Introduction

This guide provides information on how to:

• Set up Beyond Identity as an MFA factor for your Okta environment with Okta Identity Engine.

Prerequisites

Ensure that you have the following:

1. A working Beyond Identity Okta integration, where Beyond Identity passwordless authentication is already used as the first factor. (Refer to the Beyond Identity Integration Guide for Okta to complete that configuration before proceeding with this guide.)
2. Okta URL details and Admin privileges for the corresponding Okta org and the Beyond Identity org.
3. Okta “IdP Authenticator” MFA Feature is enabled.This is found under Security > Authenticators >Setup > Add Authenticator > IdP
   1. This is an Early Access Feature. To enable it, contact Okta Support.
   2. There is another similar sounding feature named “Custom OIDC Factor” which is currently in Beta. We don’t need that. We need the “IdP Authenticator”.

IdP Authenticator configuration

There are four primary steps to set up Beyond Identity as an MFA: 

1. Set up Beyond Identity Console for MFA Authentication 
2. Add Beyond Identity as the Identity Provider for use as MFA
3. Setup Beyond Identity as an Authenticator
4. Add a Multifactor Policy
5. Add an Authentication Policy

Step 1: Setup Beyond Identity Console for MFA Authentication:

1. Once logged into Beyond Identity Admin UI, click on “Integrations” tab and then click on OIDC Clients.
2. Click on “Add OIDC Client” and fill in the Name, Redirect URI field and leave the default value for Token Signing Algorithm and Auth Method as shown below.

Name: Okta Critical Apps Second Factor

Redirect URIs: https://<okta_org>.okta.com/oauth2/v1/authorize/callback

3. Click on the newly created OIDC Client configuration and write down Client ID and Client Secret Value. You will be using these values in the next step.
   
   

Step 2: Create new user group to be used for MFA 

1. In the Okta dashboard, navigate to Directory -> Groups -> Add Group
   1. Name the group: Beyond Identity MFA
2. Next, in the Groups tab select the user group created during Okta integration (group name should be something like Beyond Identity Users Group) and copy the group ID that appears in the URL (see screenshot below). Use it in step 3b. below.
   
3. Navigate to Directory -> Groups -> Rules -> +Add Rule
   1. Rule Name: Beyond Identity MFA
   2. IF: User Okta Expression Language 

Language expression: isMemberOfAnyGroup("<Okta unique identifier>") and user.byndidRegistered == “true”

Ensure you are using the Okta unique identifier saved from the previous step

3. THEN Assign to: Beyond Identity MFA 

Step 3: Add Beyond Identity as the Identity Provider for use as MFA

Note: You would already have configured Beyond Identity as an OIDC provider for the first factor. Now, you will be adding the same for use as MFA.

The image below is an example of an administrator view in Okta and illustrates the actions listed below to navigate to the Identity Providers section:

4. In the main Okta menu, select “Security”.
5. In the “Security” drop-down, select “Identity Providers”.
6. In the “Identity Providers” tab, click “Add Identity Provider”. 
7. Select “Add OpenID Connect IdP”. 
8. Select fields as seen in reference images below:
   1. Name: Beyond Identity MFA
   2. IdP Usage: Factor only
   3. Client id: (Paste Client id copied from Beyond Identity Admin Console in previous step.)
   4. Client Secret: (Paste Client id copied from Beyond Identity Admin Console in previous step.)
   5. Scopes: openid (Remove any additional scopes.)
   6. Issuer: https://auth.byndid.com/v2
   7. Authorization endpoint: https://auth.byndid.com/v2/authorize
   8. Token endpoint: https://auth.byndid.com/v2/token
   9. JWKS endpoint: https://auth.byndid.com/v2/.well-known/jwks.json
   10. Userinfo endpoint: https://auth.byndid.com/v2/userinfo
   11. NOTE! The endpoints are different for the US vs. EU.
       For Beyond Identity’s EU services use auth-eu.byndid.com and api-eu.byndid.com.
   12. Click on “Show Advanced Settings”.
   13. Set IdP Username field as “idpuser.externalId”.
   14. See images below for reference:
       
          
       

4. Setup Beyond Identity as an Authenticator 

1. In the Okta main menu navigate to Security → Authenticators → Setup → Add Authenticator 
2. Select “IdP Authenticator” and for the IdP select the Beyond Identity MFA created in step 2

5. Add Multifactor Policy 

1. In the Okta main menu navigate to Security → Authenticators → Enrollment → Add Multifactor Policy
   1. Policy Name: Beyond Identity Multi Factor 
   2. Assign to groups: Beyond Identity MFA
   3. Eligible authenticators
      1. Beyond Identity MFA: required 
      2. All others: optional

2. After the policy has been saved, a rule dialog box will appear. Fill in the following values: 
   1. Rule name: BI per app MFA
   2. Leave all other values the same and save the rule

6. Add Authentication Policy

1. In the Okta main menu, navigate to Security → Authentication Policies → Add Policy
   1. Policy Name: Beyond Identity Per App MFA
2. Once the policy has been created, select the policy and edit the Catch-all Rule
   1. Under the THEN heading, change the value for “AND User must authenticate with” to: Password/IdP
   2. Save changes
3. Under the BI Per App MFA authentication policy, create a new rule by selecting Add Rule
   1. Rule Name: Beyond Identity MFA
   2. Users group membership includes
      1. Select: At least one of the following groups
      2. Choose Beyond Identity MFA group 
   3. Under the THEN section make the following selection
      1. AND User must authenticate with: Password/IdP + Another factor
   4. Under Re-Authentication frequency make the following selections:
      1. Password re-authentication frequency is: Never re-authenticate if the session is active
      2. Re-authentication frequency for all other factors is: Every sign-in attempt 
   5. Ensure the configuration matches the screenshots below
      
      
      
      

4. Under the BI Per App MFA select the Applications tab
   1. Select Add app
   2. Search for the Beyond Identity Admin Portal app and select Add.

Testing MFA

MFA Enrollment on first Use

1. Login to your Okta end user dashboard and click on Beyond Identity Admin Portal.
2. You will be prompted to set up your MFA.
3. Click on “Configure factor”.
   
   
4. Click on Enroll.
   
   
5. You will be prompted to complete the Beyond Identity MFA factor enrollment by entering your local biometrics.
6. Once this factor enrollment is complete, you will be prompted to enroll in the optional MFA factor (Okta Verify).

8. You can skip it and click on Finish.
   
   
9. You will be prompted again to authenticate using the newly enrolled MFA.
10. Click “Verify”.
    
    
11. After the certificate-based authentication is complete, you will be prompted for your local biometrics.
12. Once the biometrics check is completed, you will be signed in to the Beyond Identity Admin Console.

Using MFA with Beyond Identity User Console

If the customer wants to use Beyond Identity MFA with the Beyond Identity User Console, you will need to complete the following steps to ensure new users with no credential are not prompted to enroll in MFA

1. Create a new user group called “Beyond Identity Enrolled Users”
2. Navigate to the Beyond Identity user group that is assigned to the Beyond Identity User portal and copy/save the group ID.
   
3. In Okta navigate to Directory → Groups → Rules and create a new rule
4. Name this rule Beyond Identity Enrolled Users
   1. Select “Use Okta Expression Language”
   2. Use “IsMemberOfAnyGroup("") and user.byndidRegistered == true” as the rule and copy in the group ID saved from step 2 between the double quotes
   3. Assign this rule to the “Beyond Identity Enrolled Users” group
      
5. Now you can create an MFA policy for the Beyond Identity User portal and only users who have registered with Beyond Identity will be asked to enroll in Beyond Identity MFA