YadvainderaS.37287 (Customer) asked a question.
Production and Dev Applications on same instance of OKTA
What is the recommended best practice for setting up Dev and Prod version of an application with SAML 2.0 authentication in OKTA. When under test mode there can be multiple versions of an application like Dev, QA, Integration Testing etc. that need to be setup. Is it recommended to setup these applications on the same instance of OKTA that the Prod version of the application will be setup on. If this is not recommended, what are the security concerns with this approach besides accidental assignment of an application to a user.
Is there any real concern around the SAML validation cert being the same for the Prod and non-Prod versions of the application?
Hello @YadvainderaS.37287 (Customer)
Thanks for posting.
It is always recommended to manage separated environments and make sure that the connections are not mixed up.
If you have both Prod and Dev app in the same environment the users may get duplicated applications.
These threads might give you a better idea, are from different people with the same situation:
https://support.okta.com/help/s/question/0D50Z00008C3jRmSAJ/best-practices-for-test-and-live-environments?language=en_US
https://devforum.okta.com/t/maintain-multiple-environments-in-okta/10429
https://devforum.okta.com/t/how-do-we-integrate-okta-sso-with-dev-test-staging-environments/11476
https://developer.okta.com/docs/guides/build-sso-integration/openidconnect/main/
Let us know if this helps you.
Daniela Chavarria.
Okta Inc.