|
| 1 | +--- |
| 2 | +title: Configure Okta as an identity provider |
| 3 | +description: How to configure Okta as an identity provider in Microsoft Entra Permissions Management. |
| 4 | +services: active-directory |
| 5 | +author: jenniferf-skc |
| 6 | +manager: amycolannino |
| 7 | +ms.service: active-directory |
| 8 | +ms.subservice: ciem |
| 9 | +ms.workload: identity |
| 10 | +ms.topic: how-to |
| 11 | +ms.date: 10/10/2023 |
| 12 | +ms.author: jfields |
| 13 | +--- |
| 14 | + |
| 15 | +# Configure Okta as an identity provider (preview) |
| 16 | + |
| 17 | +This article describes how to integrate Okta as an identity provider (IdP) for an Amazon Web Services (AWS) account in Microsoft Entra Permissions Management. |
| 18 | + |
| 19 | +Permissions Required: |
| 20 | + |
| 21 | + |
| 22 | +| **Account** | **Permissions Required** |**Why?** | |
| 23 | +|-----------------------|-----------------------------------------------------|---------------------------------| |
| 24 | +| Permissions Management | Permissions Management Administrator | Admin can create and edit the AWS authorization system onboarding configuration. | |
| 25 | +| Okta | API Access Management Administrator | Admin can add the application in the Okta portal and add or edit the API scope. | |
| 26 | +| AWS | AWS permissions explicitly | Admin should be able to run the cloudformation stack to create 1. AWS Secret in Secrets Manager; 2. Managed policy to allow the role to read the AWS secret. | |
| 27 | + |
| 28 | +> [!NOTE] |
| 29 | +> While configuring the Amazon Web Services (AWS) app in Okta, the suggested AWS role group syntax is (```aws#{account alias]#{role name}#{account #]```). |
| 30 | +> Sample RegEx pattern for the group filter name are: |
| 31 | +> - ```^aws\#\S+\#?{{role}}[\w\-]+)\#(?{{accountid}}\d+)$``` |
| 32 | +> - ```aws_(?{{accountid}}\d+)_(?{{role}}[a-zA-Z0-9+=,.@\-_]+)``` |
| 33 | +> Permissions Management reads default suggested filters. Custom RegEx expression for group syntax is not supported. |
| 34 | +
|
| 35 | +## How to configure Okta as an identity provider |
| 36 | + |
| 37 | +1. Log in to the Okta portal with API Access Management Administrator. |
| 38 | +2. Create a new **Okta API Services Application**. |
| 39 | +3. In the Admin Console, go to Applications. |
| 40 | +4. On the Create a new app integration page, select **API Services**. |
| 41 | +5. Enter a name for your app integration and click **Save**. |
| 42 | +6. Copy the **Client ID** for future use. |
| 43 | +7. In the **Client Credentials** section of the General tab, click **Edit** to change the client authentication method. |
| 44 | +8. Select **Public key/Private key** as the Client authentication method. |
| 45 | +9. Leave the default **Save keys in Okta**, then click **Add key**. |
| 46 | +10. Click **Add** and in the **Add a public key** dialog, either paste your own public key or click **Generate new key** to autogenerate a new 2048-bit RSA key. |
| 47 | +11. Copy **Public Key Id** for future use. |
| 48 | +12. Click **Generate new key** and the public and private keys appear in JWK format. |
| 49 | +13. Click **PEM**. The private key appears in PEM format. |
| 50 | + This is your only opportunity to save the private key. Click **Copy to clipboard** to copy the private key and store it somewhere safe. |
| 51 | +14. Click **Done**. The new public key is now registered with the app and appears in a table in the **PUBLIC KEYS** section of the **General** tab. |
| 52 | +15. From the Okta API scopes tab, grant these scopes: |
| 53 | + - okta.users.read |
| 54 | + - okta.groups.read |
| 55 | + - okta.apps.read |
| 56 | +16. Optional. Click the **Application rate limits** tab to adjust the rate-limit capacity percentage for this service application. By default, each new application sets this percentage at 50 percent. |
| 57 | + |
