Configuration of single sign-on in Okta

Documentation Index

Fetch the complete documentation index at: https://docs.nebius.com/llms.txt

Use this file to discover all available pages before exploring further.

• Nebius AI Cloud, where you create and configure a federation.
• , where you create an application, make it available to the users for whom you configure SSO, and connect the to the federation.

​

Costs

​

Prerequisites

1. Create an Okta account.
2. Make sure that your Nebius AI Cloud account is added to the tenant’s group of administrators. To check this, in the web console, go to  Administration → IAM → Users.
3. If you prefer not to use the web console, prepare one of the other available Nebius AI Cloud interfaces:
   • CLI
   • Terraform

   Install and configure the Nebius AI Cloud CLI.

   Install and configure the Nebius AI Cloud provider for Terraform.

​

Steps

​

Create an application in Okta

1. Sign in to the Okta admin console.
2. Create and configure a new application:
   1. Go to Applications → Applications and click Create App Integration.
   2. In the window that opens, select SAML 2.0 and click Next.
   3. On the General settings step, enter a name in the App name field. You can optionally upload a logo for your app.
   4. Click Next to proceed to the Configure SAML step and specify the following parameters:
      • Single sign-on URL: https://auth.nebius.com/login/saml2/provider/federation-id
      • Audience URI (SP Entity ID): https://auth.eu.nebius.com/saml2/rp/federation-id
      • Name ID format: Unspecified
      • Application username: Okta username
        federation-id is used temporarily until you create a federation and get its ID. After that, replace federation-id with the actual value.
   5. Click Next to proceed to the Feedback step and select the This is an internal app that we have created checkbox next to App type.
   6. Click Finish to create the application.
3. Create users, assign users to a group and then assign the group to your application.

​

Download the IdP metadata file from Okta

1. Go to your application page in the Okta admin console.
2. Switch to the Sign On tab and find the SAML Signing Certificates section.
3. Click Actions → View IdP metadata next to the currently active certificate. If there are no active certificates, click Generate new certificate to create one.
4. In the browser tab that opens, save the XML file with metadata (for example, by using Command + S on macOS or Ctrl + S on Windows). To download the certificate without metadata, use Actions → Download certificate.

​

Create a federation in Nebius AI Cloud

1. To create a federation:
   • Web console
   • CLI
   • Terraform

   1. In the sidebar, go to  Administration → IAM.
   2. Click Create entity and select Federation.
   3. Enter your federation name and click Upload file.
   4. Select the XML file you saved in the previous step and click Continue.
   5. Enter a name for your certificate in the Certificates section and click Create federation. Copy the ID of the newly created federation.

   1. Run the following command:
      nebius iam federation create \
        --parent-id <tenant_ID> \
        --name <federation_name> \
        --user-account-auto-creation=true \
        --saml-settings-sso-url <Login_URL> \
        --saml-settings-idp-issuer <Identity_Provider_Identifier>
      
      The command contains the following parameters:
      • --parent-id: The ID of the tenant where you are going to create a federation. To get the tenant ID, go to the web console and expand the top-left list of tenants. Next to the tenant’s name, click → Copy tenant ID.
      • --name: The federation name.
      • --user-account-auto-creation: When the user signs in to Nebius AI Cloud via SSO, their account is automatically created in the tenant with the configured federation.
      • --saml-settings-sso-url: Okta login URL.
      • --saml-settings-idp-issuer: Okta identifier. To get values for --saml-settings-sso-url and --saml-settings-idp-issuer:
        1. Open the XML file with metadata that you saved in the previous step.
        2. In the EntityDescriptor element, find the entityID attribute and use its value for --saml-settings-idp-issuer.
        3. In one of the SingleSignOnService elements, find the Location parameter and use its value for --saml-settings-sso-url.
   2. Copy and save the federation ID. It is returned in the metadata.id field of the command output.

   1. Create the following configuration file:
      resource "nebius_iam_v1_federation" "<federation_name>" {
        name                       = "<federation_name>"
        parent_id                  = "<tenant_ID>"
        user_account_auto_creation = true
        saml_settings = {
          sso_url    = "<login_URL>"
          idp_issuer = "<Okta_identifier>"
        }
      }
      
      output "federation_id" {
        description = "ID of the created federation"
        value = nebius_iam_v1_federation.<federation_name>.id
      }
      
      The file contains a resource with federation settings and an output that returns the federation ID. The resource contains the following parameters:
      • name: The federation name.
      • parent_id: The ID of the tenant where you are going to create a federation. To get the tenant ID, go to the web console and expand the top-left list of tenants. Next to the tenant’s name, click → Copy tenant ID.
      • user_account_auto_creation: When the user signs in to Nebius AI Cloud via SSO, their account is automatically created in the tenant with the configured federation.
      • saml_settings.sso_url: Okta login URL.
      • saml_settings.idp_issuer: Okta identifier. To get values for saml_settings.sso_url and saml_settings.idp_issuer:
        1. Open the XML file with metadata that you saved in the previous step.
        2. In the EntityDescriptor element, find the entityID attribute and use its value for saml_settings.idp_issuer.
        3. In one of the SingleSignOnService elements, find the Location parameter and use its value for saml_settings.sso_url.
   2. Check that the configuration is correct:
      terraform validate
      
   3. Apply the changes:
      terraform apply
      
   4. Copy and save the federation ID. It is returned in the terraform apply output:
      Outputs:
      
      federation_id = "federation-e00*******"
      
2. Update the SAML settings of your application in the Okta admin console:
   1. Open the application page and go to the General tab.
   2. In the SAML Settings section, click Edit and go to the Configure SAML step.
   3. In the fields Single sign-on URL and Audience URI (SP Entity ID), replace the federation-id part of the values with the copied federation ID.

​

Add a certificate to the federation

​

Log in to Nebius AI Cloud

1. Open the Nebius AI Cloud web console.
2. Click Get started with SSO.
3. Enter the federation ID and click Sign in.
4. In the Contact details window that opens:
   1. Specify your name and email.
   2. Confirm that you agree with the Nebius AI Cloud Terms of Use.
   3. Click Continue.

​

Assign administrator rights for the new account

1. Log out of your new account in the web console.
2. Log in to your main Nebius AI Cloud account.
3. Go to  Administration → IAM → Users and add the new user to the relevant admin group.