Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Integrate Okta as an Identity Provider

Follow these steps to complete pre-requisites, configure your credential apps in Okta, and add your Identity Provider to your HPE Mist organization.

You can use Okta Workforce Identity Cloud through the HPE Mist management portal to authenticate end users attempting to access the network. HPE Mist Networking Access Assurance uses Okta as an identity provider (IdP) to perform various authentication tasks.:

  • For credential-based (EAP-TTLS) authentication, Okta:
    • Performs delegated authentication, that is, checks username and password by using OAuth.
    • Retrieves user group membership information to support authentication policies based on this user identity.
    • Gets the status—active or suspended—of an user account
  • For certificate-based (EAP-TLS or EAP-TTLS ) authorization, Okta:
    • Retrieves user group membership information to support authentication policies based on this user identity
    • Gets the status—active or suspended—of an user account

Prerequisites

  • Create a subscription for Okta and get your tenant ID. During subscription creation, you specify a tenant that is used to create a URL to access the Okta dashboard. You can find your tenant ID at the top- right corner of the Okta dashboard. The tenant ID must not include okta.com.

    Note:

    Your Okta login URL has the following format:

    https://{your-okta-account-id}-admin.okta.com/admin/getting-started.

    Replace {your-okta-account-id} with your Okta tenant ID.
  • You must have super user permission on the HPE Mist portal.

  • Ensure that two-factor authentication (2FA) is disabled for user authentication.

OKTA Resource Owner Password Credential App Integration

Note:

The screenshots from third-party applications are correct at the time of publishing. We have no way to know when or if the screenshots will be accurate at any future time. Please refer to the third-party website for guidance about changes to these screens or the workflows involved.
  1. Log in to the Okta administration console and select Applications > Applications.
  2. Click Create New App Integration.
    Under Sign-in method, select OICD-OpenID Connect and under Application type, select Native Application. The result looks like: <image-needed>
    Click Next.
  3. Under Sign-in method, select OIDC-OpenID Connect and under Application Type, select Native Application.
  4. On the New Native App Integration page, select:
    • App integration name—Enter a name that you resonate with.
    • Grant Type—Select Resource Owner Password.
    • Controlled Access—Select Allow everyone in your organization to access. In this example, we are granting everyone access to the application.
  5. Click Save.

    After the system is saved as a new app integration, the application reloads with the General tab selected.

  6. On the General tab, click Edit and select following options: .
    • Client Authentication—Select Client Secret
  7. Click Save to continue.
    Okta generates the client ID and the client secret after this step.

    Note the client ID and client secret. You'll need this information later.

  8. Go to the Okta API Scopes tab and select the following check boxes to grant read permissions:
    • okta.roles.read
    • okta.users.read
    • okta.users.read.self
Now, go to the HPE Mist management portal and start integrating Okta as an IdP.

Okta Client Credential App Integration

  1. Log in to the Okta administration console and select Applications > Applications.
  2. Click Create App Integration.
    The Create a new app integration page opens.
  3. Under Sign-in method, select API Services.
    The New API Services App Integration page opens.
  4. Enter a name for App integration name and then click Save.
  5. Go to the General tab in the new app integration page and click Edit.
  6. Click Edit and select the client authentication method as Public key / Private key and then click Add Key in the PUBLIC KEYS section.
  7. Select the file format as PEM in the Private Key section, then copy the private key and save it in a safe place.
    In a safe place, save the private key file that Okta generates.

    You will not be able to retrieve this private key again.

    Click Done.
  8. Click Save to store and activate the key.

    You can notice that the status of the key is now Active. Copy the Client ID and secret displayed on the screen.

  9. Scroll down until you see General Settings section. Cick Edit and uncheck the Require Demonstrating Proof of Possession (DPoP) header in token requestsoption.
    Configuration screen for application general settings with options for app integration name, application type, proof of possession, grant type, and Save or Cancel buttons.
  10. Go to the Okta API Scopes tab and allow the following read permissions:
    • okta.roles.read
    • okta.users.read
    • okta.groups.read

Configuration in the Management Portal

  1. From the left menu of the HPE Mist management portal, select Organization > Access > Identity Providers.
    The Identity Providers page displays any configured identity providers.
  2. Click Add IDP to add a new identity provider.
  3. On the New Identity Provider page, enter the following information:
    Configuration screen for setting up an identity provider using OAuth with Okta, including fields for name, IDP type, domain name, default setting, and client credentials.
    1. Name—Enter an IdP name.
    2. IDP Type—Select an IdP type as OAuth.
      Table 1: Settings for Identity Provider Type OAuth

      Parameters

      Description

      OAuth Type

      		 Select Okta

      OAuth Tenant ID

      Enter OAuth tenant ID. Use the ID you received during Okta application configuration.

      Domain Names

      Enter your Okta users domain name. Example: abc.com

      Default IDP

      Set the selected identity provider as default if user domain name is not specified.

      OAuth Client Credential (CC) Client Id

      Use the ID you received during Okta application configuration.

      Okta Client Credential App Integration
      OAuth Client Credential (CC) Client Private Key Enter the private key generated during Okta application configuration. See Okta Client Credential App Integration

      OAuth Resource Owner Password Credential (ROPC) Client Id

      Enter the secret ID you received and stored during Okta application configuration.

      See OKTA Resource Owner Password Credential App Integration.
      OAuth Resource Owner Password Credential (ROPC) Client Secret

      Provide client secret value you received and stored during Okta application configuration.

      See OKTA Resource Owner Password Credential App Integration
  4. Click Create to save the changes.

From the left menu of the the management portal, select Monitoring > Insights > Client Events.

When a user authenticates using EAP-TLS with Okta, you can see the event called NAC IDP Group Lookup Success as shown below:

Network client event log interface showing client events like DHCP success, authorization, and certificate validation. Left side lists events with timestamps, right side shows details like SSID, authentication type, certificate info, user name, IdP roles, IDP, and EAP type.

In case of EAP-TTLS authentication, you can see the NAC IDP Authentication Success event. This event indicates that Azure AD has validated user credentials. You can also see the NAC IDP Group Lookup Success event that fetches user group memberships.

Client Events log showing network activities for vdementyev@juniper.net with 3745 total events, including 1266 good, 2303 neutral, and 176 bad. Details include AP BRQLAB-APJ-2, SSID mist-aa, authentication type 802.1X, and certificate expiry 0001-01-01T00:00:00Z.

See Also