Configuring SSO Integration with Okta
PreviousConfiguring SSO Integration with Azure/Entra IDNextConfiguring SSO Integration with Ping Identity
Last updated
Last updated
© 2024 Parallels International GmbH. All rights reserved.
Follow the steps below one by one to integrate Parallels My Account with Okta.
A domain is a part of the email addresses (after the @ symbol) used by the end users in your organization. When end users try to log in to Parallels My Account using SSO, they are prompted to enter their work email address. Parallels My Account checks the domain part of the email address and recognizes that the user belongs to your organization. Click on the title of Step 1 to expand it and read the instructions carefully.
Add one or more domains your organization uses.
Each domain must be unique and can only be registered to one business account that your organization has registered with Parallels.
Make sure to add only the domains your organization can control.
The Parallels My Account service verifies the domain ownership by checking a specific TXT record that must be added to the DNS host of the corresponding domain. Make sure that all domains added to the list are verified before proceeding with the next steps.
Depending on the software and/or provider, a TXT record may take up to 72 hours to propagate. You can check whether it's been configured using the following command:
Registering the Parallels enterprise application (required for integrating with the Parallels My Account service) in the IdP Directory allows you to configure the SSO-related parameters and correctly provision the integration between your IdP and the Parallels My Account service. The description below illustrates the registration procedure for Okta. It is assumed that you have the permissions required to register and configure enterprise applications with Okta. If your organization uses a different IdP service, follow the instructions provided in the admin guide specific to your IdP of choice. To register a Parallels enterprise application with Okta:
Log into the Okta management portal using an account that has privileges for registering and configuring enterprise applications for your organization.
On the portal’s landing page, expand the Applications section and choose the Applications item from the left-hand side panel to open the page with the list of enterprise applications registered for your organization.
Click the Create App Integration button, which is located above the list of registered applications. It opens the popup dialog titled Create a new app integration.
In the Create a new app integration dialog, choose SAML 2.0 as your sign-in method, then click Next.
On the next page, type the name of the application (the actual name remains at your discretion) in the App name field, then select the Do not display application icon to users option. Click Next to proceed with configuring the SAML settings for the application. SAML 2.0 integration between Parallels My Account and your organization’s IdP allows your users to activate their copies of Parallels Desktop for Mac Enterprise Edition using Sing Sign-On (SSO) and your system administrators to use it to log into your organization’s Parallels business account. To complete this step, you must copy certain parameters from Parallels My Account and save them in the settings of the Parallels enterprise application registered with Okta, then copy some data provided by Okta and save it in Parallels My Account.
Switch to the integration configurator page of Parallels My Account. Expand the Step 4 section on the integration configurator page. Note that there are two sets of parameters in the section. The first set has two values, Service Provider Entity ID and Assertion Consumer Service URL, that must be copied from Parallels My Account to Okta. The second set includes three parameters—Identity Provider Entity ID, Identity Provider SSO URL, and Public Certificate. The values for these parameters must be copied from Okta to Parallels My Account.
On Okta’s Create SAML Integration page (this page should have opened after completion of Step 5, as described above), insert the values into the Single sign-on URL and Audience URI (SP Entity ID) fields, as specified below:
The Assertion Consumer Service URL value from Parallels My Account (in the Step 4 section of the integration configurator) must be copied to the Single sign-on URL input field in Okta.
The Service Provider Entity ID value from Parallels My Account (in the section of Step 4 of the integration configurator) must be copied to the Audience URI (SP Entity ID) input field in Okta.
Keep the Use this for Recipient URL and Destination URL option enabled (it is enabled by default). Leave the parameters in the General section set to the defaults.
Scroll the page down to the section Attribute Statements (optional). Add the following attributes to the list (keep the text values and punctuation marks exactly as specified):
objectidentifier (Name format: Unspecified) > user.id
name (Name format: Unspecified) > user.login
displayName (Name format: Unspecified) > user.displayName
Scroll down the page to the section Group Attribute Statements (optional). Add the following attribute to the list (use the name of the value and punctuation mark exactly as specified):
groups (Name format: Unspecified) > (Filter: Matches regex), set the value to .*
Scroll to the bottom of the page and click Next. It opens the section Help Okta Support understand how you configured this application. Choose the option I’m an Okta customer adding an internal app, and then, once the additional section App type opens, choose the option This is an internal app that we have created.
Finally, click Finish, and once the registration process finishes, you will end up on the application’s home page.
Switch back to the integration configurator page at Parallels My Account, expand the Step 2 section (“Register Parallels enterprise app”), and select the option Configuration in the IdP Directory is done.
