Appendix C - Creating a SSO and MFA OpenID Connect Integration with Okta

Overview

As of version 8.6.0, Snare Central can be configured to allow login using Okta account.

This guide will help you setup and configure Snare Central to perform SSO and MFA authentication via Okta.

As a general description, the process to configure Okta support for Snare Central involves the following steps:

1. Configure a new Integration for Snare Central in the Okta portal. This requires administrative rights within the Okta portal.

2. Configure the Sign-In redirect URL in the providers portal. This URL is provided in the Sign-In redirect URL field in this section of the Configuration Wizard.

3. Configure the groups that will have access to Snare Central in the Okta portal. The name of the groups must start with the Default Group Prefix show in this section of the Configuration Wizard (Snare_Central.).

4. Once the new integration has been created, get the required credentials. In the case of Okta these credentials include Domain, Client ID, Client Secret and API Token.

5. Using the credentials from Okta: Domain, Client ID, Client Secret, and API Token, add a new IAM Service Provider in the Configuration Wizard by clicking the Add button.

6. Retrieve the groups from Okta by clicking the Retrieve Groups button.

7. Once the groups have been obtained from Okta, the Snare Central Administrator needs to grant them permissions in the Manage Access Control tool.

8. Logout from Snare Central and a new LOGIN WITH OKTA button will be available in the login page for users defined in the Okta portal.

A detailed description on each of the above steps follows.

Configure a new Integration for Snare Central in the Okta portal

• Okta allows you to enable Single Sign On (SSO) and Multi Factor Authentication (MFA) using OpenID Connect authentication for your applications. This guide explains how to create a new OpenID Connect integration with Okta.

• Before you begin, you need a verified Okta account and a registered application. If you don't have these, please follow the appropriate steps in the Okta documentation.

• Snare will use an Okta flow called Redirect authentication: A user sign-in flow that grants authentication control to Okta by redirecting to an Okta hosted sign-in page.

• This flow uses open protocols like OAuth 2.0 and SAML.

• So, the first thing that is needed is to configure your Okta environment.

Create a New OpenID Connect Integration (Application)

• Log in to your Okta account and navigate to the Okta dashboard; the dashboard displays all the applications in your organization.

• To create a new OpenID Connect integration, navigate to the Applications menu and click on Create App Integration.

Open

• From the Create a New Application Integration dialog, select OIDC - OpenID Connect, and Web Application and click on the Next button.

Open

Configure the Integration (Configure the Sign-In redirect URL)

• After creating the new OpenID Connect integration, you need to configure it. The following are the parameters that you need to fill out:

  • App Integration Name: Snare Central

  • Grant Type: Client Credentials and Authorization Code

  • Sign-in redirect URIs: https://xx.xx.xx.xx/login.php/api/v1/sign-in-callback (Note: This should be fetched from Snare Central on Identity And Access Management Setup section)

    Open

    

  • Assignments – Controlled access: Everyone

• Once you fill out all the required parameters, click on the Save button to save the integration

Open

• Once the OIDC application for Snare Central is created, make sure to check and update (if not yet set) the following application settings as well:

  • Client authentication: Client secret

  • Login initiated by: Either Okta or App

  • Initiate login URI: http://localhost:8080

Retrieving the Okta Client Credentials

• After saving the integration, select your new integration and navigate to the General tab.

• Here, you can find your Client ID and Client Secret. Copy these credentials and save them to a secure location.

• Click on Require PKCE as additional verification.

Open

Configuring CORS settings for your OpenID Connect integration with Okta

• To configure CORS settings for your Okta integration, navigate to the Security -> API page in the Okta Admin dashboard and click on the Trusted Origins tab.

• From there, you can add your application's URLs to the whitelist.

• Add https://xx.xxx.xx.xx in the Origin URL and select Cross-Origin Resource Sharing and Redirect checkboxes and click Save.

Open

Create an API token

NOTE: API tokens have the same permissions as the user who creates them, and if the user permissions change, the API token permissions also change.

• See the section above on Privilege level, regarding the use of a service account when creating an API token, to specifically control the privilege level associated with the token.

• To create an API token, follow these steps:

  • In the Okta Admin dashboard, select Security > API from the menu and then select the Tokens tab.

  • Click Create Token.

  • Name your token and click Create Token.

  • Note: Make sure to record the token value after its creation, as this is the only opportunity to see it and record it.

Configure the default authorization server

1. Add default policy and default policy rule on the default authorization server.

• On Okta Admin dashboard, go to Security → API then click the default authorization server.

