Introduction

This section provides information on how to:

• Set up Beyond Identity as a passwordless authentication solution for your Okta environment.
• Set up Okta to use Beyond Identity as an Identity Provider.

 

Before you begin

This section enumerates some items you should be aware of before configuring Okta as an SSO provider with Beyond Identity.

• As soon as you configure routing rules in Okta (with or without Beyond Identity as IdP) user login experience will change. Users will be asked for a login ID/Username first and then based on routing rules, users will be prompted for a Password or go through additional IdP options like Beyond Identity.
• Okta recommends this as the best practice to avoid password spraying attacks. It is possible that your tenant is already set up to ask for Username first and then ask for Password today and your users are experienced with this behavior. If your tenant is not set up, then please inform your users of change in login experience before proceeding.

 

Prerequisites

Ensure that you have the following:

1. An Okta account with “Super” or “Organization” admin privileges to:
   1. Add/edit attributes and their mappings in Directory > Profile Editor.
   2. Add/edit Identity Providers in Security > Identity Providers.
   3. Add/edit routing rules in Security > Identity Providers -> Routing Rules.
   4. Add/edit Event Hooks in Workflow > Event Hooks (Optional).
2. “OpenID Connect IdP” enabled for the account
   1. Contact Okta to open a support ticket to enable “OpenID Connect IdP”.  For a template of the ticket to create with Okta, see Appendix B.
   2. Ensure the “Routing Rules” tab is available on the Security->Identity Providers page. If the “Routing Rules” tab is missing, contact Okta to open a support ticket to enable “Routing Rules” on the Identity Provider page.

 

Beyond Identity Configuration

Information you will need:

 

Information you will receive from the Beyond Identity Field Team

 

 

NOTE! The endpoints are different for the US vs. EU.

For Beyond Identity’s EU services use auth-eu.byndid.com and api-eu.byndid.com.

okta Configuration

To configure Beyond Identity as the IdP in Okta, follow the steps below. Once these steps are taken, you will be ready to enable Beyond Identity for test users.

Step 1: Create Custom Attribute for Beyond Identity

The image below is an example of an administrator view in Okta and illustrates the actions listed below to navigate to the Profile Editor:

 

 

1. Sign into the Okta portal as an administrator.
2. Once signed in, select “Classic UI” from the drop-down menu on the left side of the top-most bar.
3. In the main Okta menu, select “Directory”.
4. In the “Directory” drop-down menu, select “Profile Editor”.
5. Find your “Okta” profile and select the “Edit Profile” action denoted.
6. Under the user profile editor, you will see an action to “Add Attribute”
7. Click on “Add Attribute”.

1. Select fields as shown in the following image:
   1. Data Type: Boolean
   2. Display Name: Beyond Identity Registration Status
   3. Variable Name: byndidRegistered
   4. Description: Beyond Identity Registration Status
   5. Click Save. See image below for reference:
      
      

8. If you have multiple profile masters (applicable for AD mastered users), then perform the following steps.
   1. Click on edit button for “byndidRegistered” attribute in Okta profile.
   2. For the “Master Priority” field select “Inherit from Okta” from the pull-down menu.
   3. Click on Save Attribute. Please, see image below for reference:

Step 2: Add Beyond Identity User Group

1. Click on Directory-> Groups
2. Click on “Add Group”
3. Select fields as shown in the following image:
   1. Name: “Beyond Identity”
   2. Description: “Beyond Identity Users Group”
4. Click “Add Group”.

 

Step 3: Setup Beyond Identity User Portal Application in Okta

1. Click on Applications -> Add Application
2. In Search window type “Beyond Identity User”
3. Select App with title “Beyond Identity User Portal”.
4. Click Add.
   
   

 

5. Now you will see a pop up with the following information.
   1. General Settings
   2. Application Label: “Beyond Identity User Portal”
   3. Click Done.
6. In the Assignment Tab, click on “Assign” and  from the drop down the select “Assign to Groups”. Click on the “Assign” button for the “Beyond Identity” group.
7. In the “Sign On” tab update the following fields.
   1. Click on “Edit” for settings.
   2. Update Org ID field with Organization Id provided by Beyond Identity team.
   3. Note down SSO “Client ID” and “Client Secret” field and use it in the next step.
8. In the “Provisioning” tab update the following fields.
   1. Click on “Configure API Integration”. 
   2. Then click on “Enable API Integration”.
   3. In the API token field paste the API token provided by the Beyond Identity team. 
   4. Select “Import Groups” if it is not enabled by default.(This is only available in Okta Production instances and not in Developer or Preview instances.)
   5. Then click on “Test API Credentials”.
   6. After seeing the message “Beyond Identity User Portal was verified Successfully”. Save the configuration.
      
