Configure Okta Directory
Table of Contents
Expand all | Collapse all
-
- Cloud Identity Engine Attributes
- Collect Custom Attributes with the Cloud Identity Engine
- View Directory Data
- Cloud Identity Engine User Context
- Create a Cloud Dynamic User Group
- Configure Third-Party Device-ID
- Configure an IP Tag Cloud Connection
- Configure Dynamic Privilege Access in the Cloud Identity Engine
- Configure Security Risk for the Cloud Identity Engine
-
-
- Configure Azure as an IdP in the Cloud Identity Engine
- Configure Okta as an IdP in the Cloud Identity Engine
- Configure PingOne as an IdP in the Cloud Identity Engine
- Configure PingFederate as an IdP in the Cloud Identity Engine
- Configure Google as an IdP in the Cloud Identity Engine
- Configure a SAML 2.0-Compliant IdP in the Cloud Identity Engine
- Configure a Client Certificate
- Configure an OIDC Authentication Type
- Set Up an Authentication Profile
- Configure Cloud Identity Engine Authentication on the Firewall or Panorama
- Configure the Cloud Identity Engine as a Mapping Source on the Firewall or Panorama
- Configure Dynamic Privilege Access in the Cloud Identity Engine
-
- Get Help
Configure Okta Directory
The Cloud Identity Engine can integrate Okta Directory information. When you configure your
Okta Directory as part of the Cloud Identity Engine, the Cloud Identity Engine uses Okta
Directory to collect user and group attribute information for Security policy
enforcement and for visibility into the users who access your network.
You must create an OpenID Connect (OIDC) app to configure an Okta directory for
the Cloud Identity Engine, even if you’ve configured Okta for SAML. If you try
to use the SAML app to configure an Okta directory instead of creating a new
OIDC app, the initial sync might be successful, but any subsequent syncs fail
because the refresh token from gallery applications does not support this
configuration.
You can select one of two methods for the Cloud Identity Engine to use to
connect to your Okta Directory:
- The Auth Code Flow, which requires you to log in to make changes to the directory configuration in the Cloud Identity Engine
- The Client Credential Flow, which initially requires additional permissions but does not require you to log in to change the directory configuration in the Cloud Identity Engine
For an Okta directory, the Cloud Identity Engine retrieves updates from
the directory using the following schedule:
- Users, Groups, and Devices—When the Cloud Identity Engine syncs changes.
- Apps—Everyxhours (wherexis either a maximum of three hours or the duration necessary to complete the previous apps sync).
Deploy Auth Code Flow for Okta Directory
- If you have not already done so, activate the Cloud Identity Engine and obtain the Sign-in redirect URI for Okta.
- After activating the Cloud Identity Engine, log in to the hub and select the Cloud Identity Engine app.
- Copy the URL for your Cloud Identity Engine tenant and edit it to obtain the Sign-in redirect URI that Okta requires. To edit the URL, replace the text after the domain with/authorize. For example, if your Cloud Identity Engine tenant URL ishttps://directory-sync.us.paloaltonetworks.com/directory?instance=<InstanceId>, your Redirect URL ishttps://directory-sync.us.paloaltonetworks.com/authorize.
- Using the Okta Administrator Dashboard, prepare to add your Okta Directory in the Cloud Identity Engine.To set up an Okta Directory in the Cloud Identity Engine, you must create a user then assignAdmin Rolesto that user to grant privileges for the Okta Directory in the Okta Administrator Dashboard (). This is the account you’ll assign to the app in step 2.6. This is also the same account you'll use to log in for step 8 when using the Auth Code Flow for your Okta Directory.SecurityAdministratorsAdminsAdd Administrator
- Create an app integration for the Cloud Identity Engine app in Okta.
- SelectOIDC - OpenID Connectas theSign-in method.
- SelectWeb Applicationas theApplication typethen clickNext.
- Replace any existingSign-in redirect URIswith the edited URL from step 1.2.Palo Alto Networks recommends separating regions by aligning region-specific tenants with region-specific Okta accounts. However, for testing, if you have Cloud Identity Engine tenants in more than one region, add Sign-in redirect URIs for each region where you have a tenant.
- Skip the steps forSign-out redirect URIsandBase URIsas these aren't required.
- Assign the app to a user or group andSavethe configuration.Be sure to assign the app only to the administrator you created in the first step.
- Configure the Okta app integration.
- Editthe app you just created then selectRefresh Token.Using the refresh token is mandatory.
- SelectRotate token after every useand increase theGrace period for token rotationto60seconds.
- Saveyour changes.
- Assign the app and grant the required permissions for the Cloud Identity Engine to access your Okta directory information.
- SelectAssignments, then assign the Cloud Identity Engine app to the administrator who configures the Okta integration in the Cloud Identity Engine.
- SelectOkta API Scopesand grant consent to the following scopes:
- okta.authorizationServers.read(Required only if you have more than one Okta authorization server)
- okta.groups.read
- okta.logs.readThe Cloud Identity Engine requires this scope to read the following log events only:
- user.lifecycle.delete.initiated
- group.lifecycle.delete
- user.lifecycle.activate
- user.lifecycle.deactivate
- okta.users.read
- okta.users.read.self
If you want the Cloud Identity Engine to collect enterprise application data so that it is included when you View Directory Data, you must grant consent to theokta.apps.readscope before you select the option in step 9.
- In the Cloud Identity Engine app, select.DirectoriesAdd Directory
- Set UpaCloud Directoryand selectOkta.
- Select the method you want to use to log in to the Okta directory.
- Auth Code Flow—(Default) To make changes to your Okta directory in the Cloud Identity Engine, you must log in to the Okta directory.
- Client Credential Flow—By granting the required permissions in advance, you do not need to log in to the Okta directory to make changes to that directory in the Cloud Identity Engine. This option requires additional configuration; for more information, refer to Deploy Client Credential Flow for Okta.
- Select whether you want toCollect enterprise applicationsdata so that it displays when you View Directory Data.For beta users of this feature, the Cloud Identity Engine continues collecting enterprise application data for any directories configured in your tenant during the beta and no further configuration is required. If you configure a new directory, you must select whether you want to collect enterprise application data from the new directory and grant consent for the scope in step 5.2.
- Click toSign in with Oktaand enter your Okta Directory credentials.When the login is successful,Logged Indisplays. Palo Alto Networks recommends using the built-in authorization server. If you have more than one Okta authorization server, repeat the previous steps for each additional Okta Directory you want to add.
- ClickTest Connectionto verify your configuration.When the test is successful,Successdisplays.
- (Optional) Customize the name the Cloud Identity Engine displays for your Okta Directory.By default, the Cloud Identity Engine uses the default domain name.You can use up to 15 lowercase alphanumeric characters (including hyphens, periods, and underscores) for the directory name in the Cloud Identity Engine. You don't need to change the name of the directory itself, only the name of the directory in the Cloud Identity Engine app.
- Submitthe configuration.You can now use information from your Okta Directory in the Cloud Identity Engine when you configure a user- or group-based Security policy rule or with other Palo Alto Networks applications.For optimal performance, the Cloud Identity Engine does not support the default Okta group "Everyone" because Okta does not recommend using this group to define policy rules.