Using Okta for Multifactor Authentication for CTE GuardPoints

Integration with Okta requires creating an OIDC connection in CipherTrust Manager, after you create an OIDC template in Okta.

Prerequisites

• Have a CipherTrust Manager set up with:

  • Client Profile enabled for Multifactor Authentication

  • Registration token

On the Okta platform:

1. Create an admin user.

2. Create one or more Okta users. Note that Okta requires the username to be in email format.

   • Create domain users in the format: <username>@<domain>.com

   • Create host specific users in the format: <username>@<hostname>.com

   • Create non-domain users in the format: <username>@localhost.com.

   Non-domain users map to system users with implicit host domain access on each host.

3. Create an OIDC application (“App Integration”) with the following settings:

   • Application type: Web Application

   • Client Authentication: Client Secret

   • Grant type: Authorization Code

   • Login/Sign-in Redirect URIs: http://127.0.0.1:<CTE-OIDC-Login-Port>/auth/callback

   • Default value of CTE-OIDC-Login-Port: 5560, if CTE admin changes this port, they must provide the updated value.

4. Note the OIDC parameters:

   • Client-ID as configured for the OIDC client

   • Client-Secret as shown for the OIDC client

On CipherTrust Manager

The Provider Url for the Okta account is in the following format:

https://<okta-account>.okta.com/.well-known/openid-configuration

Create an OIDC connection on CipherTrust Manager

1. Log on to the CipherTrust Manager GUI as an administrator.

2. In the left pane, click Access Management > Connections.

3. In the Connections, click Add Connection.

4. Click OIDC and then click Next.

5. Provide a name for the connection and click Next.

6. Enter values for the configuration information.

   

   Note

   Refer to your Multifactor Authentication provider profile for the values:

   • URL of OIDC provider:

     • For Thales Safenet Trusted Access, select Well Known Configuration URL

     • For other providers, select the URL of the OIDC provider

   • Client ID

   • Client Secret

7. Click Next and in the Add Products window, select CTE for product.

8. Click Add Connection.

Next, Enable Multifactor Authentication