Introduction

This guide provides information on how to:

• Set up Beyond Identity as a passwordless authentication solution for your Okta environment.
• Set up Okta to use Beyond Identity as an Identity Provider.

 

Prerequisites

Ensure that you have the following:

1. An Okta account with “Super” or “Organization” admin privileges to:
   1. Add/edit attributes and their mappings in Directory > Profile Editor.
   2. Add/edit Identity Providers in Security > Identity Providers.
   3. Add/edit routing rules in Security > Identity Providers -> Routing Rules.
   4. Add/edit Event Hooks in Workflow > Event Hooks (Optional).
2. “OpenID Connect IdP” and “Routing Rules” are enabled for the account .
   1. Test that “OpenID Connect IdP” is enabled by verifying you have "Security > Identity provider > Add Identity Provider > Add OpenID Connect IdP" available. If you do not, then contact Okta to open a support ticket to enable “OpenID Connect IdP”. For a template of the ticket to create with Okta, see Appendix B.
   2. Ensure the “Routing Rules” tab is available on the Security->Identity Providers page. If the “Routing Rules” tab is missing, contact Okta to open a support ticket to enable “Routing Rules” on the Identity Provider page.

 

Beyond Identity Configuration

Information you will need:

 

Information you will receive from the Beyond Identity Field Team

 

NOTE! The endpoints are different for the US vs. EU.

For Beyond Identity’s EU services use auth-eu.byndid.com and api-eu.byndid.com.

 

Okta Configuration

To configure Beyond Identity as the IdP in Okta, follow the steps below. Once these steps are taken, you will be ready to enable Beyond Identity for test users.

Step 1: Navigate to the Profile Editor

The image below is an example of an administrator view in Okta and illustrates the actions listed below to navigate to the Profile Editor:

 

1. Sign into the Okta portal as an administrator.
2. In the main Okta menu, select “Directory”.
3. In the “Directory” drop-down menu, select “Profile Editor”.
4. Find your “Okta User (default)” or appropriate profile and click on hyperlink to Edit Profile. 
5. Under the user profile editor, you will see an action to “Add Attribute”. See image below:
   
   

 

6. Click on “Add Attribute”.
   • Select fields as shown in the following image:
     • Data Type: Boolean
     • Display Name: Beyond Identity Registration Status
     • Variable Name: byndidRegistered
     • Description: Beyond Identity Registration Status
     • User Permission: Read Only
     • Click Save. See image below for reference:
       
       

7. If you have multiple profile masters (applicable for AD mastered users), then perform the following steps.
   1. Click on edit button for “byndidRegistered” attribute in Okta profile.
   2. For the “Master Priority” field select “Inherit from Okta” from the pull-down menu.
   3. Click on Save Attribute. Please, see image below for reference:
      
      

Step 2: Add Beyond Identity User Group

1. Click on Directory-> Groups
2. Click on “Add Group”
3. Select fields as shown in the following image:
   1. Name: “Beyond Identity”
   2. Description: “Beyond Identity Users Group”
4. Click Save.
   
   

 

Step 3: Setup Beyond Identity User Portal Application in Okta

1. Click on Applications -> Applications -> Browse App Catalog
2. In Search window type “Beyond Identity User”
3. Select App with title “Beyond Identity User Portal”.
4. Click Add.
   
   
5. Now you will see a pop up with the following information.
   1. General Settings
   2. Application Label: “Beyond Identity User Portal”
   3. Click Done.
6. In the Assignment Tab, click on “Assign” and  from the drop down the select “Assign to Groups”. Click on the “Assign” button for the “Beyond Identity” group.
7. In the “Sign On” tab update the following fields.
   1. Click on “Edit” for settings.
   2. Update Org ID field with Organization Id provided by Beyond Identity team.
   3. Note down SSO “Client ID” and “Client Secret” field and use it in the next step.
   4. Click on “Save”. 
8. In the “Provisioning” tab update the following fields.
   1. Click on “Configure API Integration”. 
   2. Then click on “Enable API Integration”.
   3. In the API token field paste the API token provided by the Beyond Identity team. 
   4. Select “Import Groups” if it is not enabled by default.(This is only available in Okta Production instances and not in Developer or Preview instances.)
   5. Then click on “Test API Credentials”.
   6. After seeing the message “Beyond Identity User Portal was verified Successfully”. Save the configuration.
      
