How To

• 1: Call Manhattan Active® API
• 1.1: Authenticate to Manhattan Active® API
• 1.2: Call Manhattan Active® API from your code
• 1.3: Call Manhattan Active® API using Postman
• 1.4: Manhattan Active® API Reference
• 2: Configure login modes
• 3: Configure Data Stream for Google PubSub
• 4: Configure OAuth Clients
• 4.1: Access Management 1.0
• 4.2: Access Management 2.0
• 5: Configure Identity Providers
• 5.1: Configure Okta SAML 2.0 IdP for JIT
• 5.2: Configure Okta OIDC IdP for JIT
• 5.3: Configure Azure Identity Providers

1 - Call Manhattan Active® API

Manhattan Active® API follows the REST architectural style. Our API has predictable resource-oriented URLs, accepts and returns JSON, and uses standard HTTP response codes, authentication, and verbs.

What’s next

1.1 - Authenticate to Manhattan Active® API

Before you begin

Before authenticating to an API, it is necessary to have an authorized user (OAuth resource owner) and an OAuth client.

Authentication information

Manhattan Active® API supports the following OAuth 2.0 authorization grants (OAuth flows):

• Authorization Code Grant (web server flow)
• Resource Owner Password Credentials Grant (password flow)

Please contact your organization’s Manhattan Active® Platform administrator for the following OAuth settings:

Authenticate from your code

For access to Manhattan Active® API from your software, please see Call from your code

Authenticate using Postman

For access to Manhattan Active® API from Postman, please see Call using Postman

What’s next

To learn more about calling an individual Manhattan Active® API, please see the REST API documentation in our product sites:

• MA Active Supply Chain
• MA Active Omni

1.2 - Call Manhattan Active® API from your code

This how-to guide will walk you through a very simple Python command line utility (CLI). The utility will obtain an access token for Manhattan Active® API using the OAuth 2.0 Resource Owner Password Credentials Grant. That token will then be used to call the following to get information for the authenticated user:

GET /api/organization/user/allDetails/userId/

Before you begin

Before beginning, please assemble the authentication information.

Obtain an access token

The OAuth 2.0 Resource Owner Password Credentials Grant (direct access) may be used to obtain an API access token. The token endpoint may be called as follows:

def access_token(client_id, client_secret, token_url, username, password):
    """Return access token for Manhattan Active® API using the resource owner password credentials grant

    Conforms to https://datatracker.ietf.org/doc/html/rfc6749#section-4.3

    Must authenticate to token endpoint with client credentials:
    https://datatracker.ietf.org/doc/html/rfc6749#section-3.2.1

    Args:
      client_id (str): client identifier <Consult your Administrator to obtain one>
      client_secret (str): client password <Consult your Administrator to obtain one>
      token_url (str): endpoint to obtain access token
      username (str): the resource owner username
      password (str): the resource owner password

    Returns:
      string: access token

    Raises
       HTTPError:  http error
    """

    # Access Token Request:  https://datatracker.ietf.org/doc/html/rfc6749#section-4.3.2
    response = requests.post(token_url, data={
        "grant_type": "password",
        "username": username, "password": password},
        auth=(client_id, client_secret))
    response.raise_for_status()
    return response.json()["access_token"]

Call an API

To call the API, obtain an access token above and place it in the Authorization header as a Bearer token:

url = api + "/organization/api/organization/user/allDetails/userId/" + username

response = requests.request(
    "GET", url, headers={'Authorization': 'Bearer ' + token}, data={})
response.raise_for_status()

print(json.dumps(response.json(), indent=2))

Run the code

Download the source code

Download the user.py python source code.

Install requests module

python3 -m pip install requests==2.27.1 

Set environment variables

Environment variables may be used to store common information:

For example:

export ACTIVE_USERNAME=user@example.com
export ACTIVE_CLIENT_ID=<Custom_Client_Id_Created_By_Your_Administrator>

Run CLI

Run the user.py script to obtain information for the authenticated user.

# See help for getting user info
python3 user.py -h

# Sample call (assumes ACTIVE_PASSWORD and ACTIVE_CLIENT_SECRET environment variables set)
python3 user.py \
 -c <Consult your Administrator to obtain the client_id> \
 -t https://<environment>-auth.omni.manh.com/oauth/token \
 -u user@system.com \
 -a https://<environment>.omni.manh.com

Troubleshooting

If you receive a 400 Client Error: for url: https://...-auth.omni.manh.com/oauth/token, then your username and password are invalid for the authorization server.

1.3 - Call Manhattan Active® API using Postman

This guide will walk you through the steps for invoking an example REST API exposed by Manhattan Active®. The steps below will also assist you in establishing the authorization using OAuth v2.0 for invoking the API.

Before You Begin

• Download and install Postman or an equivalent tool of your choice. If you already have Postman installed, update it to v9.0.9 or newer.
• You will need the following information from the administrator who manages the implementation of Manhattan Active® applications for you:
  1. Application URL such as https://<unique_id>.omni.manh.com or https://<unique_id>.sce.manh.com or https://<unique_id>.scp.manh.com. We will use https://example.omni.manh.com for this document.
  2. Authorization Server URL such as https://<unique_id>-auth.omni.manh.com or https://<unique_id>-auth.sce.manh.com or https://<unique_id>-auth.scp.manh.com. We will use https://example-auth.omni.manh.com for this document.
  3. Values of client_id and client_secret parameters as configured by your administrator. Your administrator will need to create a custom client_id (documented elsewhere already) to be used with Postman. The administrator can look up the value of the respective client_secret. We will refer the client_secret as <client_secret> as the value of client_secret for this document. Please use your own client_secret value exclusive for your use cases.
  4. A valid username and password for you to authenticate yourself. We will use jerrythomas@example.com and p455w0rd respectively as the username and password for this document. These are not valid credentials at all. Please use valid credentials for your purposes.
• As a sample REST API, we will use the endpoint that returns the details of your user. You may replace it with any other REST API that you have access to.