      

9. After setting up SCIM in the above step, make the following changes in the “Provisioning” Tab.
   1. In the “Provisioning to App” section, click on Edit.
   2. For the “Create Users”, “Update User Attributes” and “Deactivate Users” click on Enable.
   3. Save the changes by clicking on “Save”. 
      
      

 

10. Make following changes in the “Provisioning” Tab. (This is only applicable to Okta Production instances and not to Developer or Preview instances.
    1. In the “Integration” section, click on Edit.
    2. Select “Import Groups” if it is not enabled by default.
    3. Save the changes by clicking on “Save”. 
       
       

11. To sync groups with Beyond Identity:
    1. Click on the Push Groups tab.
    2. Click the Push Groups drop-down menu.
    3. To define which groups are synced with Beyond Identity:
       1. Select Find groups by name: Searches for specific groups to push.
          
          

Step 4: Setup User Portal Access in Beyond Identity

1. Once logged into Beyond Identity Admin UI, click on Settings -> Console Login-> User Console SSO Integrations and click on Add OIDC SSO.
2. Please configure the following fields for User Console SSO Integrations.
   1. Name: Okta OIDC SSO
   2. Client ID: <Use the value recorded in the previous step>
   3. Client Secret: Use the value recorded in the previous step>
   4. Issuer: https://<okta-tenant-id>.okta.com (Provided by the customer as Login URL) (Remember to not have a trailing slash after issuer URL)
   5. Token Field: sub
   6. Token Field Lookup: external id
   7. Scopes: Select all [Alternately select Profile , email] - Optional
      
      

3. Click on Save Changes.

Step 5: Setup Beyond Identity Admin Application in Okta

1. Click on Applications -> Add Application
2. In Search window type “Beyond Identity Admin”
3. Select App with title “Beyond Identity Admin Portal”.
4. Click Add.
   
5. In the “General Settings” update following fields
   1. Application Label: “Beyond Identity Admin Portal”
   2. Click Done.
6. In the Assignment Tab Assign “Admins” to this Application.
7. In the “Sign On” tab update the following fields.
   1. Click on “Edit” for settings.
   2. Update Org ID field with Organization Id provided by Beyond Identity team.
   3. Note down SSO “Client ID” and “Client Secret” fields. You will be using them in follow up steps.

Step 6: Setup Admin Portal Access in Beyond Identity

1. Login to Beyond Identity Admin Console and click on Settings.
2. Once logged into Beyond Identity Admin UI, click on Settings -> Console Login-> Admin Console SSO Integrations and click on Add OIDC SSO.
3. Please configure the following fields for Admin Console SSO Integrations.

 

1. Name: Admin Console SSO - Okta
2. Client ID: <Use the value recorded in the previous step>
3. Client Secret: <Use the value recorded in the previous step>
4. Issuer: https://<okta-tenant-id>.okta.com (Provided by the customer as Login URL) (Remember to not have a trailing slash after issuer URL)
5. Token Field: sub
6. Token Field Lookup: external id
7. Scopes: Select all [Alternately select Profile , email] - Optional

 

4. An user should also be assigned an Admin role for the admin to be able to access the Beyond Identity Admin console

1. To assign an role to a user, Navigate to Settings -> Console Access Control -> Click on a predefined admin role (In this case we are selecting “Super Administrators”) 
2. Once the role has been selected, Click on “Assign Access role to users” and type in the name of the user that requires admin access.
3. Select Assign users to role to promote the user to Admin
4. Alternatively you could assign user groups to Admin roles.
5. To assign a role to a user group, Navigate to Settings -> Console Access Control -> Click on one of the predefined admin role 
6. Once the role has been selected, Click on the “Groups” tab
   
   

 

7. Click on “Assign Access role to Groups” and type in the name of the Group or select the Group from the dropdown that requires admin access.
8. Once selected, Click on “Assign groups to role” to save the changes.
9. After these values are provisioned, the customer should login and confirm that admin has access to Beyond Identity Console through Okta SSO.

 

Step 7: Setup IDP in Beyond Identity:

5. Once logged into Beyond Identity Admin UI, click on the “Integrations” tab and then click on OIDC Clients.
6. Click on “Add OIDC Client” and fill in Name, Redirect URI field and leave the default value for Token Signing Algorithm and Auth Method as shown below.
   1. Name: Okta SSO
   2. Redirect URIs: https://<okta-tenant-name>.okta.com/oauth2/v1/authorize/callback (Also add any additional URIs separate by common if customer has custom login page)
   3. Token Signing Algorithm: RS256
   4. Auth Method: Client_secret_post
      
      
7. Click on the newly created OIDC Client configuration and write down Client ID and Client Secret Value. You will be using these values in the next step.
   