      

9. After setting up SCIM in the above step, make the following changes in the “Provisioning” Tab.
   1. In the “Provisioning to App” section, click on Edit.
   2. For the “Create Users”, “Update User Attributes” and “Deactivate Users” click on Enable.
   3. Save the changes by clicking on “Save”. 
      
      

 

10. Make following changes in the “Provisioning” Tab. (This is only applicable to Okta Production instances and not to Developer or Preview instances.
    1. In the “Integration” section, click on Edit.
    2. Select “Import Groups” if it is not enabled by default.
    3. Save the changes by clicking on “Save”. 
       
       

11. To sync groups with Beyond Identity:
    1. Click on the Push Groups tab.
    2. Click the Push Groups drop-down menu.
    3. To define which groups are synced with Beyond Identity:
       1. Select Find groups by name: Searches for specific groups to push.
          
          

 

Step 4: Setup User Portal Access in Beyond Identity

1. Once logged into Beyond Identity Admin UI, click on Settings -> Console Login-> User Console SSO Integrations and click on Add OIDC SSO.
2. Please configure the following fields for User Console SSO Integrations.
   1. Name: Okta OIDC SSO
   2. Client ID: <Use the value recorded in the previous step>
   3. Client Secret: Use the value recorded in the previous step>
   4. Issuer: https://<okta-tenant-id>.okta.com (Provided by the customer as Login URL) (Remember to not have a trailing slash after issuer URL)
   5. Token Field: sub
   6. Token Field Lookup: external id
   7. Scopes: Select all [Alternately select Profile , email] - Optional
      
      

 

3. Click on Save Changes.

Step 5: Setup Beyond Identity Admin Application in Okta

1. Click on Applications -> Applications -> Browse App Catalog.
2. In Search window type “Beyond Identity Admin”
3. Select App with title “Beyond Identity Admin Portal”.
4. Click Add.
   
   
5. In the “General Settings” update following fields
   1. Application Label: “Beyond Identity Admin Portal”
   2. Click Done.
6. In the Assignment Tab Assign “Admins” to this Application.
7. In the “Sign On” tab update the following fields.
   1. Click on “Edit” for settings.
   2. Update Org ID field with Organization Id provided by Beyond Identity team.
   3. Note down SSO “Client ID” and “Client Secret” fields. You will be using them in follow up steps.

Step 6: Setup Admin Portal Access in Beyond Identity

1. Login to Beyond Identity Admin Console and click on Settings.
2. Once logged into Beyond Identity Admin UI, click on Settings -> Console Login-> Admin Console SSO Integrations and click on Add OIDC SSO.
3. Please configure the following fields for Admin Console SSO Integrations.
4. 1. Name: Admin Console SSO - Okta
   2. Client ID: <Use the value recorded in the previous step>
   3. Client Secret: <Use the value recorded in the previous step>
   4. Issuer: https://<okta-tenant-id>.okta.com (Provided by the customer as Login URL) (Remember to not have a trailing slash after issuer URL)
   5. Token Field: sub
   6. Token Field Lookup: external id
   7. Scopes: Select all [Alternately select Profile , email] - Optional

 

4. A user should also be assigned an Admin role for the admin to be able to access the Beyond Identity Admin console

7. 1. To assign a role to a user, Navigate to Settings -> Console Access Control -> Click on a predefined admin role (In this case we are selecting “Super Administrators”) 
   2. Once the role has been selected, Click on “Assign Access role to users” and type in the name of the user that requires admin access.
   3. Select Assign users to role to promote the user to Admin
   4. Alternatively you could assign user groups to Admin roles.
   5. To assign a role to a user group, Navigate to Settings -> Console Access Control -> Click on one of the predefined admin role 
   6. Once the role has been selected, Click on the “Groups” tab.
      