Steps

The step-by-step instructions below include the steps to obtain the authorization token for invoking the target REST API, followed by the invocation of the API.

Obtaining the Authorization Token

1. Open Postman and click on “New”

2. In the pop-up dialog, select “HTTP Request”

3. Click on the “Authorization” tab in the request section under “Untitled Request”

4. Click on the “Type” drop-down and select “OAuth v2.0”.

5. In the right-hand section, scroll down to the sub-section titled “Configure New Token”, and enter the values as shown below:

1. Token Name: my-first-auth-token
2. Grant Type: Authorization Code
3. Callback URL: https://www.getpostman.com/oauth2/callback
4. Auth URL: https://example-auth.omni.manh.com/oauth/authorize
5. Access Token URL: https://example-auth.omni.manh.com/oauth/token
6. Client ID: <client_id> should be created by your Administrator
7. Client Secret: <client_secret> should be created by your Administrator
8. Scope: leave empty
9. State: leave empty
10. Client Authentication: Send as Basic Auth header

Click the “Get New Access Token” button to fetch the token.

6. Sign in with your username and password in the pop-up dialog. The pop-up may look different from the screenshot shown below depending on the Manhattan Active® application you are using.

7. Upon a successful login, Postman will display the access token in the UI, and give you an option to use it.

8. In the “Current Token” section of your REST API request, select my-first-auth-token from the list to make use of the token you obtained.

Invoking the REST API call

1. To invoke the API to get the details of your username, set the URL to the value shown below:

http://example.omni.manh.com/organization/api/organization/user/allDetails/userId/jerrythomas@example.com

Set the HTTP method to GET. The inputs will look like this:

Verify that the “Access Token” is set to my-first-auth-token in the “Current Token” section.

Click on the “Send” Button.

2. The API response in JSON format will be displayed in the section on the bottom

You can inspect the response content and headers by switching the response tabs.

Pro Tip

With the access token, you can also invoke the API using curl as a command line option instead of Postman:

curl -L -X GET  -H 'Authorization: Bearer eyJhbGciOiJSUzI1Ni...' 'http://example.omni.manh.com/organization/api/organization/user/allDetails/userId/jerrythomas@example.com'

Learn More

• Concept Guides
• Quick Starts

1.4 - Manhattan Active® API Reference

To learn more about calling an individual Manhattan Active® API, please see the API documentation in our solution sites:

• Manhattan Active Omni®
• Manhattan Active Supply Chain
• Manhattan Active Platform®

2 - Configure login modes

Objective

Manhattan Active® Platform Auth Server has administrative user interface to configure or modify several aspects of security such as the authentication and login modes and OAuth client setup. This document describes how you can configure the login modes for authenticating to Manhattan Active® Platform.

Before You Begin

You will need access to the Manhattan Active® Platform application, and a System Administrator role to configure security properties in the Auth Server user interface.

Manhattan Active® Cloud standardizes authorization with OAuth2 for all inbound HTTP traffic. For identity provisioning and active directory integration, Manhattan Active® Cloud supports a variety of authentication modes with Open ID and SAML:

• External Authentication Mode with Open ID is a login configuration where the user is exclusively authenticated via an external Identity Provider using Open ID as the identity protocol. In this mode, all users are maintained by the external Identity Provider.
• External Authentication Mode with SAML is a login configuration where the user is exclusively authenticated via an external Identity Provider using SAML as the identity protocol. In this mode, all users are maintained by the external Identity Provider.
• Mixed Authentication Mode with User Discovery is a login configuration where the user identity is managed either in the Native authentication source by Manhattan Active® Cloud, or by an External Identity Provider with Open ID or SAML. The determination for the authentication mode for the actual user is made in real-time when the user attempts to log in, based on the user’s username. In this mode, the user is first prompted to enter their username, and the UI then redirects to the authentication mode configured for that user.
• Native Authentication Mode is a login configuration where the user is exclusively authenticated by Manhattan Active® Cloud. In this mode, the user directory, and credentials (in the form of usernames and passwords) are maintained in Manhattan Active® Cloud database. Users that are maintained with the native authentication mode are referred to as native users to distinguish them from the users that are maintained in the corporate directory. If no other authentication mode is configured, Native Authentication Mode is the default configuration.

Manhattan supports known Open ID and SAML Identity Providers for configuring as the External Authentication Mode. Integration with the IDPs listed below has been tested and supported:

• Microsoft Azure AD: Open ID & SAML
• ADFS: Open ID & SAML
• Okta: Open ID & SAML
• CA SiteMinder: Open ID
• Ping Identity: Open ID
• MITREid: Open ID
• KeyCloak: Open ID & SAML
• IBM Security Access Manager: SAML

Do note, that IDPs may have their nuances - not all IDPs support the full Open ID and/or SAML standards or may support additional features that are not part of the standards. In such cases, Manhattan offers technical support and consulting to accommodate the testing and validation necessary for a specific IDP to fully integrate with Manhattan Active® Cloud.

