Using Okta for Multifactor Authentication for CTE GuardPoints

Integration with Okta requires creating an OIDC connection in CipherTrust Manager, after you create an OIDC template in Okta.

Prerequisites

• Have a CipherTrust Manager set up with:

  • Client Profile enabled for Multifactor Authentication

  • Registration token

On the Okta platform

1. Create an admin user.

2. Create one or more Okta users. Note that Okta requires the username to be in email format.

   • Create domain users in the format: <username>@<domain>.com

   • Create host specific users in the format: <username>@<hostname>.com

   • Create non-domain users in the format: <username>@localhost.com.

   Non-domain users map to system users with implicit host domain access on each host.

3. Create an OIDC application (“App Integration”) with the following settings:

   • Application type: Web Application

   • Client Authentication: Client Secret

   • Grant type: Authorization Code

   • Login/Sign-in Redirect URIs: http://127.0.0.1:<CTE-OIDC-Login-Port>/auth/callback

   • Default value of CTE-OIDC-Login-Port: 5560, if CTE admin changes this port, they must provide the updated value.

4. Note the OIDC parameters:

   • Client-ID as configured for the OIDC client

   • Client-Secret as shown for the OIDC client

On CipherTrust Manager

The Provider Url for the Okta account is in the following format:

https://<okta-account>.okta.com/.well-known/openid-configuration

Create an OIDC connection on CipherTrust Manager

1. Log on to the CipherTrust Manager GUI as an administrator.

2. In the left pane, click Access Management > Connections.

3. In the Connections, click Add Connection.

4. Click OIDC and then click Next.

5. Provide a name for the connection and click Next.

6. Enter values for the configuration information.

   Note

   Refer to your Multifactor Authentication provider profile for the values:

   • URL of OIDC provider:
   Linux

   • For KeyCloak, select the URL of the OIDC provider

   Windows

   • For Thales SafeNet Trusted Access, select Well Known Configuration URL

   • For all other providers, select the URL of the OIDC provider

   • Client-ID as configured for the OIDC client

   • Client-Secret as shown for the OIDC client

7. Click Next and in the Add Products window, select CTE for product.

8. Click Add Connection.