Configure EMR SAML authentication with Okta

Available for Enterprise Edition only.

​

Overview

• Any user assigned to the Okta app can use the EMR fabric configured with SAML using their own credentials.
• All signed-in users are granted the AWS role defined in the fabric settings.
• Users remain signed in as long as their token is valid.
• Users must sign in again when the token expires.

​

Prerequisites

• Access to EMR or EMR Serverless compute
• Administrator access to AWS and Okta
• Permission to set environment variables in your Prophecy deployment, usually associated with the Prophecy cluster admin role.
• Ability to create or edit an EMR fabric in Prophecy.

​

1. Create an Okta SAML application

1. Sign in to Okta as an administrator.
2. Go to Applications > Applications.
3. Click Create App Integration.
4. Select SAML 2.0 and click Next.
5. For App name, enter Prophecy SAML App, then click Next.
6. For Single Sign-On URL, open the Prophecy EMR fabric where you want to configure SAML. Then, copy the provided URL under Login URL and paste this into the Okta field.
7. Below the URL, select the Use this for Recipient URL and Destination URL checkbox.
8. For Audience URI (SP Entity ID), enter a value to identify the entity issuer (for example, prophecyokta).
9. Leave Default Relay State blank.
10. Keep the rest of the settings as-is and click Next.
11. Select This is an internal app that we have created.
12. Click Finish. The Prophecy SAML App appears in your application list.

​

Assign users and groups in Okta

1. In Okta, navigate to your application: Applications > Applications, then select the Prophecy SAML App.
2. Go to the Assignments tab.
3. Click Assign to see the following options:
   • Assign to People: Select individual users who should have access.
   • Assign to Groups: Select entire Okta groups to simplify management for multiple users.
4. For each user or group, click Assign.
5. Confirm assignments.

​

Save the metadata.xml file

1. In the Okta application, open the Sign On tab.
2. Copy the Metadata URL details.
3. Save the copied information as a file called metadata.xml.

​

2. Create an AWS Identity Provider

1. In AWS, open Identity and Access Management (IAM).
2. Navigate to Identity Providers.
3. Click Add Provider.
4. For Provider type, select SAML.
5. For Provider name, enter a descriptive name.
6. For Metadata document, upload the metadata.xml file you downloaded earlier.
7. Click Add Provider.
8. Note the Identity Provider ARN, which you will use when updating the Okta SAML application. For example: arn:aws:iam::<account_id>:saml-provider/okta-provider
9. Note the Issuer URL, which you will use when creating an AWS role.
10. Note the SSO service location, which you will add to Prophecy via environment variables.

​

3. Create an AWS role for SAML authentication

1. In AWS, go to IAM > Roles > Create role.
2. For Trusted entity type, select SAML 2.0 federation.
3. For SAML 2.0-based provider, choose the provider created in the previous section.
4. For Access to be allowed, select Allow programmatic access only.
5. Set attribute conditions in the AWS role to perform validations before allowing a user to assume the role.

   Attribute condition	Value	Purpose
   SAML:iss	Your Okta Issuer URL	The issuer verifies the SAML assertion was generated by your Okta tenant and not another IdP.
   SAML:aud	https://*.prophecy.io/*	The audience ensures the SAML assertion was issued for Prophecy and not for some other service.

6. Click Next > Next (you will add policies later).
7. Enter a role name and description, then click Create role.
8. If applicable, ensure that the role has required permissions to interact with the EMR Serverless application.
9. Optionally, edit the role to set the Maximum session duration.
10. Note the role ARN, which you will use when updating the Okta SAML application. For example: arn:aws:iam::<account_id>:role/prophecy-emr-okta-login-role

​

4. Update the Okta SAML application

1. In Okta, go to Applications > Applications.
2. Select the application created previously.
3. Go to General > SAML Settings > Edit.
4. In Configure SAML, under Attribute Statements, add:

   Name	Value
   https://aws.amazon.com/SAML/Attributes/RoleSessionName	user.login
   https://aws.amazon.com/SAML/Attributes/Role	<AWS Role ARN>,<AWS Identity Provider ARN>
   https://aws.amazon.com/SAML/Attributes/SessionDuration	Value can be less than or equal to the session duration defined in step 3.8

5. Click Next, then Finish.

​

5. Configure Prophecy to enable SAML for EMR

​

Set environment variables

​

Configure an EMR fabric

1. In Prophecy, create or open an EMR fabric.
2. Switch the authentication method to SAML.
3. Under Login URL, select the value from the AWS_SAML_APP_LOGIN_URLS environment variable.
4. Under Role, select the value from the AWS_SAML_ASSUMED_ROLES environment variable.
5. Select the appropriate AWS region.
6. Click Fetch Environments.
7. In the Connect to Okta dialog, click Continue. This opens the Okta sign-in page in a new tab.
8. Sign in with your Okta credentials.
9. In Prophecy, complete the fabric configuration and save it.