To access the administration UI, go to your Auth Server URL (https://<stack_name>-auth.<domain_name>). After you log in, you should see the Administration option as a button that you can use to navigation to the administration UI:

The admin panel is accessible only to the users with the System Administrator role.

There are two main concepts that are important to understand:

Authorization providers

An authorization provider is a configuration for an external identity provider. For example, you could have the following authorization providers stored in the Auth Server configuration:

• OpenID with Okta
• Backup OpenID with Okta
• OpenID with Azure
• SAML external IDP

One of these providers could be used when setting the identity type to external or mixed.

Login mode

The login mode defines how your users will authenticate in the Auth Server.

• Active login mode will be loaded on the Auth Server startup and defines how the users authenticate.
• Pending login mode will be marked when setting a new login mode. If there is a pending login mode when the Auth Server starts it will be marked as Active and the previous Active login mode will be marked as Inactive.

Steps

1. Click on Configure Login Mode

2. Select the identity type between database, external or mixed and click Next

3. If you choose external or mixed in Step 2, it will show the list of available providers. You can also add new ones. Click on Add Authentication Provider to add a new one and select the protocol.

4. You can also click Show Templates to see predefined providers

5. Select a template

6. This will copy the pre-configured parameters, you will have to provide a unique Name that cannot be edited later. Click on Save button

7. This will create a provider. You can view it under Authentication Providers tab

8. The new login mode will be Pending until the next restart of the Auth Server.

Global Properties

There are other properties that are not exclusive of either OpenId or SAML. In the Global properties tab you can edit these properties.

Note that these properties will only be loaded when manh.security.dbmode=true and a proper login mode is configured. Properties can be of three types: string, number or boolean.

Learn More

• Concept Guides
• Quick Starts

Author

• Shipra Choudhary: Senior Software Engineer, Security, Manhattan Active® Platform, R&D.

3 - Configure Data Stream for Google PubSub

Objective

This guide will walk you through the steps for enabling the Data Streaming from Manhattan Active® to Google Cloud Pub/Sub endpoint owned and managed by the customer. The below steps also guides authorization and network access required to post events to this Pub/Sub endpoint.

Gravina is Manhattan Active® Platform’s data replication solution to provide most real-time data streaming service to target systems. It provides set of distributed services that capture row-level changes in databases so that applications can see and respond to those changes. DataStream utilizes JSON for exchanging data between internal & external components.

Google Cloud Pub/Sub provides messaging between applications. Cloud Pub/Sub is designed to provide reliable, many-to-many, asynchronous messaging between applications. Publisher applications can send messages to a “topic” and other applications can subscribe to that topic to receive the messages.

Before You Begin

• Deployment model:

  • The current scope of this document considers the target Google Cloud Pub/Sub, is owned and managed by Customer. To meet customer business and preferences, we continue to extend our ability to support multiple deployment models.

• Target Google Cloud Pub/Sub configuration:

  • Google Project: Customer owned Google project.
  • Region/Location: Google Cloud Pub/Sub is Global Service. but, we prefer to have both producer and subscriber in the same region.
  • Pub/Sub topic name ( Optional ): Any preferred topic name to use. By default, Manhattan Active® uses the default gravina_cdc_stream_<customer

• Network Connectivity & whitelist:

  • Pub/Sub Targets: At present we support Google Cloud Pub/Sub.
  • Network Traffic: Since both Source and targets are managed in GCP, traffic is routed through Google backbone interface.
  • Access whitelist : If Customer Google Cloud Pub/Sub endpoint is allowed to connect only from the trusted IP sources, then Manhattan Active® Platform NAT range needs to whitelist in Customer network.

• Data inclusion list for DataStreaming

  • By default, Gravina ignores all tables for DataStreaming unless we define to include in replicator configuration.
  • Get the list of database schemas and tables required to enable for DataStream to target system.

• Subscription Strategy:

  • By default, gravina creates the default subscription which can be used by Customer Application to process the data stream events from Pub/Sub
  • Customer owns the configuration of target application subscription(s) and attach to Pub/Sub topic and processing of messages.

Steps

• Generate service-account & Key:

  • Login to Google Cloud Console –> Go to Google Cloud Project –> IAM & Admin
    • Service Accounts
    • Create Service Account : Ex: gravina-pubsub-sa
    • Go to “Keys”
    • ADD KEY –> Create New Key –> Select Key Type : JSON –> Create –> The JSON Key file gets downloaded.
    • Provide the JSON Key file to Manhattan CLoud Ops Team in secured way.

• Grant Pub/Sub Editor permissions to service-account:

  • Login to Google Cloud Console –> Go to Google Cloud Project –> IAM & Admin
    • IAM
    • Click on “ADD”
    • Give the gravina-pubsub-sa as principle & Role as “Pub/Sub Editor”
    • Save

• Provide the configuration details to Manhattan Cloud team for replicator configuration.

  • Send the Service account “JSON Key file” which have the following details
    • project_id
    • service-account-id
    • Key & secret
  • Pub/Sub Topic Name ( If any explicitly needs to configure )
  • Inclusion Table List ( If only required specific tables )

• Configure Network Access Whitelist in Customer Google Cloud project:

  • If the Customer Google project is restricted access, then Manhattan team provide the NAT IP range from which the traffic will be initiated to Pub/Sub endpoint.
  • Customer needs to whitelist the NAT IP range in Google Cloud Project to allow the access.

• Target Pub/Sub topic Subscription:

  • The configuration of subscription to topic and processing of messages are completely managed by Customer based on customer business needs.
  • By default, gravina creates the subscription which can be configured and used by Customer Application to process the data stream events from Pub/Sub topic.