Once the registration of the Parallels enterprise application with Okta is completed, you must transfer three parameters from Okta to Parallels My Account. To do so, follow these steps:
Switch back to the Okta management portal. When on the enterprise application’s home page in Okta, ensure the currently selected tab is Sign On. Locate the View SAML Setup Instructions button on the right side of the page. Clicking the link opens the page How to Configure SAML 2.0 for %1 Application, where %1 is the name of the enterprise application registered previously. The page contains the three parameters that must be transferred to Parallels My Account. The same three parameters can also be found in the Metadata Details section of the SAML 2.0 card under More details.
Transfer the values from Okta to the Step 4 section of the integration configurator page in Parallels My Account as specified below:
The value Identity Provider Issuer from Okta must be copied to the input field Identity Provider Entity ID.
The value Identity Provider Single Sign-On URL from Okta must be copied to the input field Identity Provider SSO URL.
The content of the X.509 Certificate from Okta must be copied to the input field Public Certificate.
Instead of copying and pasting these values manually, you can download the metadata in the Okta interface and then upload the resulting XML file using the Upload a metadata file link in the Parallels My Account interface.
In the SAML 2.0 card section, locate Metadata URL under the Metadata Details section.
Copy and paste the Metadata URL into a new browser tab or window.
Use Ctrl/Cmd+S to save the metadata as an XML file.
Switch to Parallels My Account interface, open the Step 4 Identity Provider Settings, click Upload a metadata file, and choose the newly created XML file.
Once you have copied the values from Okta to Parallels My Account, click the Save button in the Step 4 section on the integration configurator page at Parallels My Account and select the Configuration in the IdP Directory is done option at the bottom of the section. Then proceed to the next step.
You must create user groups associated with the Parallels enterprise application in your IdP Directory. Later, you will add users to those groups to let Parallels My Account know which users should be able to activate their copies of Parallels Desktop for Mac Enterprise Edition using SSO and which ones should have business account admin privileges in the Parallels ecosystem. At least one user group is required for adding users with admin access to your organization’s business account registered with Parallels. Once the group is created, you should add the group's names in Step 3 of the integration configurator page in Parallels My Account.
Start with creating the group in the IdP Directory. To create a user group for the Parallels enterprise application in Okta:
Log into the Okta management portal using the account with privileges for managing user groups and configuring enterprise applications.
On the portal's landing page, expand the section Directory and choose the item Groups on the left-hand side panel to open the page with the list of the groups registered for your organization.
Click the Add Group button placed above the list of groups, which opens the Add group popup dialog.
Type in the name and the group description, and click Save.
Make sure you have repeated steps 3 and 4 three times and created three separate groups as specified above.
Note: Please ensure that the respective group names on the IdP side and the Parallels My Account side match precisely and that in Parallels My Account, the group names match each other precisely. This will help you avoid potential problems, as some IdPs use group names in their identification and authorization processes.
Write down the name of the group created for the Parallels Business Account Admins. You must transfer these values to Parallels My Account later.
Next, assign the Parallels enterprise application registered with Okta to the transit group that you have created before. Make sure you are on the page with the list of the groups at the Okta management portal. To assign the application to the transit group, follow the instructions below:
Find the transit group in the list of groups.
Click on the group’s item in the list to open the page with the details of the group.
Click the Applications tab at the top to open the list of the applications assigned to the group. Since the group is new, the list is supposed to be empty.
Click the Assign Applications button to launch the popup dialog titled Assign Applications to %1, where %1 is the name of the transit group.
Locate the Parallels enterprise application that has been registered with Okta before and click Assign.
Click Done to save the assignment. You will now see the Parallels enterprise application on the list of the assigned applications of the transit group.
After that, you must create a rule to push members from the groups created for the Parallels Administrators to the Parallels enterprise application through the transit group. Make sure you are on the Okta admin portal’s page with the list of the groups. To create the rule, follow these steps:
When on the page with the list of the groups, click Rules at the top of the list to open the list of the rules created for the groups.
Click Add Rule to create a new rule. It opens the popup dialog titled Add Rule.
Type the name of the rule (use whatever name you find suitable).
Choose the Use basic condition option, then select Group membership from the list below.
In the input field below, type the name of the group that has been created for the Parallels Administrators.
In the THEN Assign to input field, type in the name of the transit group.
Click Save to save the rule. Now you will see the new rule in the list of rules.
Once the rule has been created, activate it by clicking on the Actions drop-down menu on the right and then Activate.
Before proceeding, make sure that the following conditions have been met:
At least one group has been created for the Parallels Business Account Admins.
You have written down the unique names of the groups you have created for the Parallels users and admins.
An additional transit group has been created, and the Parallels enterprise application has been registered with Okta and assigned to that group.
A rule has been created that enables you to push members of both the admin and user groups to the Parallels enterprise application through the transit group.
To complete this step, switch to the integration configurator page at Parallels My Account and expand Step 3 (“Configure user groups mapping”).
