This guide outlines how to configure CAC (Common Access Card) and PIV (Personal Identity Verification) authentication for S-Sign using Okta as the Identity Provider. This setup provides a high-assuran
Using Okta as an authentication layer allows S-Sign to leverage hardware-based certificates (CAC/PIV) to verify a signer's identity before they can access and sign a document within Salesforce.
The authentication flow moves the signer from the S-Sign document link through Okta’s secure verification process before returning them to Salesforce to complete the signature.
S-Sign: Acts as the service requester.
Okta: Acts as the Identity Provider (IdP) that handles the certificate challenge.
Salesforce: The native environment where the document and audit trail reside.
Before beginning the configuration, ensure the following environments are prepared:
Okta Tenant: An active Okta instance with administrative access.
Salesforce Org: S-Sign must be installed and configured.
Certificates: Valid Root and Intermediate CA certificates must be uploaded to Okta to validate the CAC/PIV cards.
Attribute Mapping: A unique identifier (typically email or UPN) must match between the user's CAC/PIV certificate and their record in Salesforce/Okta.
SSign.AuthenticationRedirect must be added to the S-Sign Site's Visualforce pages
Enable Personal Identity Verification: In the Okta Admin Console, navigate to Security > Authenticators and set up the PIV/CAC card authenticator.
Upload Certificates: Upload the necessary CA certificates that issued the CAC/PIV cards to the Okta Trust Store.
Create an OIDC Application: Create a new App Integration in Okta using OIDC (OpenID Connect).
Sign-in redirect URIs: This must match the S-Sign callback URL provided in the S-Sign setup.
Assignments: Assign the specific users or groups who will be required to sign documents using this method.
Create Auth. Provider: In Salesforce Setup, create a new Auth. Provider using the "Open ID Connect" type. Use the Client ID and Secret generated in the Okta App Integration.
Named Credentials: Configure a Named Credential if required by your specific S-Sign version to securely handle the callouts to Okta.
S-Sign Custom Settings: Navigate to the S-Sign Configuration page. Under the "Alternative Authentication" section, input the Okta Auth. Provider details and the specific Okta Org URL.
Once the global connection is established, you must enable it on a per-template basis:
Open the S-Sign Template Editor.
Navigate to Template Settings > Signer Profiles.
For the specific signer (e.g., Signer 1), change the Authentication Method from "Email PIN" to "Okta/CAC/PIV".
Save and select the appropriate Auth. Provider from the dropdown menu.
When a signer receives a document link with CAC/PIV enabled, the workflow changes:
Click Link: The signer clicks the link in their email.
Redirect: S-Sign automatically redirects the browser to the Okta login page.
Certificate Challenge: The signer inserts their CAC/PIV card and enters their PIN. Okta validates the certificate against the trusted CA.
Verification: Upon success, Okta redirects the signer back to the S-Sign document.
Access: The document is unlocked, and the signer can proceed to sign.
Multi-Factor Authentication (MFA): Satisfies federal requirements for hardware-based MFA.
Non-Repudiation: Digital certificates provide stronger proof of identity than standard email access.
Audit Trail: The S-Sign Audit Trail will record that the user was authenticated via an external Identity Provider (Okta), including the successful authentication timestamp.
Redirect Mismatch: Ensure the "Sign-in redirect URI" in Okta exactly matches the URL in the Salesforce Auth. Provider.
Certificate Errors: If the signer's card is not recognized, verify that the full certificate chain (Root and Intermediate) is correctly uploaded to Okta.
User Matching: Ensure the "Subject Alternative Name" or "Common Name" on the CAC card matches the username or email expected by Okta.
Last updated
Was this helpful?
Was this helpful?