• Monitoring & Alerts:

  • Google Cloud Console provides the default monitoring statistics & metrics.
    • Publish message request count.
    • Average message size.
    • Unacked message count.
    • Oldest unacked message age.
  • Customer responsible to configure the required monitoring and Alerting based on the business needs.

Learn More

• Concept Guides
• Quick Starts

Authors

• Srinivasa Rao Jammula: Director, Manhattan Active® Platform, R&D.

4 - Configure OAuth Clients

Objective

Manhattan Active® Platform Access Management has administrative screens that manage various aspects of security, including authentication, login modes, and OAuth client setup. Documents that describe OAuth client setup for external integration are based on the version of Access Management.

Identifying Access Management Version

You can identify the version of Access Management based on its URL.

When you enter the environment hostname or the Access Management hostname as the address in your browser, you will be redirected to the login page of the Access Management server.

• https://<unique_id>.<domain_name> (environment hostname)
• https://<unique_id>-auth.<domain_name> (Access Management hostname)

The URL of the login page may be used to identify the version of Access Management -

4.1 - Access Management 1.0

Objective

Manhattan Active® Platform Auth Server has an administrative user interface to configure or modify several security aspects, such as the authentication and login modes and OAuth client setup. This document describes how to set up OAuth clients for external integration and calling the REST API.

Before You Begin

You will need access to the Manhattan Active® Platform solution and a System Administrator role to configure security properties in the Auth Server user interface.

To access the administration UI, go to your Auth Server URL (https://<unique_id>-auth.<domain_name>). After you log in, you should see the Administration option as a button that you can use to navigate to the administration UI:

The admin panel is accessible only to the users with the System Administrator role.

Clicking on the “OAuth Clients” option in the menu will take you to the UI to manage the configuration for OAuth Clients.

The UI has two sections in it:

• Custom clients: includes the clients that are created by users. These clients can be edited and deleted.
• Default clients: pre-configured clients. These cannot be edited but cloned.

Steps

1. Go to Custom clients tab and click on the Add button
2. Add client details like Client Id and Client secret. The value of the Client secret will be encoded and stored. Optionally, you can set the value of Access token validity and Refresh token validity. Select appropriate Scopes and Grants for this client. For each Scope selected, you have the option if you’d like to auto-approve the requests. You can add one or more Redirect URIs and Resource Ids to this client.
3. Hit the Save button, and this creates a new client.

Learn More

• Concept Guides
• Quick Starts

Author

• Shipra Choudhary: Senior Software Engineer, Security, Manhattan Active® Platform, R&D.

4.2 - Access Management 2.0

Objective

Manhattan Active® Platform Access Management 2.0 has an administrative user interface to configure or modify several security aspects, such as the authentication and OAuth client setup. This document describes how you can set up OAuth 2.0 clients for external integration and for calling the REST API.

Before You Begin

You will need access to the Manhattan Active® Platform solution and a Maactive System Administrator role to configure security properties in the Access Management 2.0 administration user interface.

To access the administration UI, go to your Access Management 2.0 URL (https://<unique_id>-auth.<domain_name>/auth/admin/maactive/console/). After you log in, administration UI will look something like this:

The panel is accessible only to the users with the Maactive System Administrator role.

Managing OpenID Connect clients
Clients are entities that request authentication on behalf of a user. Clients come in two forms. The first type of client is an application that wants to participate in a Single Sign On. These clients are only looking for security from Access Management 2.0. The other type of client is the one that requests an access token so that it can invoke other services on behalf of the authenticated user.

Note: In case you have a custom client that you might have created in Access Management 1.0, then you will see that this client should already be migrated to Access Management 2.0. In this case, you will only need to perform client secret updation activity for the same client in the Access Management 2.0 portal. If you have the client’s secret handy, then you can go to the Credentials tab of this client and update the credentials.

If you do not have the secret value, you can create a custom client following the below steps.

Steps

Let’s see how you can create a new OpenID Connect client.

1. Under the Manage menu, click on Clients.

   

2. Click on Create client.

3. Under General Settings, leave the Client type set to OpenID Connect

   

4. Enter a Client ID
   This is an alphanumeric string that specifies ID reference in URI and tokens.

5. Enter a Name for this client.
   Specify the display name of this client.

6. You can optionally give a description of this client in the Description field.

7. Click on Save. This action will create a client for you.

8. Next, under Capability config, we have a toggle button to enable/disable Client authentication. This setting depends on the type of OIDC you would like to create.
    Select ON if the server-side clients perform browser logins and require client secrets when requesting for an Access Token.
    Select OFF if the client-side clients perform browser logins where secrets cannot be kept safe.

   

9. Select Authentication flow as needed. Hover over the question mark ? icon to show a tooltip text that describes which Access Management 2.0 Authentication Flow Maps to which OAuth2 Grant Type.

10. Click on Next.

11. Enter the Valid redirect URIs as needed.
    This is the place where the browser redirects after a successful login.
    NOTE: If you want to use Postman to get an access token using this client for Authorization Code Grant, configure this URL in the Valid redirect URI field - https://www.getpostman.com/oauth2/callback

    

12. You will be redirected to the basic client configuration page. You can review or modify any other details needed on this page.

    

13. In case the Client Authentication was set to true in step 8, you will see a Credentials tab. Click on it. Take note of the Client Secret to be used during the authentication of this created client against Access Management 2.0.

