For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt, and this page is available as Markdown at https://docs.us.ovhcloud.com/en/account/account-information/sso-okta.md.
  • English

Enabling Okta SSO connections with your OVHcloud account

View as Markdown

Learn how to associate your OVHcloud account with an external Okta service.

You can use Single Sign-On (SSO) to connect to your OVHcloud account. To enable these connections, your account and your Okta accounts have to be configured using SAML (Security Assertion Markup Language) authentications.

 

Requirements

 

Instructions

Info

For a service provider (i.e. your OVHcloud account) to establish an SSO connection with an identity provider (i.e. your Okta service), the key is to establish a mutual trust relationship by registering the SSO connection in both services.

Registering OVHcloud into Okta

Your Okta service acts as an identity provider. Requests to authenticate your OVHcloud account will only be accepted if you have first declared it as a trusted third party.

This means that it must be added to Applications.

Log in to the Okta administration interface with your administrator account.

Go to Applications then again Applications.

Okta SSO - step 0

Click Create App Integration, select SAML 2.0, then select Next.

Okta SSO - step 1

Okta SSO - step 2

In the General Settings step, add a name for this application, such as "OVHcloud," and click Next.

Okta SSO - step 3

In the SAML Settings step, complete the Single sign-on URL and Audience URI fields with the information below:

  • Single sign-on URL: https://us.ovhcloud.com/auth/ and
  • Audience URI: https://us.ovhcloud.com/auth/

Okta SSO - step 4

Then set the following Attribute Statements:

  • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn and Value: user.login
  • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress and Value: user.email
  • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name and Value: user.displayName

Set these Group Attribute Statements:

  • Name: groups and Filter: Matches regex:.* (Adapt the filter if you want to be more specific)

Click Next.

Okta SSO - step 6

In the Feedback step, select the appropriate option and click Finish.

Okta SSO 6

Then open the application, go to the Assignments tab, and assign users or groups to the application.

Okta SSO 07

Before going to the next section, go to the Sign On tab, access the Metadata URL, and save the provided XML file.

Okta SSO - step 8

Your Okta service now trusts OVHcloud as a service provider. The next step is to ensure that the OVHcloud account trusts your Okta as an identity provider.

 

Registering Okta into the OVHcloud account and configuring the connection

To add Okta as a trusted identity provider, you must provide the identity provider metadata in the OVHcloud Control Panel.

  1. Click your name and then your initials.
  2. Select Identity and Access Management (IAM) from the left-hand menu.
  3. Click the Identities tab to access local users management.

Local identities - SSO okta

Click the SSO connection button.

Okta SSO - step 12

Fill in the XML metadata of your Okta service. Enter groups as the Group Attribute Name. Click on Confirm.

Info

You can keep local users by ticking the Keep active OVHcloud users box.

Okta SSO - step 13

Now you need to retrieve your Okta as the identity provider, as well as default groups.

Okta SSO - step 14

For more information, click on the link under SSO service URL.

Okta SSO - step 15

The more options ... button allows you to update or delete the SSO, and view its details.

Okta SSO - step 16

Your Okta service is now considered a trusted identity provider. However, you still need to add groups to your OVHcloud account.

Warning

NOTE: If you try to connect via SSO at this point, you will probably receive a Not in valid groups error message.

That is because your OVHcloud account checks whether the authenticating user belongs to an existing group on the account.

You must then assign roles to Okta user groups at OVHcloud. Otherwise, your OVHcloud account does not know what the user is allowed to do and, by default, no rights are assigned.

From the OVHcloud Control Panel, add a group by clicking the Declare a group button and filling in the fields:

  • Group name: Group name within Okta
  • Role: Level of rights granted to this group

When finished, click Confirm.

Okta SSO - step 17

Okta SSO - step 18

You can then verify that the group is added to your OVHcloud account in the "Groups" section:

Okta SSO - step 19

When you later log in with a user from the Intern group, your OVHcloud account will recognize that the user has the role "UNPRIVILEGED" specified by his group.

Warning

NOTE: If you set the privileges to NONE, you will need to assign permissions to this group via the IAM policies.

You will then be able to log out of your account and log back in with your Okta as an identity provider.

 

Connecting via SSO

On the OVHcloud login page, enter your customer code followed by /idp without entering a password, and click the Login button.

Local login - SSO okta

You are then redirected to your Okta login page. Enter the login and password for a user of your Okta, then click the Sign in button.

Okta SSO - step 21

You are now logged in with the same customer code but through your Okta user.

Local account - SSO okta

 

Go further

Browse all the Account information guides.

Browse the rest of the OVHcloud US documentation for guides on our other products and services.