Okta

Last Updated: August 18, 2026

An identity provider (IdP) uses an authentication token to vouch for a person's identity. Vasion Automate uses IdPs for several tasks, including logging in to the Admin Console and portals, deploying printers, releasing print jobs, and more.

If you use an IdP, the Control Panel Application (CPA) supports only badge and PIN authentication.

Key Points

Review the following key points:

  • These steps follow Okta's classic user interface rather than the Developer Console user interface.
  • Systems for Cross-domain Identity Management (SCIM) configurations generally require Okta Lifecycle Management licensing.
  • Okta might show two PrinterLogic apps. Use the PrinterLogic SaaS (with support for multiple instances) option.

Configure Connection

To add and configure enterprise app properties for the Vasion Automate connection, do the following:

  1. Create the Okta App.
  2. Set the Authentication Type.
  3. Configure Single Sign-On (SSO).
  4. Add the X-509 Certificate.
  5. Configure Provisioning.
  6. Add PrinterLogic Admins.

1. Create the Okta App

To create the Okta App, follow these steps:

  1. Log in to your Okta Admin Console.

  2. Expand the Applications option in the left-side navigation, and select Applications.

    Okta Admin Console showing expanded Applications section in side navigation.

  3. On the Applications page, select Create App Integration.
  4. Select SAML 2.0 in the Create a new app integration modal, and then select Next.
  5. On the Create SAML Integration page, enter a name for your app in the App name field.
  6. Optional: Adjust the app visibility setting.
  7. Select Next.

Okta Admin Console showing Create SAML Integration page.

Leave the current browser on the new app page. To continue app configuration, open the Vasion Automate or PrinterLogic Admin Console in a new browser, and access the service provider information.

2. Set the Authentication Type

In a separate browser window, log in to Vasion Automate, and do the following:

  1. Select Admin from the left-side navigation.
  2. Select the Authentication option.

  3. Select the + New Authentication button.

    Authentication page showing + (add) New Authentication button.

  4. Select the IdP that you want to configure.
  5. Select Next.
  6. Give your IdP a unique name.
    1. (Optional) Add a description.
  7. Select SAML2 in the Authentication Protocol section.

  8. In the Provisioning section, if you are using Systems for Cross-domain Identity Management (SCIM), leave the Just-in-Time (JIT) option deselected.

  9. Leave the IdP Information page open. You need this information for the next step.

IdP Information window showing different configuration fields and Service Provider Information section.

3. Configure Single Sign-On (SSO)

Follow these steps:

  1. From the Service Provider Information section in Vasion Automate, copy the Vasion Reply Url (ACS), and paste it in the Okta Single sign-on URL field.
  2. Leave the checkbox for User this for Recipient URL and Destination URL selected.
  3. Copy the Vasion Identifier (Entity ID) URL, and paste it in the Okta Audience URI (SP Entity ID) field.
  4. Copy the Vasion Relay State URL, and paste it in the Okta Default RelayState field.
  5. In Okta, select Next at the bottom.
  6. On the Feedback page, select the checkbox next to This is an internal app that we have created, and then select Finish.
  7. Select the app's Sign On tab, and do the following:
    1. Expand the More details section in the Metadata details section.
    2. Copy the Okta Sign on URL, and paste it in the Vasion SSO URL field.
    3. Copy the Okta Issuer URL, and paste it in the Vasion Issuer URL field.

    4. In the Issuer URL field, cut the numerical portion after the slash (/), and paste it in the Issuer ID field.

      Issuer URL example: http://www.okta.com/.
      Issuer ID example: d8e6ae12-fb1f-4f71-1212-8675309d.

  8. In Okta, scroll down to the Attribute statements section, select Add expression, and add the following:

    1. Name: Email, Expression: user.profile.email.
    2. Name: FirstName, Expression: user.profile.firstName.
    3. Name: LastName, Expression: user.profile.lastName.
    4. Name: Login, Expression: user.profile.login.

    Okta Admin Console showing Attribute Statements section.

Okta Admin Console showing app's Sign On tab.

4. Add the X-509 Certificate

Follow these steps:

  1. In Okta, select the Download button next to Signing Certificate.
  2. Open the file in your preferred text editor.

  3. Copy the certificate body, including the Begin and End Certificate headers, and paste it in the Admin Console X509 Certificate field.

    SAML Certificate opened in Notepad, showing content selected, excluding begin and end certificate lines.

  4. Select Save in the upper-right corner.

IdP Information screen showing fields for URLs and X-509 certificate.

5. Configure Provisioning

The provisioning steps vary depending on whether you are using Systems for Cross-domain Identity Management (SCIM) or Just-in-Time (JIT) provisioning. Choose the appropriate option below to view the corresponding steps.

