseIdentityServer/identity/auth/databaseselection?langCd={langCode}

  1. Click Save.

1. Integrating for Windows

To integrate Okta for Windows:

  1. Log in to Okta.
  2. Select Applications.

Click 'Applications'

  1. Click Create App Integration.

Click 'Create App Integration'

  1. Select OIDC - Open ID Connect.

Enable 'OIDC - OpenID ConnectToken-based OAuth 2.0 authentication for Single Sign-On (SSO) through API endpoints. Recommended if you intend to build a custom app integration with the Okta Sign-In Widget.'

  1. Choose Native Application for the Application type.

Enable 'Native ApplicationDesktop or mobile applications that run natively on a device and redirect users to a non-HTTP callback (for example, iOS, Android, React Native)'

  1. Click Next.
  2. Enter App integration name as IQMP Native Application.

Fill in the appropriate application name

  1. Tick Refresh Token under Grant type.

Enable 'Refresh Token'

  1. Expand Advanced.

Expand advanced options

  1. Tick Implicit (hybrid).

Enable 'Implicit (hybrid)'

  1. Set Controlled access to Allow everyone in your organization to access.

Enable 'Allow everyone in your organization to access'

  1. Tick Enable immediate access with Federation Broker Mode.

Ensure 'Enable immediate access with Federation Broker Mode' is enabled

  1. Click Save.
  2. Access General Settings.

Click 'General Settings'

  1. Click Edit.

Click 'Edit'

  1. Tick Allow wildcard in login URI redirect.

Click 'Allow wildcard in login URI redirect.'

  1. Enter the Sign-in and Sign out URIs.

Replace the field with QPulse Domain URI

  1. Click Save.

What do you think about this article?

Your feedback helps us improve

More articles in this section

Looking for more help? Ask the Community

On this page