Click on Click to edit on the respective group and insert the Parallels Admins group name you have written down earlier into both corresponding fields (“UUID” and “Display Name”), then do the same for the Parallels Desktop Users group section. Click Save to save the changes.
The SAML 2.0 is supposed to be configured for the Parallels enterprise application registered with Okta at the time of the Parallels enterprise application registration (refer the chapter (2) Register Parallels enterprise app and configure SAML settings earlier in this document for more details).
Make sure to check the Step 4 section on the integration configurator page at Parallels My Account. All fields must be filled in, and the Configuration in the IdP Directory is done option must be enabled.
If everything is set, proceed to the next step.
SCIM 2.0 integration between Parallels My Account and your Organization’s IdP allows you to keep user identity information in Parallels My Account in constant sync with the updates made to user identities in the IdP Directory. Okta supports the SCIM 2.0 protocol, which is used for this purpose.
To configure provisioning via SCIM, you must first enable the provisioning for the Parallels enterprise application registered with Okta. After that, you must copy two parameters, SCIM Base URL and Bearer Token, from Parallels My Account (the section of Step 5 of the integration configurator) to Okta. Finally, you must configure the push of the user groups from Okta to Parallels through SCIM.
The description below illustrates the procedure for Okta. It is assumed that you have appropriate permissions to configure enterprise applications in Okta. To configure the provisioning settings for the Parallels enterprise application registered with Okta:
Log into the Okta management portal using the account with privileges for configuring enterprise applications.
When on the portal's landing page, choose Applications > Applications in the left-hand side panel to open the list of enterprise applications registered for your organization.
Find the Parallels enterprise application that has been registered before (refer to chapter (2) Register Parallels enterprise app and configure SAML settings earlier in this document for details). Select the application’s item from the list to open the app’s home page.
Click on the General tab to switch to the tab that displays the app’s general settings. There, click Edit in the upper right corner of the tab to switch to the edit mode.
Select the option Enable SCIM Provisioning and click Save.
A new tab called Provisioning will appear at the top of the page. Click on it to open the tab where you can configure the SCIM settings for the application.
While on the Provisioning tab, click Edit in the upper right corner to switch to the edit mode.
Switch to Parallels My Account, open the integration configurator page and expand the Step 5 section ("Configure SCIM integration”).
Copy the values from the Step 5 section Parallels My Account to Okta, as specified below:
SCIM connector base URL (Okta): insert the value of the parameter SCIM Base URL copied from Parallels My Account.
Bearer (Okta): insert the value of the parameter Bearer Token copied from Parallels My Account. The Bearer field in Okta is not displayed by default. To make it visible, switch Authentication Mode to HTTP Header.
Enable the options Push New Users, Push Profile Updates, and Push Groups on the same page in Okta.
Insert the text userName (use the text exactly as it is provided here: userName) into the input field Unique identifier field for users.
Click Save to save the changes. Okta’s interface will revert to the Provisioning tab of the Parallels enterprise application.
Make sure the section To App is selected on the left. Click Edit to switch to edit mode. Enable the following options: Create Users, Update User Attributes, Deactivate Users. Click Save to save the changes.
Click the Push Groups tab at the top to open the tab with the list of the groups from which the users are supposed to be pushed to the Parallels ecosystem. The list is supposed to be empty.
Click Push Groups > Find groups by name to open the dialog, which allows you to specify the group that must be pushed. Specify the name of the group that has been created for the Parallels Admins (refer to chapter (3) Configure user groups mapping earlier in this document for more details) and select the group when it shows up in the list. The section with additional parameters will appear below. Keep the default settings. Scroll down and click Save. You will see the new group on the list.
When you complete configuring the provisioning settings for the Parallels enterprise application in Okta, switch back to Parallels My Account and select the option Configuration in the IdP Directory is done at the bottom of the Step 5 section ("Configure SCIM integration”).
Continue to the next step.
Add users to the groups created in Step 3 (described earlier in the chapter (3) Configure user groups mapping) to enable users to activate their copies of Parallels products via SSO and administrators to access your organization’s business account registered with Parallels.
To do so, switch to Okta and follow the standard procedure for adding users to groups. Please note that no user will be able to activate their Parallels product unless they have been added to the User group.
Once it is done, switch back to the integration configurator page at Parallels My Account, expand the Step 6 section ("Add users to the application groups”) and select the option Configuration in the IdP Directory is done at the bottom of the section.
The backup login can be used to access your organization’s business account registered with Parallels, bypassing Single Sign-On in case of an SSO malfunction. By default, the backup login is set to the email address of the currently logged-in user. If you want to define a different backup login, add more users first on the Users page of the Business Profile section in Parallels My Account. The new user must log into the business account at least once before being designated as a backup login.