    

14. The next step is to add claims that will be sent as part of the access token, or to be returned during the user info endpoint call. Go to the Client scopes tab. A dedicated scope will be automatically created for this client. Click on this scope.

    

15. This scope will initially be empty. Here is where we need to add the user attributes. Click on Configure a new mapper.

    

16. From this list of mappings, select the User Attribute mapper.

    

17. In this example, we will see how to configure the “sub” attribute.
    Enter Name as sub.
    Enter User Attribute as sub.
    Enter Token Name Claim as sub.
    Select Claim JSON Type as String.
    Toggle ON Add to access token.
    Hit Save.

    

    We can see that the sub claim is now added to this client’s dedicated scope.

    

18. Similarly, you can add other claims as per application requirements. To add another claim, click the Add Mapper dropdown and select the By configuration option.

    

19. Repeat the same steps from 16-18 to map all the attributes (similar to sub attribute) as listed in the table below.

    User Attribute	Token Claim Name	Claim Type	Present in Access Token	Present in ID Token	Multivalued
    sub	sub	String	TRUE	FALSE	FALSE
    organization	organization	String	TRUE	FALSE	FALSE
    userOrgs	userOrgs	String	TRUE	FALSE	TRUE
    bulkOrganizationAccess	bulkOrganizationAccess	boolean	TRUE	FALSE	FALSE
    userBusinessUnits	userBusinessUnits	String	TRUE	FALSE	TRUE
    excludedUserBusinessUnits	excludedUserBusinessUnits	String	TRUE	FALSE	TRUE
    bulkBusinessUnitAccess	bulkBusinessUnitAccess	boolean	TRUE	FALSE	FALSE
    userDefaults	userDefaults	JSON	TRUE	FALSE	TRUE
    userLocations	userLocations	JSON	TRUE	FALSE	TRUE
    largeStoreAccess	largeStoreAccess	boolean	TRUE	FALSE	FALSE
    locale	locale	String	TRUE	TRUE	FALSE
    edge	edge	String	TRUE	FALSE	FALSE
    tenantId	tenantId	String	TRUE	FALSE	FALSE
    userTimeZone	userTimeZone	String	TRUE	FALSE	FALSE
    authorities	authorities	String	TRUE	FALSE	TRUE
    reporting_roles	reporting_roles	String	TRUE	FALSE	TRUE
    user_name	user_name	String	TRUE	FALSE	FALSE

20. Navigate to Scope tab of this dedicated scope and toggle OFF the Full scope allowed option.

Learn More

• Concept Guides
• Quick Starts

Author

• Shipra Choudhary: Senior Software Engineer, Security, Manhattan Active® Platform, R&D.

5 - Configure Identity Providers

Objective

Manhattan Active® Platform Access Management has administrative screens that manage various security aspects, including authentication, login modes, OAuth client setup, and Identity Provider Configuration. Documents that describe various flavors of Identity Provider Setup for external integration are based on the type of Identity Provider Integration Sought. There are two available:

• Azure Ad
• Okta.

Introduction

As a premier SaaS provider in the market, Manhattan prioritizes the security of its Active Platform software. In alignment with this commitment, we are pleased to announce the release of an enhanced version of the Manhattan Identity & Access Management (IAM) system, named Access Management 2.0. This updated version not only delivers enhanced security features but also offers improved integration capabilities with customer-owned identity platforms such as Azure and Okta. Previously, the Manhattan Active Platform supported Just In Time (JIT) user provisioning exclusively for the SAML 2.0 protocol. With Access Management 2.0, JIT support has been extended to include the OpenID Connect (OIDC) protocol as well. The subsequent sections provide comprehensive guidance, including illustrative screen captures, on configuring Access Management 2.0 alongside Azure and Okta as external Identity Providers (IdPs) for both JIT and non-JIT use cases within the OIDC protocol.

Assumptions

• The configuration screens shown for both Azure and Okta could change with time.
• This document will be kept in alignment when that happens.
• If further assistance is needed during configuring Access Management 2.0 for OIDC JIT/Non-JIT, please reach out to your Manhattan Services Representatives to seek help and report any issues with this document.

Special Note

• Access Management 2.0 creates a Local User for every external Identity Provider (IdP) User.
• After creation in the JIT Flow, such external Users are also created in the Organization Database.
• If, subsequently, the same user is deleted and recreated through the JIT process, to remove roles/orgs/locations, such deletion is:
  • First, not needed
  • Second, it blocks the same user from logging in because Access Management 2.0 cannot find the Id of the internal user
• To proceed, usually add and remove roles/org/location, and the JIT process will update the same user in the Organization DB.
• If such users must be deleted, please reach out to Manhattan Operations for a subsequent cleanup in the Access Management 2.0 DB.

5.1 - Configure Okta SAML 2.0 IdP for JIT

Objective

This page describes the Okta SAML 2.0 setup with JIT and Non JIT flows.

Integrating Access Management 2.0 with Okta SAML 2.0

This section shows how to integrate Access Management 2.0 (AM 2.0) with Okta, where Okta will serve as the Identity Provider (IdP). The protocol used for authentication is SAML 2.0. Steps involve exchanging the IdP Metadata (URL generating XML) and the Service Provider Metadata URL between the IdP and the AM 2.0 SP.

Step 1: Identity provider in AM 2.0.

• Login to AM 2.0 Admin Console. Select the maactive realm.
  