   
8. On “Integrations” tab and click on “API Extensions” and then click on Install for “Okta Registration Attribute”.
   
   
9. Fill information for Okta Domain, Okta API Token for your tenant. Also, update “Okta Registration Attribute” with default value of “byndidRegistered” or the value chosen by your organization in Step 1. Click on “Save Changes”.
   
   

 

Step 8: Configure Beyond Identity as the IdP in OKTA

The image below is an example of an administrator view in Okta and illustrates the actions listed below to navigate to the Identity Providers section:

 

1. In the main Okta menu, select “Security”.
2. In the “Security” drop-down, select “Identity Providers”.
3. In the “Identity Providers” tab, click “Add Identity Provider”. 
4. Select “Add OpenID Connect IdP”. 
   1. Note: This option will not be available in Okta until the ticket mentioned in the Introduction, Prerequisites section is resolved.
5. Select fields as seen in reference images below:
   1. Name: Beyond Identity
   2. Client id: (Paste Client id copied from Beyond Identity Admin Console in previous step.)
   3. Client Secret: (Paste Client id copied from Beyond Identity Admin Console in previous step.)
   4. Scopes: openid (Remove any additional scopes.)
   5. Issuer: https://auth.byndid.com/v2
   6. Authorization endpoint: https://auth.byndid.com/v2/authorize
   7. Token endpoint: https://auth.byndid.com/v2/token
   8. JWKS endpoint: https://auth.byndid.com/v2/.well-known/jwks.json
   9. NOTE! The endpoints are different for the US vs. EU.
      For Beyond Identity’s EU services use auth-eu.byndid.com and api-eu.byndid.com.
   10. Click on “Show Advanced Settings”.
   11. Set IdP Username field as “idpuser.externalId”.
   12. Set Match Against field as “Okta Username”.
   13. Leave Account Link Policy and Auto-Link restrictions with default options.
   14. Set “If no match is found” field to “Redirect to Okta Sign-in Page”.
   15. See images below for reference:
       
       

Step 9: Set up Event Hooks in Okta (Optional)

The Event Hooks configuration is only required if you do not have SCIM capability enabled for your Okta tenant due to licensing restrictions.

1. In Okta Admin Portal, Click on Workflow ->Event Hooks
2. Select “Create Event Hook”
3. Update fields as seen in reference images below:
   1. Name: Beyond Identity Provisioning flow
   2. URL: https://api.byndid.com/okta_events
   3. NOTE! The endpoints are different for the US vs. EU.
      For Beyond Identity’s EU services use auth-eu.byndid.com and api-eu.byndid.com.
   4. Authentication field: Authorization
   5. Authentication Secret: Enter “Bearer ” and then cut and paste Bearer token provided by the Beyond Identity team (Token must be prefixed with “Bearer ”)
   6. Subscribe to events: “User Added to Group”, “User Removed from Group”, “User suspended” and “User unsuspended”.
   7. Click “Save & Continue”.
   8. You will see a new form titled “Verify Endpoint Ownership”. Click on “Verify”.
      
      
      

 

 

Step 10: Set up Event Hooks in Beyond Identity (Optional)

The Event Hooks configuration is only required if you do not have SCIM capability enabled for your Okta tenant due to licensing restrictions. Following changes are required in Beyond Identity Admin UI to enable Okta Event Hooks.

1. Click on Integrations -> API Extensions
2. Fill information for Okta Domain, Okta API Token for your tenant. Also, update “Okta Group Name” with the default value of “Beyond Identity” or the value chosen by your organization in Step 2. Click on “Save Changes” as shown in the following Fig.

 

Step 11: Set up Routing Rules

1. Click on Security->Identity Providers
2. Select “Routing Rules”

1. Click on “Add Routing Rule” and set the following parameters.
2. Rule Name: Beyond Identity Auth
3. Default value for User IPs, Device Platform, Applications
4. Set User Matches to “User Attribute” and “byndidRegistered Equals true”
   1. Note: These values are case sensitive. Ex. “True” will not work but “true” will.
5. Set “Then Use the Identity Provider” as “Beyond Identity”.
6. Click “Save and Activate Rule”. 
   1. This Rule will be set as a first rule.
7. See images below for reference:
   

 

 

Setting up test users

 

User Enrollment

1. To enroll a user in the Beyond Identity experience, assign the user to the “Beyond Identity” Group.
   1. Click on Directory -> Groups
   2. Select the “Beyond Identity” group.
   3. Click on “Manage People”.
   4. Click on the “+” sign next to the user's name in the column titled “Not Members”.
   5. Click Save.
      

