Single Sign On Setup for ZigiOps

Configure SAML-based Single Sign-On (SSO) in ZigiOps with Okta as the identity provider, covering setup steps and settings.

ZigiOps supports Single Sign-On (SSO) through the SAML 2.0 protocol, allowing enterprise users to authenticate into the ZigiOps web console with their existing identity provider credentials instead of a local username and password.

This guide walks through configuring SAML SSO between ZigiOps and Okta, an identity provider (IdP) commonly used for enterprise authentication. The same principles apply when integrating other SAML 2.0 compliant identity providers.

Why Use SSO with ZigiOps

Enabling SSO for ZigiOps allows organizations to:

• centralize user authentication through an existing identity provider

• reduce password fatigue and local account management overhead

• enforce organization wide security and access policies

• maintain a single source of truth for user identity across enterprise tools

Access

Navigate to ZigiOps → Settings → General Settings → Single Sign-On to configure SSO.

Part 1: Configure SAML in Okta

Before enabling SSO in ZigiOps, you need to create and configure a SAML application in Okta.

1

Create an application integration

Log in to your Okta UI instance, navigate to Applications → Applications, and select Create App Integration.

2

Select the sign-in method

Choose SAML 2.0 as the sign-in method and select Next.

3

Name the application

Enter a suitable application name, for example ZigiWave ZigiOps SSO, and select Next.

4

Configure the SAML URLs

Enter the ZigiOps URL and port number for both the Single sign-on URL and Audience URI (SP Entity ID) fields. For example: https://zigiops.example.com:8585.

5

Configure assertion encryption

Scroll down and select Show Advanced Settings:

• Set Assertion Encryption to Encrypted.

• For Encryption Certificate, upload an SSL certificate issued for the ZigiOps FQDN.

  In a contained environment, you can generate this certificate with OpenSSL.

  openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:2048 -keyout sp-private.key -out sp-certificate.crt

6

Preview the SAML assertion

Scroll down and select Preview the SAML Assertion. This option becomes available once a user is assigned to the application.

7

Retrieve the required values

Retrieve the required values from the generated XML document. ZigiOps needs this data to connect to Okta.

8

Finalize the application setup

Finalize the application setup.

9

View SAML setup instructions

Open the newly created application, go to the Sign On tab, and select View SAML Setup Instructions.

10

Copy the identity provider values

Copy the following values from this page:

• Identity Provider Single Sign-On URL, for example: https://example.okta.com/app/exampleAppName/exampleIssuer/sso/saml

• Identity Provider Issuer, for example: http://www.okta.com/exampleIssuer

11

Download the signing certificate

Return to the Sign On tab, scroll to the SAML Signing Certificates section, and select Actions → Download Certificate to download the certificate. You will upload this certificate to ZigiOps in Part 2.

Part 2: Configure SSO in ZigiOps

1

Open Single Sign-On settings

Log in to ZigiOps and navigate to General Settings → Single Sign-On.

2

Complete the SSO settings

Use the data retrieved from Okta to complete the following settings:

Setting	Description
Activate	Enables SSO for the ZigiOps instance.
Allow local ZigiOps user login	Enable or disable local username and password login alongside SSO, based on your organization's preference.
Identity Provider	Select OKTA from the drop-down menu.
Identity Provider URL	The Identity Provider Single Sign-On URL retrieved from Okta. Example: https://example.okta.com/app/exampleAppName/exampleIssuer/sso/saml.
Service Provider Name	The application name created in Okta. Example: ZigiWave ZigiOps SSO.
Identity Provider's API Base URL	The base URL derived from the identity provider's single sign-on URL. For example, if the single sign-on URL is https://example.okta.com/app/exampleAppName, the API base URL is https://example.okta.com.
Entity ID / Issuer	The entity issuer ID or identity provider issuer. Example: http://www.okta.com/exampleIssuer.
Name ID Policy	The name ID policy from Okta's SAML Assertion XML.
Certificate	Upload the Okta certificate downloaded in Part 1.
Service Provider Private Key	Upload the service provider private key generated when creating the SSL certificate in Part 1.

Frequently Asked Questions

Which identity providers does ZigiOps support for SSO?

ZigiOps supports any SAML 2.0 compliant identity provider. This guide uses Okta as the example, but the same configuration principles apply to other SAML 2.0 providers.

Can users still log in with a local ZigiOps account after SSO is enabled?

Yes, if the Allow local ZigiOps user login setting is enabled, local authentication remains available alongside SSO.

What do I need from the identity provider before configuring ZigiOps?

You need the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the signing certificate downloaded from the identity provider.

Related Pages

• Encryption

• Hardening Web App

• General Settings