Introduction

This guide provides information on how to:

• Set up Beyond Identity as an MFA factor for your Okta environment.

 

Prerequisites

Ensure that you have the following:

1. A working Beyond Identity Okta integration, where Beyond Identity passwordless authentication is already used as the first factor. (Refer to the Beyond Identity Integration Guide for Okta to complete that configuration before proceeding with this guide.)
2. Okta URL details and Admin privileges for the corresponding Okta org and the Beyond Identity org.
3. Okta “IdP Factor” MFA Feature is enabled.
   1. This is an Early Access Feature. To enable it, contact Okta Support.
   2. There is another similar sounding feature named “Custom OIDC Factor” which is currently in Beta. We don’t need that. We need the “IdP Factor”.

 

Idp factor configuration

There are four primary steps to set up Beyond Identity as an MFA: 

1. Set up Beyond Identity Console for MFA Authentication 
2. Add Beyond Identity as the Identity Provider for use as MFA
3. Enable the IdP factor at tenant level, create policy, and rule for factor enrollment
4. Enable MFA as a sign-on Policy per app

 

Step 1: Setup Beyond Identity Console for MFA Authentication:

1. Once logged into Beyond Identity Admin UI, click on “Integrations” tab and then click on OIDC Clients.
2. Click on “Add OIDC Client” and fill in the Name, Redirect URI field and leave the default value for Token Signing Algorithm and Auth Method as shown below.

 

Name: Okta Critical Apps Second Factor

Redirect URIs: https://<okta_org>.okta.com/oauth2/v1/authorize/callback

 

 

3. Click on the newly created OIDC Client configuration and write down Client ID and Client Secret Value. You will be using these values in the next step.

 

 Step 2: Add Beyond Identity as the Identity Provider for use as MFA

Note: You would already have configured Beyond Identity as an OIDC provider for the first factor. Now, you will be adding the same for use as MFA.

The image below is an example of an administrator view in Okta and illustrates the actions listed below to navigate to the Identity Providers section:

1. In the main Okta menu, select “Security”.
2. In the “Security” drop-down, select “Identity Providers”.
3. In the “Identity Providers” tab, click “Add Identity Provider”. 
4. Select “Add OpenID Connect IdP”. 
5. Select fields as seen in reference images below:
   1. Name: Beyond Identity MFA
   2. IdP Usage: Factor only
   3. Client id: (Paste Client id copied from Beyond Identity Admin Console in previous step.)
   4. Client Secret: (Paste Client id copied from Beyond Identity Admin Console in previous step.)
   5. Scopes: openid (Remove any additional scopes.)
   6. Issuer: https://auth.byndid.com/v2
   7. Authorization endpoint: https://auth.byndid.com/v2/authorize
   8. Token endpoint: https://auth.byndid.com/v2/token
   9. JWKS endpoint: https://auth.byndid.com/v2/.well-known/jwks.json
   10. Userinfo endpoint: https://auth.byndid.com/v2/userinfo
   11. NOTE! The endpoints are different for the US vs. EU.
       For Beyond Identity’s EU services use auth-eu.byndid.com and api-eu.byndid.com.
   12. Click on “Show Advanced Settings”.
   13. Set IdP Username field as “idpuser.externalId”.
   14. See images below for reference:

 

Advanced Settings:

 

 

Step 3: Enable the IdP factor at tenant level, create policy, and rule for factor enrollment

In this step, we will enable the IdP factor. It is advisable that you configure multiple MFA factors, so that users have the option to fall back to another factor in case one of the factors is not working. Therefore, we will also configure Okta Verify and SMS Authentication.

