Story

As an InFORM team, we would like to know if having our own instance if OKTA with the same configurations as the CFA OKTA instance will help us to expedite SSO development.

Questions to Answer in this Spike

The purpose of this research spike is to determine if and how a local OKTA instance will help InFORM to develop SSO features. The open questions that should be answered to close this spike are:

1. Do we have everything we need from CFA to succssfully configure a local OKTA instance that mirrors the CFA OKTA environment?
2. If we do not have everything we need, what is missing?
3. Once we have all the information, can we utilize the OKTA trial period for successful initial develop and testing?
4. If no, would it be helpful to purchase an OKTA account for a period of time?

Expected Result

Once these questions are answered, if we determine that a local OKTA instance is a viable option for the future the expected result of this research is comprehensive confluence documentation. The goal of this documentation is to guide an uninitiated user through the process of configuring a new OKTA instance for testing and development.

CFA OKTA Info

CFA has provided OKTA configuration details for their development and production environments.

OKTA Metadata.xml files

• InFORM (DEV) – Dev Okta
  https://cfahome.oktapreview.com/app/exkfn6a6x97bU8pqf0h7/sso/saml/metadata

• InFORM (Prod) – Prod Okta
  https://cfahome.okta.com/app/exk9e7sgfi3LU4I6W1t7/sso/saml/metadata

UAC

(Assuming a local OKTA environment is a viable option) Confirm

1. Using the documentation product of this ticket, an uninitiated user can configure an OKTA instance from scratch that mirrors the CFA OKTA environment.
2. The local OKTA instance includes the following actions:
   1. User can login to InFORM via the local OKTA instance
   2. Automatic logouts are redirected back to the local OKTA login screen
   3. Manual logouts are redirected back to the local OKTA login screen
3. A local OKTA bypass URL is available which allows users to login to InFORM MxC test servers without having to pass though OKTA.
   1. This URL is documented and action is documented in confluence.