SafeNet IDPrime Virtual Server Setup

As a prerequisite, you must have a SafeNet IDPrime Virtual server that is up and running on your machine. The SafeNet IDPrime Virtual server runs in a docker container, and stores the configuration in a database.

Configuring Okta as your identity provider in SafeNet IDPrime Virtual requires:

• Configuring the Identity Provider Configuration File
• Running the IDPV Server and Setting Up the IDPV Tenant

Configuring the Identity Provider Configuration File

Perform the following steps to configure the idp-configuration.json configuration file:

1. Create or copy an existing idp-configuration.json file and place it in the /config directory mapped to the container.

2. Access the WELL KNOWN CONFIGURATION URL (openid-connect discovery url) on the Okta Authorization Server to get the above parameters.

3. In a browser, open the jwks_uri URL, and copy the values of the following keys and paste them in the text editor:

   • kid
   • n
   • e

4. Open the idp-configuration.json file that is placed at the /config path and enter the values of the parameters given in the below table:

   Parameter	Value
   SigningKeys	IdpPublicKeyModulus: Enter the value of n key copied from step 3. IdpPublicKeyExponent: Enter the value of e key copied from step 3. IdpKeyId: Enter the value of kid key copied from step 3.
   IdpIssuerUrl	Enter the value of the Issuer url from ./well-known url.
   IdpClientId	Enter the value of the Client ID that is added on Okta Authorization server for this oauth application.
   IdpRedirectUrl	Enter the VALID REDIRECT URL that is configured in client configuration on IDPV server. For executing IDPV client only: URL structure: https://<server-host>/redirect For example: https://www.idpvserver.com/redirect For executing Self-Service Portal and IDPV client: URL structure: https://<server-host>/redirect For example: https://www.idpvserver.com/redirect Note: This URL is updated per IDPV server host name.
   IdentityProvider	Enter Okta as the IDPV type.
   RefreshTokenExpirationDuration	By default, the value is 480
   JwtExpiration	Enter a timeframe (in seconds) to be used by the IDPV client. The IDPV client obtains the access token value during this timeframe preceding the expiration of the access token.
   JwtGroupClaim	Enter groups.
   JwtUserClaim	Enter preferred_username.
   IDPrimeVirtualAdmin	Enter a list of administrator group claim names.
   IDPrimeVirtualUser	Enter a list of user group claim names. Note: User must be a part of any of the groups mentioned in the IDPrimeVirtualUser or IDPrimeVirtualAdmin parameter.
   OfflineTokenEnabledGroup	Enter a list of group claim name for offline.
   IDPrimeVirtualProvisioningAdmin	Enter a list of provisioning admin group.
   JwtAdminWhiteList	Contains list of IDPrime Virtual Admin users.
   IdpScope	The mandatory scope added in application on Okta. IdpScope parameter will read the IdpScope field of tenant configuration. When the server is upgraded, old tenant will be populated with value as idpvscope openid offline_access for Okta IDP, if this field is not explicity provided. For new tenant, this field must be configured similar to Okta client side in the idp-configuration.json file.

The JwtAdminWhiteList, IDPrimeVirtualProvisioningAdmin, and OfflineTokenEnableGroup are optional parameters and must be provided if the Provisioning and Offline mode functions are enabled.

Sample 1: idp-configuration.json file for 2.5 release

    {
    "SigningKeys": [
    {
    "IdpPublicKeyModulus": "w8WNolAPDM-24wIMoKNXtkYEoMyzmvSJsOqphFFPx9ko1lrq3Uow2ocwkdn6NXh-QB5uIwHmO-QnvCbwHmDwOqOWKDqriW30GgRB-PJTbkvp0d0EJ-gaumOWG3Sm0MXDuAEdhT2F4YFSiIeiVvgSz6lwvvL6oMZldRCT4WqmrXbCy79InBpsabEjSCEt8WvU0XN1cPOK7D-9i2qMgoUdtOyGLnfO_FYpKnxjNnyTvgxsNZTU0gtH_GchffDljOorAvNJYKDHtkn9r86gAZxrSniM_DZq2FOtz8AOkeGE8qHAYG3jjipv2E0q6Y9S0ycIwsrC0W_mOEdItc1pE5H2jQ",
    "IdpPublicKeyExponent": "AQAB",
    "IdpKeyId": "umxhT2pUQvFk1vx0QXK5FDGARDmO4fGAPC3H2YZvSRc"
    }
    ],
    "IdpClientId":"0oa12p1plx199nhBk5d7",
    "IdpIssuerUrl":"https:///oauth2/aus12xi6q8QQx1yhL5d7", 
    "IdpRedirectUrl":"https://www.idpvserver.com/redirect", 
    "JwtExpiration":"0000001e",
    "IdentityProvider":"Okta",
    "RefreshTokenExpirationDuration": "480", 
    "JwtGroupClaim":"groups", 
    "JwtUserClaim":"preferred_username", 
    "JwtAdminWhiteList":"", 
    "IDPrimeVirtualAdmin":"IDPrimeVirtualAdmin", 
    "IDPrimeVirtualUser":"IDPrimeVirtualUser", 
    "OfflineTokenEnabledGroup":"IDPrimeVirtual_Offline",
    "IDPrimeVirtualProvisioningAdmin":"IDPrimeVirtualProvisioningAdmin",
    "IdpScope": "idpvscope openid  offline_access"
    }