SCIM Provisioning

Turn On Provisioning

In Okta, select the app's General tab, and then do the following:

  1. Select Edit in the App Settings section.
  2. In the Provisioning section, select SCIM.
  3. Select Save.

Configure SCIM

Follow these steps:

  1. Select the app's Provisioning tab, and select Edit.
  2. Copy the Vasion SCIM Tenant URL, and paste it in the Okta SCIM connector base URL field.
  3. In the Unique identifier field for users field, enter "email."
  4. In the Supported provisioning actions section, select the checkboxes next to the following:
    1. Import New Users and Profile Updates.
    2. Push New Users.
    3. Push Profile Updates.
    4. Push Groups.
  5. From the Authentication Mode menu, select HTTP Header.
  6. In the Vasion IdP Information page, select the Generate New Token button in the SCIM Token section.
    1. Copy the SCIM token, and paste it in the Okta Bearer field next to Authorization.
    2. Select the Test Connector Configuration button.
    3. Select Close in the Test Connector Configuration modal, and then select Save.
  7. In the To App settings and in the Provisioning to App section, select Edit.
  8. Enable the following:
    1. Create Users.
    2. Updated User Attributes.
    3. Deactivate Users.
  9. Select Save.

Okta Admin Console showing Provisioning tab and SCIM Connection section.

Assign Users & Groups

Note that Okta does not support assigning the same groups on the Assignments and Push Groups tabs. For example, if you assign Group A on the Assignments tab, you should not assign Group A on the Push Group tab.

A best practice is to create an Okta group that includes all users who need access to the PrinterLogic app, which should consist of admin users who require access to the Admin Console and end users who only need access to the Self-service Portal. Assign this group on the Assignments tab in Okta, which provisions all the necessary user records into the instance without any group membership data. You can then assign your role-specific groups, such as Admin, Help Desk, etc., on the Push Group tab, which provisions the group membership data needed for Role-Based Access Control (RBAC), portal security, and deployment rules.

For more details refer to the official Okta documentation on the Push Group tab.

Assignments Tab: Assign Users & Groups

Follow these steps:

  1. In Okta, select the Assignments tab.

  2. Select the Assign menu.

    Okta Admin Console showing expanded Assign menu and "Assign to People" and "Assign to Groups" options.

  3. To grant access to individual users, select Assign to People. To grant access to groups, select Assign to Groups.
  4. Search for the desired users or groups, and select Assign.
  5. Scroll down to the bottom, and select Save and Go Back.
  6. Select Done.
  7. Repeat these steps for any additional users or groups.

Okta Admin Console showing modal, search results, and Assign and Done buttons.

Push Groups Tab: Assign Groups

If you need to provision group membership information into PrinterLogic, do the following:

  1. In Okta, select the Push Groups tab.
  2. Select the + Push Group menu.

  3. Select Find groups by name.

    Okta Admin Console showing expanded + Push Groups menu.

  4. Search for and select the desired groups.

    Ensure that the groups you select on this tab are not the same groups that you assigned on the Assignments tab.

  5. In the Match result & push action column, confirm that + Create Group is selected.

    Okta Admin Console showing Push Groups tab with selected group and + Create Group option.

  6. Select Save.
  7. In the Push Status column, confirm that the status changes from Pushing to Active.

Okta Admin Console showing Push Groups tab. Pushed group has Active status in Push Status column.

Turn On the IdP

Follow these steps:

  1. In Vasion Automate, close the IdP Information page.
  2. In the Authentication page, select the button next to the configured IdP to turn it on.

CyberArk showing Authentication tab and IdP turned on.

JIT Provisioning

Assign Users

JIT does not support the provisioning of group membership associations, so you cannot apply Role-Based Access Control (RBAC) roles, printer deployments, or portal security roles to groups. You must create assignments individually for each user.

Follow these steps:

  1. In Okta, select the app's Assignments tab.

  2. Select the Assign menu.

    Okta Admin Console showing expanded Assign menu and "Assign to People" and "Assign to Groups" options.

  3. To grant access to individual users, select Assign to People. To grant access to groups, select Assign to Groups.
  4. Search for the desired users or groups, and select Assign.
  5. Scroll down to the bottom, and select Save and Go Back.
  6. Select Done.
  7. Repeat these steps for any additional users or groups.

Turn On the IdP

Follow these steps:

  1. In Vasion Automate, close the IdP Information page.
  2. In the Authentication page, select the button next to the configured IdP to turn it on.

CyberArk showing Authentication tab and IdP turned on.

Create Users

When using JIT provisioning, the app creates users during the first sing-in attempt:

  1. Access your Vasion instance, and select Sign In With <IdP Name>.
  2. Attempt to sign in with your IdP credentials.

  3. This sign-in attempt fails and returns you to the sign-in screen.

    This behavior is expected. With JIT, this action triggers user creation in the Vasion instance.

  4. The second sign-in attempt with valid credentials initiates a typical sign-in sequence.

For admins who need access to the Admin Console, you still need to add them to the Users page located in Tools then Users.

6. Add PrinterLogic Admins

For steps on assigning users and roles to the PrinterLogic and Vasion Automate Admin Console, refer to Admin Console Users.