  Note: In case you have Restricted Admin Access on AM 2.0, then use the URL:

  https://<stack_name>-auth.<domain_name>/auth/admin/maactive/console/
  

  Click on the Identity Providers option from the left panel and select SAML v2.0 from the list of providers.

  

• Enter the Alias. This will be the default display name on the login page.
  Please note that the Alias forms a part of the redirect URL. In case it does not reflect, you can create the Redirect URI yourself and keep the URL handy.
  Eg. if Alias is set as - samlokta
  Redirect URI - https://localdocker:8443/auth/realms/sample/broker/samlokta/endpoint

  

• Optionally enter Display Name. This is the name that will be displayed, in case you need it to be different from the alias.

• Take note of the Service provider entity ID value from the same page.

Step 2: SAML 2.0 App Registration in Okta

• Next, we need to create an IDP in Okta. In the Okta admin page, go to Applications → Click Create App Integration.

  

• Select the SAML 2.0 radio button, and click Next.

  

• Provide the application name under the App name, and click Next.

  

• Copy Redirect URI from AM 2.0’s provider page, from Step 1. Configure this URL in the Single sign on URL field.

  

• Copy the Service Provider Entity ID from AM 2.0’s provider page, from Step 1 and configure this URL in the Audience URI field.

• Leave other fields to default values. Hit Next. Select the fields as indicated below and select Finish.

  

Step 3: Get the IdP Metadata URL From Okta

• Now in the same Okta application configuration page, click on the Sign On tab. You will find the metadata URL here. Please copy this URL and we will configure this in AM 2.0

  

Step 4: Configure AM 2.0 With IdP Metadata

• Paste the metadata link from Okta in the SAML entity descriptor field on AM 2.0’s provider page. If the URL is correct, you will see a green tick on the right.

  

• Click on Add. This will create a basic SP configuration on AM 2.0 for this Okta application.

Step 5: Configure other fields on AM 2.0

• Scroll down and set the Want AuthnRequests signed option to be On.

  

• Now scroll to the bottom of AM 2.0’s provider configuration page and select First Login Flow and Post Login Flow, if not already pre-selected.

  

• Click on Save.

Step 6: Configure Mapping for JIT (this step is mandatory only if you would like to enable SAML JIT)

• In case a customer requires SAML JIT need to be enabled, we need to add 4 mandatory mappers on both sides - AM 2.0 as well as Okta. In case SAML JIT is not required, please skip this step entirely.

• To add mappers in AM 2.0, click the Mappers tab on the same SP configuration page. Click on the Add mapper button.

  

• Configure User.UserId mapper by filling in the fields as shown in the image below.

  

  Click on Save.

• Similarly, configure User.LocaleId mapper by filling in the fields as shown in the image below.

  

  Click on Save.

• Similarly, configure User.PrimaryOrgId mapper by filling in the fields as shown in the image below.

  

  Click on Save.

• Similarly, configure User.Roles mapper by filling in the fields as shown in the image below.

  

  Click on Save.

• To add mappers on the Okta side to support SAML JIT, go to the General settings tab and click on the Edit button in SAML Settings.

  

  Navigate to the SAML Tab by clicking on the Configure SAML button. Go to the Configure SAML tab and add the 4 attributes as shown below.

  

  Note: the values shown in the above image in the Okta side mapper configuration are only for example. Please enter values as per your requirements.

  Click on Next and then click on Finish. You are now done with the SAML JIT configuration.

Step 7: Configure logout

To configure logout, a Signing certificate needs to be extracted from AM 2.0 and saved on the Okta side.

• To extract this Signing certificate from AM 2.0, go to Realm settings → Keys → Certificate.

  

  The certificate will look like below:

  

• Follow the template shown below to create a new certificate file.

  —–BEGIN CERTIFICATE—–
  <PASTE THE CERT HERE!>
  —–END CERTIFICATE—–
  

  Replace the text “<PASTE THE CERT HERE!>” with the copied certificate data from above. It should look like this after the replace:

  

• This file needs to be saved on the Okta side. Now on the Okta side, go to the General settings tab and click the Edit button in SAML Settings. Click on Show Advanced Settings.

  

  The certificate saved goes in the Signature Certificate field.

  

• Get the Single Logout URL from the AM 2.0 metadata URL of this realm. The metadata link can be found on the IDP configuration page, as shown below.

  

  The metadata will look like below:

  

  Extract this URL and save it in the Single Logout URL field.

• The SP issuer will be the same as the SP Entity ID, which we saw in Step 1.

• After saving all of these changes, go to the Sign On tab in Okta and get the metadata URL.

  

• Okta metadata will now have a SingleLogoutService field populated to reflect the Logout URL.

  

  Use this URL to configure the logout on the AM 2.0 side. Save the change.

Step 8: Additional attributes configuration

• In case additional attributes are needed, they can be configured as well. Below is a list of attributes can be configured. You will have to pass the attribute from the IDP side to receive on SP side.

5.2 - Configure Okta OIDC IdP for JIT

Objective

This page describes the Okta OIDC setup with JIT and Non JIT flows.

Integrating Access Management 2.0 with OKTA OIDC

This section shows how to integrate Access Management 2.0 with OKTA, where OKTA will behave as the Identity Provider (IdP). The protocol used for authentication is OIDC. Steps involve creating an OIDC client on both sides.

Step 1: Identity provider in Access Management 2.0.

• Login to the Access Management 2.0 admin console. Select the correct realm, here it’s maactive.

https://mpsos-auth.sce.manh.com/auth/

If you only have Restricted Admin Access, then use the URL:

https://<stack_short_name>-auth.<domain_name>/auth/admin/maactive/console/

• Verify the Realm.