Please note: If a customer already has another MFA factor enabled, you do not need to configure an additional one, you can move forward with enabling Beyond Identity MFA

1. From the admin dashboard, navigate to Security > Multifactor.
2. Click on Okta Verify and select Activate (Optional)
3. Click on SMS Authentication and select Activate (Optional)
4. Click on IdP Factor to use an Identity Provider (IdP) integration as an authenticator and Select Activate.
5. Click Edit and Select “Beyond Identity MFA” from the pull down menu.
6. Click Save

7. On the Multifactor page click on the “Factor Enrollment” tab and add the IdP factor to your org's factor enrollment policy.
8. Click on Add Multifactor Policy
   1. Policy name: Beyond Identity MFA Policy
   2. Policy description: Beyond Identity MFA Policy
   3. Assign to groups: Beyond Identity
   4. Eligible Factors
   5. Okta Verify: Optional
   6. SMS Authentication: Disabled
   7. IdP Factor: Required
   8. Click Create Policy.

 

9. Add Rule
   1. Rule Name: Beyond Identity MFA Rule
   2. THEN clause Enroll on multi-factor: select the first time a user signs in
   3. Leave other fields to the default values.
   4. Click Create Rule

 

5. PLEASE NOTE: Some tenants may have an option for User Is Accessing. In this case, please ensure they select 
   1. Okta
   2. Applications (and select aAny application that supports MFA enrollment)

10. On the Multifactor page click on the “Factor Enrollment” tab and Click on “Default Policy” edit “Default Policy” as follows.
    1. Under “Eligible Factors” mark “IdP Factor” as disabled if you do not want to enable Beyond Identity MFA by default for all users.
       1. IdP Factor: Disabled
       2. Leave other parameters unchanged.
    2. Click Update Policy.

 

 

Step 4: Enable MFA as a sign-on Policy per app

In this step we are enabling MFA for “Beyond Identity Admin Portal”. Please follow these steps for the application for which you would like to enable MFA.

1. From Okta Admin Portal, Go to Applications > Applications > Beyond Identity Admin Portal
2. Click on the “Sign On” tab.
3. On the “Sign on” tab scroll down to the “Sign On Policy” section.
4. Click “Add Rule” and Enter following details:
   1. Rule Name: “Per App MFA”
   2. “Who does this rule apply to?”, select “Users assigned this app”
   3. Under the “Access” section
      1. Select “Prompt for factor”
      2. Select “Every sign on”
   4. Leave other sections with default value.
   5. Click Save.

Testing MFA

 

MFA Enrollment on first Use

1. Login to your Okta end user dashboard and click on Beyond Identity Admin Portal.
2. You will be prompted to set up your MFA.
3. Click on “Configure factor”.

 

 

4. Click on “Enroll”

5. You will be prompted to complete the Beyond Identity MFA factor enrollment by entering your local biometrics.
6. Once this factor enrollment is complete, you will be prompted to enroll in the

optional MFA factor (Okta Verify).

7. You can skip it and click on Finish.

 

8. You will be prompted again to authenticate using the newly enrolled MFA.
9. Click “Verify”.

 

10. After the certificate-based authentication is complete, you will be prompted for your local biometrics.
11. Once the biometrics check is completed, you will be signed in to the Beyond Identity Admin Console.

 

Using MFA with Beyond Identity User Console

If the customer wants to use Beyond Identity MFA with the Beyond Identity User Console, you will need to complete the following steps to ensure new users with no credential are not prompted to enroll in MFA

1. Create a new user group called “Beyond Identity Enrolled Users”
2. Navigate to the Beyond Identity user group that is assigned to the Beyond Identity User portal and copy/save the group ID
   
3. In Okta navigate to Directory → Groups → Rules and create a new rule
4. Name this rule Beyond Identity Enrolled Users
   1. Select “Use Okta Expression Language”
   2. Use “IsMemberOfAnyGroup("") and user.byndidRegistered == true” as the rule and copy in the group ID saved from step 2 between the double quotes
   3. Assign this rule to the “Beyond Identity Enrolled Users” group
      
5. In Step 3 Part 8, replace the user group with the newly created “Beyond Identity Enrolled Users” group
6. Now you can create an MFA policy for the Beyond Identity User portal and only users who have registered with Beyond Identity will be asked to enroll in Beyond Identity MFA