MicroStrategy ONE

Integrate MicroStrategy with Okta OIDC Single Sign-On

Starting in MicroStrategy ONE (December 2024), you can use the Denodo JDBC driver to implement OIDC Single Sign-On with Okta.

Configure Your Application in Okta

Create an Okta Application

  1. Log in to Okta.
  2. In the Navigation pane, under Applications, click Applications.
  3. Click Create App Integration.

  4. Choose the OIDC - OpenID Connect sign-in method and the Native Application application type.
  5. Click Next.
  6. Enter a name for the application integration, and choose the Refresh Token and Token Exchange grant types.
  7. Add your sign-in redirect URIs for your environment, for example, https://env-308750.customer.cloud.microstrategy.com/MicroStrategyLibrary/auth/oidc/login.
  8. Choose the Allow everyone in your organization to access controlled access.
  9. Click Save.

Create an API

  1. In the Navigation pane, under Security, click API.
  2. Click Add Authorization Server.
  3. Enter a name and audience and click Save.
  4. Navigate to the Scopes tab of your newly created API.

  5. Click Add Scope.

    The scope name should be the same as the role name in the database. Denodo scopes are the same name as roles. Once Denodo has the scopes of the token, it obtains roles with the same names and executes the request with the privileges granted to these roles.

  6. Click Create.

Create an Access Policy and Rule

  1. Navigate to the Access Policies tab of your newly created API.
  2. Click Add Policy.
  3. Enter a name and description. Optionally, customize Assign to.
  4. Click Create Policy.
  5. Click Add rule.
  6. Enter your preferred rule options and click Create rule.

  7. Click Actions and Edit.
  8. In Assign to, assign the rule to the application you created.
  9. Click Update Policy.

Integrate Denodo with Okta

For more information on enabling OAuth in Denodo, follow the instructions in the JWT section of Enabling OAuth Authentication.

  1. Open the Denodo Administration Tool and log in with an Administrator account.

  2. In the menu, click Administration and Server configuration.

  3. Click Server authentication and OAuth.

  4. Define the following values:

    • Select a validation mode: Select Use JWT.

    • Select the signing algorithm: Choose RS256.

    • Issuer: Use the value from your OpenID configuration. To find this value, use https://<okta_url>.okta.com/oauth2/<serverid>/.well-known/oauth-authorization-server.

    • JWKS URL: Use the value from your OpenID configuration. To find this value, use https://<okta_url>.okta.com/oauth2/<serverid>/.well-known/oauth-authorization-server.

    • Audience: Enter your Okta Authorization Server Audience value.

      To find this value in Okta, in the Navigation pane, under Security, click API, and copy the Authorization Server Audience value.

    • Scope field name: Type scp.

  5. Click OK.

  6. To create roles in Virtual DataPort and grant them the appropriate privileges, see Creating Roles.

    The role name is used in Add Scope in Okta.

MicroStrategy Configuration

Create a Data Source Using OIDC Single Sign-On Authentication Mode

  1. Open the Workstation window.

  2. Connect to an environment.

  3. Create an IAM object using Manage OAuth Enterprise Security with Identity and Access Management (IAM) Objects.

    • Use the Client ID and Client Secret from your Okta application.

    • In Scope, enter openid email profile offline_access <scope created>, where <scope created> is the scope name from Create an API.

  4. In the Navigation pane, click next to Data Sources.

  5. Search for and choose Denodo from the data source list.

  6. In the Default Database Connection drop-down list, click Add New Database Connection.

  7. Type a Name.

  8. In the Driver drop-down list, choose the Denodo JDBC driver.

  9. Type a Server Name, Port Number, and Database.

  10. In the Authentication Mode drop-down in the Basic tab, choose OIDC Single Sign-On.

  11. In the Authentication Service drop-down list, choose the authentication service you created above or click Add New Authentication Service.

    For more information on creating Identity and Access Management objects, see Manage OAuth Enterprise Security with Identity and Access Management (IAM) Objects.

  12. Click Save.

  13. In the Add Data Source dialog, enter a Name and Database Version, and optionally choose Projects for further data manipulation.

  14. Click Save.

Create and Map Users to Okta

  1. Open the Workstation window.

  2. Connect to an environment.

  3. In the Navigation pane, click Users and Groups.

  4. Click next to All Users.

  5. Type a Full Name, Email Address, Username, and other optional fields.

  6. In the left pane, click Privileges and select the check box next to the following privileges:

    • Access data from Databases, Google BigQuery, Big Data, OLAP, BI tools

    • Create and edit database instances and connections

    • Create and edit database logins

    • Create configuration objects

    • Create dataset in Workstation

    • Configure project data source

    • Monitor Database Connections

    • Use Workstation

  7. In the left pane, click Authentication.

  8. In Trusted Authentication Request User ID, type the Okta user's email address.

  9. Click Save.

Configure OIDC

For more information, see Enable OIDC Authentication for MicroStrategy Library.

  1. Open Workstation and connect to your environment using standard authentication and administrator credentials.

  2. Right-click the connected environment and choose Configure OIDC under Configure Enterprise Security.

  3. In Step 2: Select an identity provider, choose Okta from the drop-down list.

  4. Copy the MicroStrategy Library URI and Workstation URI into the mobile and desktop application's sign-in redirect URIs in the Okta application you created in Create an Okta Application.

  5. Copy and paste the Client ID of the application you created in Create an Okta Application.

  6. Use the Issuer value from Okta. To find this value, use https://<okta_url>.okta.com/oauth2/<serverid>/.well-known/oauth-authorization-server.

  7. Click Save.

  8. Restart the web server.

Single Sign-On with OIDC

  1. Open the Workstation window.

  2. Connect to an environment.

  3. Right-click the environment and choose Environment under Edit.

  4. Select Default OIDC and click Continue.

  5. A browser displays. Log in using your Okta credentials.

  6. Use a MicroStrategy Administrator account to assign privileges to the new user.

    You do not need to perform this step if you mapped a MicroStrategy user to an Okta account and granted privileges.

  7. In the Navigation pane, click next to Datasets.

  8. Choose a Project and select Data Import Cube.

  9. Click OK.

  10. Choose the data source you created in Create a Data Source Using OIDC Single Sign-On Authentication Mode.

    The namespaces and tables display.