Configuring Okta SSO for AppCheck

1. Raise a ticket with AppCheck Support to have the SSO feature enabled for your account.
2. Wait for the ticket to be completed.
3. Open Log into Okta admin site
4. Open two tabs/windows (in addition to this guide):
   • Your Organisation settings page in the AppCheck scanner portal
     • Select the SSO Settings tab in the left-hand menu.
   • Your Okta admin portal
5. In your Okta tab Navigate to Applications in the left-hand panel
6. Click Create App Integration
7. Select SAML 2.0, and press Next
8. Provide a name for the new app integration, eh "AppCheck"
9. Tick Do not display application
10. Click Next
11. Copy the Entity ID and Reply URL from the Service Provider Details section of your AppCheck tab and paste them into the matching fields in Okta (Audience URI, and Single sign-on URL)
12. In your Okta tab, change the Name ID format field to "EmailAddress"
13. Change the Application username field to "Email"
14. In your AppCheck tab, download the X.509 Certificate
15. In your Okta tab, upload the certificate to the Signature Certificate field, and tick the Signed Requests checkbox
16. Optional: If you want to enable encryption for the assertions, change Assertion Encryption to "Encrypted", and upload the same X.509 Certificate you used for the signature to the Encryption Certificate field
17. In your Okta tab, in the Attribute Statements section, create entries for givenname and surname. These should point to the user's first and last name
18. Click Next to save and finish your Okta app configuration
19. Under the Sign On header, find the Metadata URL
20. Copy this URL, and in your AppCheck tab, in the Identity Provider Settings section, click Upload XML Metadata, and paste the URL into the URL field.
21. Press upload.
22. In your Okta tab, assign some users to the Okta app. These are the users that will be able to sign into AppCheck with SSO.  This list can be amended later.
23. In your AppCheck tab click Test SAML Config
24. Wait for the test to succeed
25. Tick Enable SAML authentiation
26. Click Update

Users whose email addresses match an assigned user in the Okta application can now sign in to AppCheck without being asked for their AppCheck password.  If they are not already logged in to an Okta account in that browser session they will be redirected to Okta to log in.