| 58 | +### Convert public key to a Base64 string |
| 59 | + |
| 60 | +1. See instructions for [using a personal access token (PAT)](https://go.microsoft.com/fwlink/?linkid=2249174). |
| 61 | + |
| 62 | +### Find your Okta URL (also called an Okta domain) |
| 63 | + |
| 64 | +This Okta URL/Okta domain is saved in the AWS secret. |
| 65 | + |
| 66 | +1. Sign in to your Okta organization with your administrator account. |
| 67 | +2. Look for the Okta URL/Okta domain in the global header of the dashboard. |
| 68 | +Once located, note the Okta URL in an app such as Notepad. You'll need this URL for your next steps. |
| 69 | + |
| 70 | +### Configure AWS stack details |
| 71 | + |
| 72 | +1. Fill in the following fields on the **CloudFormation Template Specify stack details** screen using the information from your Okta application: |
| 73 | + - **Stack name** - A name of our choosing |
| 74 | + - **Or URL** Your organization's Okta URL, example: *https://companyname.okta.com* |
| 75 | + - **Client Id** - From the **Client Credentials** section of your Okta application |
| 76 | + - **Public Key Id** - Click **Add > Generate new key**. The public key is generated |
| 77 | + - **Private Key (in PEM format)** - Base64 encoded string of the PEM format of the **Private key** |
| 78 | + > [!NOTE] |
| 79 | + > You must copy all text in the field before converting to a Base64 string, including the dash before BEGIN PRIVATE KEY and after END PRIVATE KEY. |
| 80 | +2. When the **CloudFormation Template Specify stack details** screen is complete, click **Next**. |
| 81 | +3. On the **Configure stack options** screen, click **Next**. |
| 82 | +4. Review the information you've entered, then click **Submit**. |
| 83 | +5. Select the **Resources** tab, then copy the **Physical ID** (this ID is the Secret ARN) for future use. |
| 84 | + |
| 85 | +### Configure Okta in Microsoft Entra Permissions Management |
| 86 | + |
| 87 | +> [!NOTE] |
| 88 | +> Integrating Okta as an identity provider is an optional step. You can return to these steps to configure an IdP at any time. |
| 89 | +
|
| 90 | +1. If the **Data Collectors** dashboard isn't displayed when Permissions Management launches, select **Settings** (gear icon), and then select the **Data Collectors** subtab. |
| 91 | +2. On the **Data Collectors** dashboard, select **AWS**, and then select **Create Configuration**. |
| 92 | + Complete the **Manage Authorization System** steps. |
| 93 | + > [!NOTE] |
| 94 | + > If a Data Collector already exists in your AWS account and you want to add Okta integration, follow these steps: |
| 95 | + > 1. Select the Data Collector for which you want to add Okta integration. |
| 96 | + > 1. Click on the ellipsis next to the **Authorization System Status**. |
| 97 | + > 1. Select **Integrate Identity Provider**. |
| 98 | +
|
| 99 | +3. On the **Integrate Identity Provider (IdP)** page, select the box for **Okta**. |
| 100 | +4. Select **Launch CloudFormation Template**. The template opens in a new window. |
| 101 | + > [!NOTE] |
| 102 | + > Here you'll fill in information to create a secret Amazon Resource Name (ARN) that you'll enter on the **Integrate Identity Provider (IdP)** page. Microsoft does not read or store this ARN. |
| 103 | +5. Return to the Permissions Management **Integrate Identity Provider (IdP)** page and paste the **Secret ARN** in the field provided. |
| 104 | +6. Click **Next** to review and confirm the information you've entered. |
| 105 | +7. Click **Verify Now & Save**. |
| 106 | + The system returns the populated AWS CloudFormation Template. |
| 107 | + |
| 108 | +## Next steps |
| 109 | + |
| 110 | +- For information on how to view existing roles/policies, requests, and permissions, see [View roles/policies, requests, and permission in the Remediation dashboard](ui-remediation.md). |
0 commit comments