2. Enrolled users will receive an email from Beyond Identity welcoming them to the new Identity Provider.
   1. See image below for reference:

 

3. Each enrolled user will be asked to follow the two steps below:
   1. Step 1: Download the Beyond Identity Authenticator to their device.
      1. When the user clicks “View Download Options”, the Beyond Identity Authenticator downloads page will open in a browser with all supported platforms displayed. The user should download and install the Beyond Identity Authenticator on their device if they have not already.
      2. Now that the user has the Authenticator installed on their device, they should proceed to Step 2 as there is not yet a user credential associated with the Authenticator on that device.
   2. Step 2: Register their Credential in the Beyond Identity IdP.
      1. By clicking on Step 2 “Register New Credential”, the user’s credential will get enrolled in the Beyond Identity service on the back end. On the front end, users who click Step 2 will be taken to the Beyond Identity Authenticator where they will see the progress of their credential registration. Once completed, the user will see the credentials in the Authenticator. 
      2. See example image below:

 

 

User Authentication (Signing in)

1. Each enrolled user can visit their Okta instance or any application supported by your SSO to sign into their corporate applications. 
2. The Okta application or SSO-supported application will ask the user to enter their username. 
3. Once the username is submitted, a prompt to use or open the Beyond Identity app for authentication will display for the user.
4. The user should click affirmatively on the prompt to be signed into their application, without the use of a password. The Beyond Identity app along with a success notification will display.
   1. Note: For iOS devices, some application sign-in processes will ask the user to exit out of the Beyond Identity Authenticator to return to their app after successful authentication.

 

User Deprovisioning

1. To deprovision a user from the Beyond Identity experience, remove the user from the “Beyond Identity” Group.
   1. Click on Directory -> Groups
   2. Select the “Beyond Identity” group.
   3. Click on “Manage People”.
   4. Click on the “-” sign next to the user's name in the column titled “Members”.
   5. Click Save.

 

Appendices

 

Appendix A: Creating a token in Okta

The image below is an example of an administrator view in Okta and illustrates the actions listed below:

 

1. Sign into the Okta portal as an administrator.
2. Once signed in, select “Classic UI” from the drop-down menu on the left side of the top-most bar.
3. In the main menu bar for Okta, select “Security”.
4. In the “Security” drop-down menu, select “API”.
5. In the “API” section, select the “Tokens” tab. 
6. Click “Create Token”.
7. In the “Create Token” form, provide your name for the token (e.g. Beyond Identity).

 

Appendix B: Opening a ticket to enable OpenID Connect IDP connections in Okta

The image below is an example of how to open a case with Okta requesting them to enable OpenID IDP Connections in Okta Sandbox and Production environments. 

 

 

1. Navigate to Okta’s Open Case Center at https://support.okta.com/help/s/opencase.
2. Create a case with the following information: 
   1. Request Type: Okta org request
   2. Subject: Enable OIDC Provider Type
   3. Detailed Description: (see example description below)
      1. Please enable the "ODIC IdP" type on my Okta organization. 
         My Organization Id is: <ORG_ID>
         This would normally show up under:
         "Security > Identity provider > Add Identity Provider > Add OpenID Connect IdP"
   4. Steps to reproduce: (see example below)
      1. This would normally show up under:
         "Security > Identity provider > Add Identity Provider > Add OpenID Connect IdP"
   5. Scope: Whole organization affected
   6. Business impact: (see example below)
      1. Unable to enable integration
   7. Priority: P3 - Non critical issue
   8. Okta org: Select from the list the organizations where Beyond Identity will be integrated. 
   9. Case email: Your own email
   10. Phone number: Your phone number
   11. Add contact to team: <Can be left empty>
   12. Add attachment: <Not required>

 

 

Appendix C: Opening a ticket to enable Attribute Level Sourcing Feature in Okta

The image below is an example of how to open a case with Okta requesting them to enable “Attribute Level Sourcing/Mastering” and “Profile Mastering and Push” features in Okta Sandbox and Production environments. This feature needs to be enabled if Okta is integrated with AD.

 

 

1. Navigate to Okta’s Open Case Center at https://support.okta.com/help/s/opencase.
2. Create a case with the following information:

a. Request Type: Okta org request

b. Priority: P3 – Non-critical issue

c. Select the Okta org: Select from the list the organizations where Beyond Identity will be integrated.

d. Subject: Enable "Attribute Level Mastering” & “Allow both profile mastering and push" features

e. Detailed Description: (see example description below)

• Please enable the following features for my org.

- Attribute Level Mastering

- Allow both profile mastering and push

f. Scope: Whole organization affected

g. Case email: Your own email

h. Phone number: Your phone number

i. Add contact to team: <Can be left empty>

j. Add attachment: <Not required> 

k. Click on “Open Case”.