Access Control for Data Science Workspaces using Okta SAML

Question

Pulumi · Accepted Answer

To set up access control for Data Science Workspaces using Okta SAML, you'll need to create SAML integrations in Okta that allow users to authenticate with SAML. You can use Pulumi to provision this setup on a cloud provider like AWS, Azure, or GCP, integrating with their services that support SAML, for instance, AWS Sagemaker, Azure Databricks, or Google Cloud AI Platform Notebooks.

Here's what we'll do in the Pulumi program:

Create a SAML application in Okta for your Data Science Workspace. This will act as a Service Provider (SP) that can be configured to use SAML for authentication.
Set up an Identity Provider (IdP) in Okta, if needed, to represent the external identity provider.
Configure Okta groups and possibly application settings if additional configuration is needed.

Below is a Pulumi program written in Python that sets up SAML access control for Data Science Workspaces in Okta. Remember to replace placeholders with actual values that are relevant to your Okta domain and application-specific details.

import pulumi
import pulumi_okta as okta

# Define your SAML application in Okta
saml_app = okta.app.Saml("dataScienceWorkspaceSamlApp",
    label="Data Science Workspace",
    # The below properties need to be adjusted to align with your SAML SP configuration
    preconfigured_app="saml_2_0",
    app_settings_json="""{
        "app": {
            "exampleProperty": "exampleValue"
        }
    }""",
    # Configure endpoints for your Service Provider (SP)
    acs_endpoints=[
        okta.app.SamlAcsEndpointArgs(
            binding="HTTP-POST",
            type="INSTANCE",
            url="https://<workspace-service-provider-endpoint>"
        )
    ],
    # Assertion attributes and other SAML settings go here
    # ...
)

# If using an external IdP or need finer control over SAML configurations, you might define a SAML IdP
idp_saml = okta.idp.Saml("externalIdPSaml",
    issuer="<external-idp-issuer-url>",
    sso_url="<external-idp-single-sign-on-url>",
    # Other necessary properties such as certificates follow
    # ...
)

# We would define Okta user groups likely to correspond to different roles in your workspace
data_scientists_group = okta.Group("dataScientistsGroup",
    name="DataScientists",
    description="Group for data scientists"
)
# Repeat for other user roles as necessary

# If you need to, associate the Okta groups with the SAML App
group_attachment = okta.app.GroupAttachment("attachDataScientists",
    app_id=saml_app.id,
    group_id=data_scientists_group.id,
)

# If application settings need to be fine tuned, they can be set as well
app_settings = okta.AppSamlAppSettings("samlAppSettings",
    app_id=saml_app.id,
    settings="""{
        "custom_setting": "custom_value"
    }""",
)

# Outputs
pulumi.export("saml_app_id", saml_app.id)
pulumi.export("data_scientists_group_id", data_scientists_group.id)

This program creates the SAML application configuration within your Okta organization which is needed to set up access control for your Data Science workspaces. The application is preconfigured for SAML 2.0 and you need to replace the endpoints with URLs specific to your service provider. User groups are essential for role-based access control, so you need to create these groups accordingly and link them to the application.

After running this program with pulumi up, your Okta environment will be configured for SAML-based access control that you can use with your Data Science workspaces. Remember to set the Access Control policies within your workspace provider to trust the SAML application you've set up.