Sample 2: idp-configuration.json file for 2.4.1 release

    {
    "IdpPublicKeyModulus":"w8WNolAPDM- 24wIMoKNXtkYEoMyzmvSJsOqphFFPx9ko1lrq3Uow2ocwkdn6NXh-QB5uIwHmO- QnvCbwHmDwOqOWKDqriW30GgRB-PJTbkvp0d0EJ- gaumOWG3Sm0MXDuAEdhT2F4YFSiIeiVvgSz6lwvvL6oMZldRCT4WqmrXbCy79InBpsabEjSCEt8WvU0 XN1cPOK7D-9i2qMgoUdtOyGLnfO_FYpKnxjNnyTvgxsNZTU0gtH_ GchffDljOorAvNJYKDHtkn9r86gAZxrSniM_ DZq2FOtz8AOkeGE8qHAYG3jjipv2E0q6Y9S0ycIwsrC0W_mOEdItc1pE5H2jQ",
    "IdpPublicKeyExponent":"AQAB", "IdpKeyID":"umxhT2pUQvFk1vx0QXK5FDGARDmO4fGAPC3H2YZvSRc",
    "IdpClientId":"0oa12p1plx199nhBk5d7",
    "IdpIssuerUrl":"https:///oauth2/aus12xi6q8QQx1yhL5d7", 
    "IdpRedirectUrl":"https://www.idpvserver.com/redirect", 
    "JwtExpiration":"0000001e",
    "IdentityProvider":"Okta",
    "RefreshTokenExpirationDuration": "480", 
    "JwtGroupClaim":"groups", 
    "JwtUserClaim":"preferred_username", 
    "JwtAdminWhiteList":"", 
    "IDPrimeVirtualAdmin":"IDPrimeVirtualAdmin", 
    "IDPrimeVirtualUser":"IDPrimeVirtualUser", 
    "OfflineTokenEnabledGroup":"IDPrimeVirtual_Offline",
    "IDPrimeVirtualProvisioningAdmin":"IDPrimeVirtualProvisioningAdmin",
    "IdpScope": "idpvscope openid  offline_access"
    }

You can modify the policy-configuration.json file as per your preferred configuration.

Sample policy-configuration.json file:

    {
    "UserPinPolicy": 
    { 
        "MaxRetries": 5, 
        "IsMustChange": false
    },
    "AdminPinPolicy": 
    { 
        "MaxRetries": 5, 
        "IsMustChange": false
    },
    "OfflineTokenPolicy": 
    { 
        "ValidityDurationInHours": 120, 
        "PrivateKeyExportLevel": "All"
    }
    }

Sample sws-config.json file:

    {
    "_comment1": "(Mandatory for SWS API) The commercial name of the remote service. The maximum size of the string is 255 characters.",
    "Name": "Thales Signing Web Service",
    "_comment2": "(Mandatory for SWS API) The ISO 3166-1 [22] Alpha-2 code of the Country where the remote service provider is established (e.g. ES for Spain).",
    "Region": "US",
    "_comment3": "(Mandatory for SWS API) The URI of the image file containing the logo of the remote service which SHALL be published online. The image SHALL be in either JPEG or PNG format
    and not larger than 256x256 pixels.",
    "Logo": "https://example.com/SWSLogo.png",
    "_comment4": "(Mandatory for SWS API) The maximum size of the string is 255 characters.",
    "Description": "The Signing web service (SWS) APIs are based on Cloud Signature Consortium (CSC) standards and it supports web and mobile applications and comply with the most demanding electronic signature regulations in the world.' # (Mandatory for SWS API) The maximum size of the string is 255 characters."
    }

Running the IDPV Server and Setting Up the IDPV Tenant

After configuring the SafeNet IDPrime Virtual Server files, you need to perform the following steps to run the IDPV server and set up the IDPV tenant:

1. Run the IDPV server, refer to Running the IDPV Server section.

2. Run the following command to create an SafeNet IDPrime Virtual (IDPV) tenant.

   
   SetupTenant create -i <Config/idp-staclassic-redirect.json> -p <Config/policy-configuration.json> -k true (or false)  -a <IDP_client_secret> -k true (or false) -n <tenant_name> -u true (or false) -c <IDPV (or SWS)> -m false (or true) -s <Config/sws-config.json>
   

   Where,

   • -i accepts a json file as an IDP configuration file (Mandatory).
   • -p accepts a json file as a token policy configuration file (Mandatory).
   • -a accepts the OAuth Client Secret (Mandatory).
   • -k accepts true or false for the HSM export key flag. It is true by default (Optional).
     If -k is set to true explicitly, then the tenant is created for the export mode provided, and HSM supports it.
   • -c accepts the tenantCategory (Optional). Use SafeNet IDPrime Virtual (IDPV) or Signature Web Service (SWS) to specify a tenant category. If -c is not given, the default value is IDPV.
   • -s accepts a json file as a sws configuration file.
   • -n accepts a tenant name.
   • -m accepts true or false for the SKS mode flag. The default value is set to false.
   • -u accepts true or false. When -u is true, the IDPV Admin needs to provision the smart card for the user by using Connecting on behalf of the user functionality. When -u is false, the user can provision the smart card on his own, by connecting with the IDPV Client.

IDPV Tenant Example:

   SetupTenant create -i Config/idp-staclassic-redirect.json -p Config/policy-configuration.json -k true  -a fd1b4b61-32ba-47b3-a0c9-cf8bda938b4d -n 'Okta-IDPV-Tenant' -u true -c IDPV

   

SWS Tenant Example:

   SetupTenant create -i Config/idp-staclassic-redirect.json -p Config/policy-configuration.json -k true  -a fd1b4b61-32ba-47b3-a0c9-cf8bda938b4d -n 'Okta-SWS-Tenant' -c SWS -m True -s Config/sws-config.json

   

1. After running the above command, a Tenant ID is generated and saved as a text file in the /publish/Tenant/<TenantGUID>.txt directory, and displayed on the console.

2. Copy the Tenant ID to the machine using the following command:

   
   docker cp idprime-virtual-server-containername:/publish/Tenant/<TenantGUID>.txt <location on host>