Open

• Click the Access Policies tab, then click Add Policy to add DefaultPolicy .

Open

• After creating DefaultPolicy, click the Add rule to add DefaultPolicyRule as well.

Open

Open

2. Add scope for Okta API access on the default authorization server.

• On the default authorization server, click the Scopes tab.

• Then click Add Scope and input the following on the dialog box then click Create.

  • Name: okta.myAccount.email.read

  • The rest of the fields are optional

  Open

  

Test the Integration

• To test the integration, navigate to the Assignments tab and assign users or groups to your OpenID Connect application.

• Once you assign users, they can log in to your application using their Okta credentials.

• Congratulations, you have successfully created a new OpenID Connect integration with Okta.

Create Okta Groups

1. In the Okta Admin dashboard, go to Directory → Groups.

2. Add the groups that will have access to Snare Central. The name of each group MUST start with the group prefix defined in the IAM section of the Configuration Wizard in the Snare Central server (default is Snare_central.).

3. Assign user(s) per each created group(s).

Configure app-level MFA

1. On Okta Admin dashboard, go to Applications then click the OIDC application created for Snare Central.

2. Click the Sign On tab, then go to User authentication section and click the View policy details.

3. You can create a rule or modify an existing one to configure MFA on the app. Click Add Rule to create a rule or click the edit rule pencil icon in the Actions column for the rule you want to modify. The App Sign On Rule dialog box appears.

4. Enter a name in the Rule Name field.

5. Optional. In the PEOPLE section, select the users and groups to whom this rule applies.

   • Users assigned this app: Select this option to assign this rule automatically to all users who are assigned to this app from the app's Assignments tab.

   • The following groups and users:

     • Groups: Enter the names of groups to whom you want to apply this rule.

     • Users: Enter the names of individual users to whom you want to apply this rule.

     • Exclude the following users and groups from this rule: Select this option to add groups and users that you want to exclude from this rule. The following options appear:

       • Excluded Groups: Enter the names of groups that you want to exclude from this rule.

       • Excluded Users: Enter the names of individuals that you want to exclude from this rule.

6. Optional. In the LOCATION section, select an option to require MFA to access to the app based on the user's network zone.

   • Anywhere: Require MFA to access the app from users who sign in from any network zone.

   • In Zone: Require MFA to access the app from users who sign in from network zones that you specify.

   • Not in Zone: Require MFA to access the app from users who sign in from outside of the network zones that you specify.

   • Network Zones:

     • All Zones: Select this option to apply the In Zone or Not in Zone option to users who sign in from all network zones.

     • Click in the field and enter the names of network zones to apply to the In Zone or Not in Zone option.

7. Optional. In the CLIENT section, select the platforms to which you want to apply this rule.

8. In the ACCESS section, select whether sign-on to the application is allowed or denied from the drop down. Select an action:

   • Prompt for re-authentication: Require users to re-authenticate when they try to access the app.

   • Prompt for factor: Require that users authenticate with a specific factor when they try to access the app.

   • Multi-factor Settings: If you haven't configured your factor types yet, you can click this link and configure them. Don't click this link if you've already configured your factor types.

9. Click Save.

https://help.okta.com/en-us/content/topics/security/policies/about-app-signon-policies.htm

https://help.okta.com/en-us/content/topics/security/policies/configure-app-signon-policies.htm

Add a new IAM Service Provider in the Configuration Wizard

1. Login as Administrator in the Snare Central server and go to the Administrative Tools → Configuration Wizard → Identity and Access Management Setup and click on the Add button.

   Open

   

2. Fill the form with the required values from Okta.

   • IAM Domain: This is your Okta Organization URL (https://dev-xxxxxxxxxx.okta.com).

     • Note: To find your Okta URL (also called an Okta domain).

       • Sign in to your Okta organization with your administrator account.

       • Look for the Okta domain in the global header located in the upper-right corner of the dashboard.

   • Client ID: see “Retrieve Your Client Credentials" section for more details.

   • Client Secret: see “Retrieve Your Client Credentials" section for more details.

   • API Token: see “Create an API token” section for more details.

3. Enable the Okta provider by selecting the Okta service provider and clicking the Enable button.

Retrieving the groups from Okta

• Note: Make sure that groups with the proper group prefix in their names are created and members are assigned on the Okta side.

• Go to Snare Central server, then go to the Administrative Tools → Configuration Wizard → Identity and Access Management Setup section.

• Select Okta service provider and click the Retrieve Groups button.