   7. Click on “Assign Access role to Groups” and type in the name of the Group or select the Group from the dropdown that requires admin access.
   8. Once selected, Click on “Assign groups to role” to save the changes.

5. After these values are provisioned, the customer should login and confirm that admin has access to Beyond Identity Console through Okta SSO.

Step 7: Setup Federated SSO for User Authentication:

1. Once logged into Beyond Identity Admin UI, click on the “Integrations” tab and then click on OIDC Clients.
2. Click on “Add OIDC Client” and fill in Name, Redirect URI field and leave the default value for Token Signing Algorithm and Auth Method as shown below.
   1. Name: Okta SSO
   2. Redirect URIs: https://<okta-tenant-name>.okta.com/oauth2/v1/authorize/callback
   3. Token Signing Algorithm: RS256
   4. Auth Method: Client_secret_post
      
      

 

3. Click on the newly created OIDC Client configuration and write down Client ID and Client Secret Value. You will be using these values in the next step.
   
   

 

4. On the “Integrations” tab, click on “Okta” and then click on Install for “Okta Registration Attribute”.
   
   
   
5. Fill information for Okta Domain, Okta API Token for your tenant. Also, update “Okta Registration Attribute” with default value of “byndidRegistered” or the value chosen by your organization in Step 1. Click on “Save Changes”.
   
   

 

 

Step 8: Configure Beyond Identity as the Identity Provider

1. In the main Okta menu, select “Security”.
2. In the “Security” drop-down, select “Identity Providers”.
3. In the “Identity Providers” tab, click “Add Identity Provider”. 
4. From the next screen, select ‘OpenID Connect Identity Provider’ and select ‘Next’
   
   
5. Select fields as seen in reference images below:
   1. Name: Beyond Identity
   2. IdP Usage: SSO only
   3. Client id: (Paste Client id copied from Beyond Identity Admin Console in previous step.)
   4. Client Secret: (Paste Client id copied from Beyond Identity Admin Console in previous step.)
   5. Scopes: openid (Remove any additional scopes.)
   6. Issuer: https://auth.byndid.com/v2
   7. Authorization endpoint: https://auth.byndid.com/v2/authorize
   8. Token endpoint: https://auth.byndid.com/v2/token
   9. JWKS endpoint: https://auth.byndid.com/v2/.well-known/jwks.json
   10. Userinfo endpoint: https://auth.byndid.com/v2/userinfo
   11. NOTE! The endpoints are different for the US vs. EU.
       For Beyond Identity’s EU services use auth-eu.byndid.com and api-eu.byndid.com.
   12. Under Authentication Settings. 
   13. Set IdP Username field as “idpuser.externalId”.
   14. Set Match Against field as “Okta Username”.
   15. Account Link Policy: Automatic
   16. Auto-Link Restrictions: None
   17. Set “If no match is found” field to “Redirect to Okta Sign-in Page”. 
   18. Select “Finish” to save changes.
   19. See images below for reference:
       
       
       
       

 

Step 9: Configure OIDC client for Step-Up authentication (Required only for Step-up Authentication)

1. Repeat all of the actions from Step 8 to create an OIDC provider for Step-Up authentication WITH THE EXCEPTION of specifying a different name and selecting IdP Usage: Factor only

 

Step 10: Set up Routing Rules

1. Click on Security-> Identity Providers
2. Select “Routing Rules”
   1. Click on “Add Routing Rule” and set the following parameters.
   2. Rule Name: Beyond Identity Auth
   3. Default value for User IPs, Device Platform, Applications
   4. Set User Matches to “User Attribute” and “byndidRegistered Equals true”
      1. Note: These values are case sensitive. Ex. “True” will not work but “true” will.
   5. Set “Then Use the Identity Provider” as “Beyond Identity”.
   6. Click “Save and Activate Rule”. 
      1. This Rule will be set as a first rule.
   7. See images below for reference:
      
      
   8. Ensure your newly created Routing Rule has the highest precedence
      
      

 

Setting up test users

User Enrollment

1. To enroll a user in the Beyond Identity experience, assign the user to the “Beyond Identity” Group.
   1. Click on Directory -> Groups
   2. Select the “Beyond Identity” group.
   3. Click on “Manage People”.
   4. Click on the “+” sign next to the user's name in the column titled “Not Members”.
   5. Click Save.
      