• Click Identity Providers → Add providers and select OpenID Connect provider from the list of providers.

• Enter the Alias and the Display name.

Alias also forms part of Redirect URL. For example, if the Alias is scoeoidc, then the Redirect URI is:

https://mpsos-auth.sce.manh.com/auth/realms/maactive/broker/scoeoidc/endpoint

Copy this redirect URI to register the application In OKTA.

Step 2: App Registration in OKTA

The instructions described below can be used to integrate the Manhattan Active Cloud Platform with OKTA Login

• Login to your OKTA Account → Go to Applications → Click Create App Integration.

• Select OIDC - OpenID connect radio button and then Web/Native Application radio button on the Application Type Panel, and click Next.

Provide the name of the application and paste that Redirect URI from step1-C to Okta Sign-in redirect URIs

The below screen will be displayed after Save Operation on Okta.

• Follow the below steps to create a client_secret key.

Edit and select client secret → save. As soon as you hit Save, you see Client Secret. Copy this for further configuration. Unselect Proof Key for Code Exchange (PKCE)

• Copy the Client ID, Client Secret from the above screen, and Metadata Well known URI as below to register it in Access Management 2.0.

• There is a concept in OIDC Application called the Metadata Well Known URI.

The general format (in Okta) is https://host:<port>/oauth2/default/.well-known/openid-configuration. In our case:

https://dev-95801423.okta.com/oauth2/default/.well-known/openid-configuration

• Assign users to the application in OKTA.

Step 3: Integrating Access Management 2.0 with OKTA OIDC

• Go to Access Management 2.0 Admin and paste the OpenID connect metadata URI in the Discovery endpoint as shown below (click on show metadata to see the rest of the endpoints).

• Select Client Authentication as Client secret sent as basic auth, paste the client ID and client secret value, and then hit add.

• Next, click on advanced to add the default scopes as shown below.

• Next, choose the First Login Flow as MA first Broker login if not already configured. Once done, choose the MA post login flow as the Post Login Flow drop down. This is an important step, and it is needed for the IDP login to work fine.

  

• Manually add users to the application with appropriate roles. This completes the integration of Access Management 2.0 and OKTA using the OIDC protocol.

• Click on the application URL and use the icon in the UI to log in through OKTA-ODIC. In our case it is scoeoidc

  

Step 4: Enabling JWT-OIDC-JIT – OKTA

Creating/adding mappers in Access Management 2.0:

• To add mappers in Access Management 2.0, go to Access Management 2.0’s provider configuration page, Select the identity providers (Scoeoidc) and click on the Mappers tab.

  

• Click on Add mapper and create the below mappers by filling in the fields as shown in the below screenshots.

  • User.UserId:

  

  • User.FirstName:

  

  • User.LastName:

  

  • User.Primary_Org_Id:

  

  • User.Roles:

  

  • User.LocaleId :

  

Step 5: Adding Custom claims in OKTA:

Login to OKTA portal https://okta-devok12.okta.com/

• Login to your OKTA Account → Go to Directory → Click Profile Editor → select User (default).

  

• Next, click on Add Attribute to add the required customer user attributes.

  

  • primary_org_id:

  

  • preferred_roles:

  

  • LocaleId:

  

Save and Next:

Once the attributes are added to the profile-editor, custom attributes fields will be displayed for the user under the profile.

• → Go to Directory → Click People → select User(ltadimarri@manh.com) → profile → Edit.

Define the values for custom attributes.

• Next is Add claims, go to Security tab on the left-hand side, and select the API option.

  

• Under the Authorization Servers tab, select the default authorization server.

  

• Under the claims header, click on the Add Claim button.

  

• Create a new claim called “primary_org_id” as shown below. Click save.

  

• Create a new claim called “preferred_roles” as shown below. Click save.

  

• Create a new claim called “LocaleId” as shown below. Click save.

  

Follow the above steps to add attributes based on customer requirements.

• Next, assign users to this application in OKTA.

Step 6: Viewing Claims and Attributes in Okta’s Token Preview

Okta provides a way to view the custom claims or attributes passed under the token preview in the authorization server.

• In the Okta admin console, navigate to Security > API > Authorization Servers, select default authorization server, and then go to the Token Preview.

Select the properties for your token request to preview a token payload (ClientID, Grant type, user, and scopes).

• Once properties are selected, click on the token preview to view the attributes and claims.

  

Note: By default, the claims for preferred_username, first name (given_name), and last name (family_name) will be available in the Okta token.

Step 7: JWT-OIDC-JIT Required claims in OKTA.

Note: Please take special care to make sure values mapped to your Identity Provider do not have any unwanted spaces, commas, or other invalid characters before or after the values.

Attributes Shown Below can be configured on IDP as well as SP.

5.3 - Configure Azure Identity Providers

Objective

This page describes Azure Ad OIDC Setup with JIT and Non JIT Flows.

Integrating Access Management 2.0 with Azure OIDC

This section shows how to integrate Access Management 2.0 with Azure AD, where Azure will behave as an Identity Provider (IdP). The protocol used for authentication is OpenID Connect (OIDC). Steps involve creating an OIDC client on both sides.

Step 1: Identity provider in Access Management 2.0.

• Login to the Access Management 2.0 Admin console and select the correct realm, here it’s maactive.

https://mpsos-auth.sce.manh.com/auth/

If you only have Restricted Admin Access, then use the URL.

https://<stack_short_name>-auth.<domain_name>/auth/admin/maactive/console/

• Verify the Realm.