Granting access rights to Okta groups

Go to the Manage Access Control tool under the Administrative Tools menu and assign access to Snare pages and Reports as needed for the group retrieved from Okta.

Open

Login with Okta credentials

• Snare Central uses Oktas Redirect Authentication Model.

• A user sign-in flow that grants authentication control to Okta by redirecting the user browser to the Okta hosted sign-in page.

• This flow uses open protocols like OAuth 2.0 and SAML.

• The user is redirected to Okta for credential verification.

• The user is then provided authenticated access to Snare Central.

• When a user signs in, they're redirected to Okta using a protocol OpenID Connect.

• After the user signs in (based on policies configured in Okta), Okta redirects the user back to the Snare Central where group verification is carried out and if correct, the user will be granted access with its group authorization level.

Open

Open

Troubleshooting Guide

This guide will be your resource for resolving common issues and challenges that you may encounter during Okta IAM service provider configuration.

1. Unable to retrieve groups from Okta due to the invalid API token

Error sample and resolution

Error sample:

Open

Possible resolution:

• If you still have a copy of the API token value, just update the API token of the Okta provider; otherwise, generate a new API token by following the “Create an API token” section of this user guide.

• Once the API token is generated, edit the Okta provider and update its API token, then click Retrieve Groups again.

• Also, check if the current API token is expired; if so, generate a new API token, update the Okta provider with the new token, and click Retrieve Groups again.

2. Unable to retrieve groups from Okta due to error “No groups defined for SC usage …”

Error sample and resolution

Error sample:

Open

 

Possible resolutions:

• Option #1: On the Okta Admin dashboard, create the group(s) with the corresponding group prefix that was configured on the Snare Central side, for example, “Snare_CentralxxxGuest” or “Snare_CentralxxxAdmins”. Once the group(s) were created, try and click Retrieve Groups again.

• Option #2: Update the Default Group Prefix in Snare Central, then click Next, and create the groups with the corresponding group prefix if those groups do not exist yet. Once the group(s) are created, try and click Retrieve Groups again.

3. Unable to enable Okta SSO provider

Error sample and resolution

Error sample:

Open

 

Possible resolutions:

• Possible solution#1: Check if the Okta configuration parameters are correct:

  • Go to the Okta Admin dashboard, check and compare if the Okta domain and Cient ID are correct, and update if necessary.

  • Copy and update the application's Client Secret to ensure it is correct.

  • Ensure that the API token is correct and not expired; if the token was already expired, generate a new API token by following the “Create an API token” section of this user guide.

  • Also ensure that groups associated with the configured Default Group Prefix are properly created or ensure that Default Group Prefix is properly set.

 

• Possible solution#2: If the issue still persists despite having the correct Okta parameters, then you must check if OIDC application’s Client Credentials was properly set.

  • On Okta Admin dashboard, go to Applications, click the created OIDC application for Snare Central connection, then go to Grant type and check if Client Credentials is enabled or checked; if not, make sure to update the application and enable it.

    Open

    

  • After enabling the needed settings, go back to Snare Central, then try again to enable the Okta provider.

 

• Possible solution#3: If the issue persists despite applying the previous resolutions, then you must check if the default authorization server is properly configured

  • See the “Configure the default authorization server” section of this user guide for more details.

  • After configuring the default authorization server, go back to Snare Central, then try to enable the Okta provider again.

4. Bad request error after trying to login in using Okta account

Error sample and resolution

Error sample:

Open

Possible resolutions:

• Go to Okta Admin dashboard and check if the Sign-in redirect URIs is properly configured, see the “Configure the Integration (Configure the Sign-In redirect URL)” section of this user guide for more details.

• Once these settings adjustments are made, go back to Snare Central and try to log in again via Okta.

5. Unable to login to Okta due to Okta state error

Error sample and resolution

Error sample:

Open

Possible resolutions:

• Go to Okta Admin dashboard, then go to the OIDC application for Snare Central.

• Check if Login initiated by is set to Either Okta or App, also set Initiate login URI to http://localhost:8080 and update these settings if they are not yet set.

• Once these settings adjustments are made, go back to Snare Central and try to log in again via Okta.

6. Unable to login to Okta due user’s unauthorized access

Error sample and resolution

Error sample:

Open

 

Possible resolution:

• Go to Okta Admin dashboard, go to the groups that was dedicated for Snare Central’s IAM service authentication.

• Make sure the users were properly assigned to the Okta groups which will be used for Snare Central authentication.

• Once group members were assigned, wait for few minutes then try to login again.