Configure Okta as an IdP in the Cloud Identity Engine
If you want
to use Okta to authenticate users with the Cloud Identity Engine, there
are two ways to configure Okta authentication with the Cloud Identity
Engine:
Select the method you want to use to integrate
the Okta authentication in the Cloud Identity Engine and complete
the steps in the Okta management console.
Set up the Okta authentication in the Cloud Identity
Engine.
If you have not already done so, activate the Cloud Identity
Engine app.
In the Cloud Identity Engine app, select AuthenticationSP MetadataDownload SP Metadata and Save the
metadata in a secure location.
Add Okta as an authentication type in the Cloud Identity
Engine app.
Select Authentication Types and
click Add New Authentication Type.
Set Up a SAML 2.0 authentication
type.
Enter a Profile Name.
Select Okta as your Identity
Provider Vendor.
Select the method you want to use to Add Metadata and Submit the
IdP profile.
If you want to enter the information manually, copy
the identity provider ID and SSO URL, download the certificate,
then enter the information in the Cloud Identity Engine IdP profile.
In the Okta Admin Console, click Identity Provider
metadata.
Copy the necessary information from the Okta Admin Console and enter it in
the IdP profile on the Cloud Identity Engine app as indicated in
the following table:
Copy or Download from Okta
Admin Console
Enter in Cloud Identity Engine
Copy the Identity
Provider Issuer.
Enter it as the
Identity Provider
ID.
Download
the X.509
Certificate.
Click to
Upload the certificate from the Okta
Admin Console.
Copy the Identity
Provider Single Sign-On URL.
Enter the URL as the
Identity Provider SSO
URL.
Select the HTTP Binding for SSO Request to IdP method you want to use for
the SAML binding that allows the firewall and IdP to exchange
request and response messages:
HTTP Redirect—Transmit SAML
messages through URL parameters.
HTTP Post—Transmit SAML messages
using base64-encoded HTML.
If you want to upload a metadata file, download the metadata file from your IdP management
system.
In the Okta Admin Console, click View Setup
Info and copy the IDP
metadata and save it to a secure location.
In the Cloud Identity Engine app, click Browse
Files to select the metadata file then
Open the metadata file.
If you don't want to
enter the configuration information now, you can Do it
later. This option allows you to submit the profile
without including configuration information. However, you must edit the
profile to include the configuration information to use the
authentication type in an authentication profile.
Specify the Maximum Clock Skew (seconds), which is the
allowed difference in seconds between the system times of the IdP and the
firewall at the moment when the firewall validates IdP messages (default is 60;
range is 1–900). If the difference exceeds this value, authentication
fails.
To require users to log in using their credentials to reconnect to
GlobalProtect, enable Force Authentication.
Test SAML setup to verify the
profile configuration.
This step is necessary to confirm that your firewall and IdP can
communicate.
Select the SAML attributes you want the firewall to use
for authentication and Submit the IdP profile.
You must select the username attribute in the Okta Admin
Console for the attribute to display in the Cloud Identity Engine.
In the Okta Admin Console, Edit the User
Attributes & Claims.
In the Cloud Identity Engine app, select the Username Attribute and
optionally, the Usergroup Attribute,
Access Domain, User
Domain, and Admin Role.
If
you're using the Cloud Identity Engine for SAML authentication with
GlobalProtect Clientless VPN, you must configure the User
Domain attribute to the same value as the
userdomain field in the Okta Admin
Console (ApplicationsApplicationsSAML 2.0General).
Integrate Okta as a Gallery Application
Palo Alto Networks strongly recommends that
you integrate Okta in the Cloud Identity Engine as a gallery application.
Complete the following steps to add and configure the Okta gallery
application in the Cloud Identity Engine. Be sure to complete all
the steps here and in the Okta documentation.
Log in to the Okta Admin Console and select ApplicationsApplications.
Click Browse App Catalog.
Search for and select Palo Alto Networks Cloud Identity Engine.
Click Add Integration.
Optionally edit the application name then click Next.
Verify that SAML 2.0 is the sign-on option
type.
If you enabled Force Authenticationin step 6, select
Applications, select the app you created, select
Sign-On, Edit the
Settings, and uncheck Disable Force
Authentication.
Edit and paste the SAML Region.
The SAML Region is based on the Entity ID in the SP Metadata.
To obtain the SAML Region, enter only the text between the backslash
in the Entity ID and the paloaltonetworks.com domain.
For example, if the Entity ID is https://cloud-auth.us.apps.paloaltonetworks.com/sp,
the SAML Region is cloud-auth.us.apps.
Select the Application username format that
you want to use to authenticate the user. For example, Email represents
the UserPrincipalName (UPN) format.
Click Done.
(Optional) If you want to configure other attributes
in addition to the username, refer to the Okta documentation.
Integrate Okta as a Custom Application
Palo Alto Networks strongly recommends that you Integrate Okta as a Gallery Application. However, if you want to configure the Okta integration as a
custom application, complete the following steps.
Log in to the Okta Admin Console and select ApplicationsApplications.
Click Create App Integration.
Verify that SAML 2.0 is the sign-on method then
click Next.
Enter an App name then click Next.
Copy the SP Metadata information
from the Cloud Identity Engine and enter it in the Okta Admin Console
as described in the following table:
Copy from Cloud Identity Engine
Enter in Okta Admin Console
Copy the Entity ID from
the SP Metadata page.
Enter it as the Audience URI (SP Entity
ID).
Copy the Assertion Consumer Service
URL.
Enter the URL as the Single sign on
URL.
(Required for custom app) Select a Value for
the user attributes (Attribute Statements (optional))
and optionally enter a Filter for the group
attributes (Group Attribute Statements (optional))
to specify the attribute formats.
You must configure at least one SAML attribute that contains identification information for the
user (usually the username attribute) for the attributes to display in
the Cloud Identity Engine. To configure administrator access, you must
also enter values for the accessdomain attribute
and for the adminrole attribute that match the
values on the firewall.
Click Next, specify whether you're a customer or
partner, then click Finish.
Click Add Rule to define a Sign
On Policy that specifies which users and groups must
authenticate with the Okta IdP using the Cloud Identity Engine.
Select Assignments and Assign the users
and groups that you require to authenticate using the Cloud Identity
Engine. Save and Go Back to assign more users
or groups.
Be sure to assign the account you're using so you can test the configuration when it's
complete. You may need to refresh the page after adding accounts to
successfully complete the test.
Select Sign On and View
Setup Instructions.
Select the SAML attributes you want the firewall to use
for authentication.