• Click Identity Providers → Add providers and select OpenID Connect provider from the list of providers.

• Enter the Alias and the Display name.

Alias also forms part of the Redirect URL. For example, if Alias is scoeoidcazure, then the redirect URI is:

https://mpsos-auth.sce.manh.com/auth/realms/maactive/broker/scoeoidcazure/endpoint

Copy this redirect URI to register the application In Azure.

Step 2: OIDC App Registration in Microsoft Azure AD

The instructions described below can be used to integrate Manhattan Active Cloud Platform with Microsoft Azure AD Login:

• Login to https://portal.azure.com/#home as an Administrator or Co-Administrator to create a new Application.
• Select App Registration from the homepage or search for the same from the search bar.

• Select New Registration to create an OIDC application.

• Set the application name, select web application from the drop-down, and paste the redirect URI that has been copied from Access Management 2.0:

https://mpsos-auth.sce.manh.com/auth/realms/maactive/broker/scoeoidcazure/endpoint

Once the redirect URI is pasted, register the application.

This creates the new application (client) in Azure Portal. Note down the client ID, which is also the application ID.

• Creation of client secret Key.
  • Select the application (scoeoidc) → select certificate and secrets to create a new secret key.
  • Select New client secret. Describe this secret. Hit Add.

Note: Write down the Client secret value, and make sure you register the key “Value”.

This will be the only chance to capture the key. Never send the secrets over emails.

• Enable permission for this application
  • Select API permissions.
  • Click on Grant admin consent. Confirm in yes.

• Copy Endpoints for this client to configure in Access Management 2.0. These endpoints can be captured by clicking on Endpoints, as shown below.

Copy the OpenID Connect metadata document (also known as the OIDC Well Known URL across the Security Industry, like SAML IdP Metadata) to configure it in Access Management 2.0.

https://login.microsoftonline.com/c38aa44d-4165-427e-94a7-62d15e922c35/v2.0/.well-known/openid-configuration

Configure the OpenID Connect application using OpenID Connect Application Endpoints in Access Management 2.0.

• Assign the users or groups to this application in Azure.

Step 3: Integrating Access Management 2.0 with Azure OIDC

• Go to Access Management 2.0 Admin Console and paste the OpenID connect metadata in the Discovery endpoint as shown below (click on show metadata to see the rest of the endpoints).

• Select Client Authentication as Client secret sent as basic auth, paste the client ID and Client secret value, then hit Add.

• Next, click on Advanced to add the default scopes as shown below.

• Next, choose the First login flow as MA first Broker login if not yet configured.

Also, choose Post login flow as MA post login flow if not configured already. This is an important step, and it is needed for the IDP login to work fine.

• Ensure users were added to the application with appropriate roles.

This completes the integration of Access Management 2.0 and Azure using the OIDC protocol.

• Click on the application URL and use the icon in the UI to log in through Azure-ODIC. A better-looking screen is expected soon. The number of IdP Login buttons/Options will depend on how many IdPs the user has configured within Access Management 2.0. In our case, it is scoeazure-oidc.

Step 4: Enabling JWT-OIDC-JIT - Azure

In case Just In Time (JIT) User Provisioning is not needed, please skip this step 4.

If JIT needs to be enabled, we need to add six mandatory mappers on each side in Access Management 2.0, as well as Azure.

• To add mappers in Access Management 2.0, go to the Access Management 2.0 provider configuration page, select the identity providers (Scoeazure-oidc), and click on the Mappers tab.

• Click on Add mapper and create the below mappers by filling in the fields as shown in the screenshots below.

  • User.UserId:

  

  • User.FirstName:

  

  • User.LastName:

  

  • User.Primary_Org_Id:

  

  • User.Roles:

  

  • User.LocaleId:

  

Step 5: Adding Custom claims in Azure AD

Login to Azure portal https://portal.azure.com/#home

We have multiple options in Azure AD to pass the required claims in the response token.

Steps for Enabling Optional claim for OIDC in Azure:

• In AZURE AD, go to Token Configuration → Add optional claim ID → select preferred_username and add available required claims as well.

• If we do not have options to pass the required attributes/claims in token configuration, we can pass it through managed claims.

• Go to Enterprise applications → Single Sign-on → Attributes and claims.

• Go to Enterprise applications and search for the application (in our case: scoeoidc)

• Select the application and click on the Single sign-on Tab.

• Edit the attributes & Claims. Click on Add new claim. Provide the Claim Name and the Source attribute value:

  • primary_org_id

  

Similarly, add other attributes as well.

• To make these changes work and send the attributes in the ID token, we need to update the acceptMappedClaims to true in the application manifest.

Go to App registrations → <application name(scoeoidc)> → manifest.

Next, assign users to this application.

Once the above steps are performed, the user will be created in the application.

• JWT Token response using Postman.

We can check the sent claims/attributes in the JWT token response using Postman. Use the token endpoint, client ID, and client secret key to get the token response ID of the user in Postman.

POST Request:

A successful request would get HTTP 200 OK responses having an ID token and access token, as shown below.

• Go to https://jwt.io/ and paste the ID token in the debugger to know what response is sent from the token.

Step 6: JWT-OIDC-JIT Required claims in Azure.

Note: Please take special care to make sure values mapped to your Identity Provider do not have any unwanted spaces, commas, or other invalid characters before or after the values.

The attributes in the table below can be configured on both IDP and SP by following the steps above.