Table of Contents

Prerequisites

If the SSO feature is enabled, the following restrictions and notes apply.
Please review the information below before proceeding with the configuration.

• Login Method
  After SSO is enabled, login using the conventional user ID and password will no longer be available.
  If you wish to disable the SSO feature, please contact us again.
• Authentication Method
  After SSO is enabled, the Kuranosuke optional multi-factor authentication feature will no longer be available.
• NameID (Username) Changes
  If the NameID (username) is changed in Okta after SSO usage has started,
  please notify us of the updated information.
• User Provisioning
  User provisioning, including Just-In-Time (JIT) provisioning, is not supported.

Supported Features

• SP-Initiated
• IdP-Initiated

For details on the supported features, please refer to the Okta Glossary .

Configuration Steps

1. Please contact Kuranosuke Support or your assigned sales representative regarding the use of SSO.
   We will provide you with the “Single Sign-On Configuration Information” required for SSO setup.
2. Once you have received the “Single Sign-On Configuration Information,”
   please follow the steps below to create an application in Okta.
   • 2-1 Log in to Okta using an account with permission to create applications
   • 2-2 Navigate to Applications > Applications and select “Browse App Catalog”
   • 2-3 Search for and select “Kuranosuke”
   • 2-4 Click “Add Integration”
   • 2-5 Copy and enter the Domain and UserPool ID provided in the “Single Sign-On Configuration Information”
   • 2-6 Click “Done”
   * After completing the above steps, the metadata URL will be automatically generated.
   • 2-7 Open the “Sign On” tab and set Settings > Sign On Method > SAML 2.0 > Default Relay State by copying the Default Relay State value from the “Single Sign-On Configuration Information”
   • 2-8 Assign users and groups

Notes

Please ensure that the items configured in the steps above exactly match
the information provided in the “Single Sign-On Configuration Information.”
If these values do not match, SAML authentication to Kuranosuke will not function correctly.

• Applications > Applications > Kuranosuke > General > App Settings
  “Domain”, “UserPool ID”
• Applications > Applications > Kuranosuke > Sign On > Settings > Sign On Method > SAML 2.0
  “Default Relay State”
• The following attributes are supported as Attribute Statements.

  Attribute Name	Value
  email	user.email

3. Please complete the required fields in the “Single Sign-On Configuration Information” and return it to us.
   • Metadata URL (Required)
     Applications > Applications > Kuranosuke > Sign On > Settings > Sign On Method > Metadata URL This is a unique URL automatically generated when the application is created. Please copy it as-is and enter it in the form.
   • SAML Certificate Expiration Date (Required)
     Applications > Applications > Kuranosuke > Sign On > SAML Signing Certificates Please enter the expiration date of the certificate with an active status.
   • Username (Required)
     Applications > Applications > Kuranosuke > Assignments Please enter the username assigned to Kuranosuke (the default is the email address).
     Please ensure that the username has not been individually modified during assignment.
     If it has been changed, the modified value will be used as the username in Kuranosuke.
4. Once the Okta configuration has been completed on the Kuranosuke side, we will send you an email to notify you that the service is ready for use.

SP-initiated SSO

1. Navigate to the Kuranosuke login screen from your browser.
   * The URL is included in the service start notification email.
2. Click the “Log in with Okta” button
   * If you are not logged in to Okta, you will be prompted to log in before accessing Kuranosuke.
3. If authentication is successful, you will be redirected to the Kuranosuke main screen.

Help

If you have any questions or issues regarding the configuration, please contact Kuranosuke Support.