      

 

2. Enrolled users will receive an email from Beyond Identity welcoming them to the new Identity Provider. See image below for reference:
   
   
3. Each enrolled user will be asked to follow the two steps below:
   1. Step 1: Download the Beyond Identity Authenticator to their device.
      1. When the user clicks “View Download Options”, the Beyond Identity Authenticator downloads page will open in a browser with all supported platforms displayed. The user should download and install the Beyond Identity Authenticator on their device if they have not already.
      2. Now that the user has the Authenticator installed on their device, they should proceed to Step 2 as there is not yet a user credential associated with the Authenticator on that device.
   2. Step 2: Register their Credential in the Beyond Identity IdP.
      1. By clicking on Step 2 “Register New Credential”, the user’s credential will get enrolled in the Beyond Identity service on the back end. On the front end, users who click Step 2 will be taken to the Beyond Identity Authenticator where they will see the progress of their credential registration. Once completed, the user will see the credentials in the Authenticator. 
      2. See example image below:
         
         

 

User Authentication (Signing in)

1. Each enrolled user can visit their Okta instance or any application supported by your SSO to sign into their corporate applications. 
2. The Okta application or SSO-supported application will ask the user to enter their username. 
3. Once the username is submitted, a prompt to use or open the Beyond Identity app for authentication will display for the user.
4. The user should click affirmatively on the prompt to be signed into their application, without the use of a password. The Beyond Identity app along with a success notification will display.
   1. Note: For iOS devices, some application sign-in processes will ask the user to exit out of the Beyond Identity Authenticator to return to their app after successful authentication.

 

User Deprovisioning

1. To deprovision a user from the Beyond Identity experience, remove the user from the “Beyond Identity” Group.
   1. Click on Directory -> Groups
   2. Select the “Beyond Identity” group.
   3. Click on “Manage People”.
   4. Click on the “-” sign next to the user's name in the column titled “Members”.
   5. Click Save.

 

Appendices

 

Appendix A: Creating a token in Okta

The image below is an example of an administrator view in Okta and illustrates the actions listed below:

1. Sign into the Okta portal as an administrator.
2. Once signed in, select “Classic UI” from the drop-down menu on the left side of the top-most bar.
3. In the main menu bar for Okta, select “Security”.
4. In the “Security” drop-down menu, select “API”.
5. In the “API” section, select the “Tokens” tab. 
6. Click “Create Token”.
7. In the “Create Token” form, provide your name for the token (e.g. Beyond Identity).

 

Appendix B: Opening a ticket to enable OpenID Connect IDP connections in Okta

The image below is an example of how to open a case with Okta requesting them to enable OpenID IDP Connections in Okta Sandbox and Production environments. 

 

1. Navigate to Okta’s Open Case Center at https://support.okta.com/help/s/opencase.
2. Create a case with the following information: 
   1. Request Type: Okta org request
   2. Subject: Enable OIDC Provider Type
   3. Detailed Description: (see example description below)
      1. Please enable the "ODIC IdP" type on my Okta organization. 
         My Organization Id is: <ORG_ID>
         This would normally show up under:
         "Security > Identity provider > Add Identity Provider > Add OpenID Connect IdP"
   4. Steps to reproduce: (see example below)
      1. This would normally show up under:
         "Security > Identity provider > Add Identity Provider > Add OpenID Connect IdP"
   5. Scope: Whole organization affected
   6. Business impact: (see example below)
      1. Unable to enable integration
   7. Priority: P3 - Non critical issue
   8. Okta org: Select from the list the organizations where Beyond Identity will be integrated. 
   9. Case email: Your own email
   10. Phone number: Your phone number
   11. Add contact to team: <Can be left empty>
   12. Add attachment: <Not required>