Configure Okta as an IdP in the Cloud Identity Engine

1. Select the method you want to use to integrate the Okta authentication in the Cloud Identity Engine and complete the steps in the Okta management console.

   • (Recommended)Integrate Okta as a Gallery Application
   • Integrate Okta as a Custom Application
2. Set up the Okta authentication in the Cloud Identity Engine.

   1. If you have not already done so, activate the Cloud Identity Engine app.
   2. In the Cloud Identity Engine app, select AuthenticationAuthentication Type.
3. Add Okta as an authentication type in the Cloud Identity Engine app.

   1. Set Up a SAML 2.0 authentication type.

   2. Select the Metadata Type.

      • To use the gallery app, the custom app, or SCIM, select Single service provider metadata.
      • To Configure Dynamic Privilege Access in the Cloud Identity Engine, select Dynamic service provider metadata.

   3. Copy the Entity ID and store it in a secure location.
   4. Copy the Assertion Consumer Service URL and store it in a secure location.
   5. Click Download SP Certificate and store it in a secure location.
   6. Click Download SP Metadata and store it in a secure location.
4. Configure the Okta IDP profile.

   1. Enter a unique and descriptive Profile Name.

   2. Select Okta as the Identity Provider Vendor.
5. Select the method you want to use to Add Metadata.

   • If you want to enter the information manually, copy the client ID and domain, download the SP metadata certificate, then enter the information in the Cloud Identity Engine IdP profile.
     1. In the Okta Admin Console, select ApplicationsAPI Service Integrations and select the Palo Alto Networks Cloud Identity Engine integration.
     2. Copy the necessary information from the Okta Admin Console and enter it in the IdP profile on the Cloud Identity Engine app as indicated in the following table:

        Copy or Download from Okta Admin Console	Enter in Cloud Identity Engine
        Copy the Client ID.	Enter it as the Identity Provider ID.
        N/A	Click to Upload the SP metadata certificate you downloaded in step 3.e.
        Copy the Okta Domain.	Enter the URL as the Identity Provider SSO URL.

     3. Select the HTTP Binding for SSO Request to IdP method you want to use for the SAML binding that allows the firewall and IdP to exchange request and response messages:
        • HTTP Redirect—Transmit SAML messages through URL parameters.
        • HTTP Post—Transmit SAML messages using base64-encoded HTML.
   • If you want to upload a metadata file, download the metadata file from your IdP management system.
     1. In the Okta Admin Console, click View Setup Info and copy the IDP metadata and save it to a secure location.
     2. In the Cloud Identity Engine app, click Browse Files to select the metadata file then Open the metadata file.

   • If you want to use a URL to retrieve the metadata, copy the IDP metadata from step 4.2. Paste it in the profile and click Get URL to obtain the metadata.

     #id4126bb2e-0974-45b8-81da-c13f5db29908_li_l5n_bz5_3xb

   • If you don't want to enter the configuration information now, you can Do it later. This option allows you to submit the profile without including configuration information. However, you must edit the profile to include the configuration information to use the authentication type in an authentication profile.

6. Specify the Maximum Clock Skew (seconds), which is the allowed difference in seconds between the system times of the IdP and the firewall at the moment when the firewall validates IdP messages (default is 60; range is 1–900). If the difference exceeds this value, authentication fails.
7. To require users to log in using their credentials to reconnect to GlobalProtect, enable Force Authentication.

8. Test SAML setup to verify the profile configuration.

   The Test SAML setup option is not available until the Cloud Identity Engine validates the identity provider profile data.

   This step is necessary to confirm that your firewall and IdP can communicate.
9. Select the SAML attributes you want the firewall to use for authentication and Submit the IdP profile.

   You must select the username attribute in the Okta Admin Console for the attribute to display in the Cloud Identity Engine.

   1. In the Okta Admin Console, Edit the User Attributes & Claims.
   2. In the Cloud Identity Engine app, select the Username Attribute and optionally, the Usergroup Attribute, Access Domain, User Domain, and Admin Role.
      If you're using the Cloud Identity Engine for SAML authentication with GlobalProtect Clientless VPN, you must configure the User Domain attribute to the same value as the userdomain field in the Okta Admin Console (ApplicationsApplicationsSAML 2.0General).