Tag: Access Management

Password Management for Okta Administrators using CyberArk PVWA 

Posted on by Leela Krishna Paluru in Okta
  • Introduction
  • Pre-Requisites
  • Use case Overview
  • Technical Demonstration
  • Conclusion
  • Reference Links

Introduction: 

As Organizations continue to adopt cloud-based identity and access management solutions like Okta, securing administrative access to these platforms has become a top priority. Okta administrators possess elevated privilege allowing them to manage user identities, configure security policies, and access sensitive data. However, this also makes them a prime target for attackers seeking to exploit these privileges. 

To mitigate this risk, it is essential to implement a robust password management solution that can securely store, manage, and rotate administrative credentials. Okta manages password in cloud and the organization desires to manage passwords on-premises using CyberArk Password Vault. 

To address the integration challenge, we will implement a comprehensive solution that integrates Okta with CyberArk PVWA using SAML 2.0. This integration will enable secure and automated management of Okta admin account passwords, reducing the risk of password-related security incidents and ensuring compliance with regulatory requirements. As part of this solution, two admin accounts will be created in Okta: one non-privileged account to access Okta user dashboard, and a second one Privileged account which will be linked to CyberArk PVWA. The Privileged account will receive a password generated by CyberArk, which will be used for authentication. Using SAML 2.0, the admin will log in to Okta using the privileged account credentials, with the password provided by CyberArk. This will ensure secure and compliant access management and password management processes, streamlining administrative tasks and reducing the risk of security breaches.

Pre-requisites: 

  • Okta tenant, CyberArk PVWA tenant and Active Directory with a Domain. 
  •  Active Directory must be integrated with CyberArk and Okta. 

Use case Overview:

Please refer to the below video to have an understanding about Okta & the use case around integrating CyberArk Password Vault with Okta.

Technical Demonstration:

Here’s the technical walkthrough on the integration between CyberArk Password Vault & Okta.

Conclusion: 

The integration of Okta with CyberArk PVWA provides a comprehensive solution for managing Okta administrator passwords, enhancing security, and improving compliance. By automating password rotation, expiration, and compliance, organizations can reduce administrative burdens and minimize the risk of password-related security incidents. With real-time visibility and control over password management, organizations can respond swiftly on security incidents and ensure the integrity of their identity and access management systems. Overall, this integration provides a robust and scalable solution for securing Okta administrator passwords and protecting sensitive resources and applications. 

Reference Links:

Setup SSO | Okta 

SAML authentication | CyberArk Docs 

Simplifying Server Access with Okta Advanced Server Access

Posted on by Akshit Konaperthi in Okta
  • Introduction
  • Prerequisites
  • Usecase Overview
  • Technical Demonstration
  • Conclusion
  • Reference Links

Introduction:

Many organizations face difficulties in securely managing access to their servers. This often results in compromised static credentials, delay in accessing the servers and increase in security risks. Okta’s approach to address this problem is unique, comes with Advanced Server Access (ASA) to provide simple & secure way to access the servers through ephemeral certificates. These certificates are short-lived & tightly scoped which ensures strong security for the connection. And also, JIT Passwordless authentication for server access which will create & revoke access for the user through time-bound constraints. It streamlines the login process and enhances security, ensuring that only the right people can access right resources.

To get started, we need to create and configure an ASA team, which is a designated group of users that can authenticate with Okta. Each team acts as an Advanced Server Access tenant, with all configurations and resources scoped to that team. 

Prerequisites:

  • An Okta Org account with the necessary permissions to configure applications and integrations.
  • Supported OS for ASA Server Agent – Linux & Windows
  • Supported OS for ASA Client Agent – Linux, Windows & MacOS
  • Administrative permission to install ASA Server Agent & Client Agent on servers & end devices.
  • For Network settings, please refer to Okta Docs.

Usecase Overview:

Please refer to the below video to have an understanding about Okta Advanced Server Access & the usecase around integrating servers with Okta ASA.

Technical Demonstration:

Here’s the technical demonstration on the integration of Windows and Linux servers with Okta ASA. We will cover the process of creating an ASA team in ScaleFT, followed by integrating and configuring the ASA application in Okta. Next, we will explain how to enroll servers and clients, and finally, we will test the process by accessing the server from client machines to showcase a seamless user experience.

Conclusion:

On a closure note, with all the steps carried out in this blog it is fair enough to say integrating Servers with Okta Advanced Server Access not only enhances security through ephemeral credentials but also simplifies management processes while ensuring compliance. Its scalable architecture supports modern cloud environments, making it a comprehensive solution for organizations looking to secure their server access effectively.

Reference Links:

Okta Advanced Server Access Guide

SailPoint IdentityIQ SSO Integration with Okta

Posted on by Akhil Sangam in Identity Governance, Okta, Sailpoint, Technology

You have to admit that there are many people who change their password to ‘incorrect’ .That way it always reminds them whenever they enter a wrong password – “your password is incorrect” . Also a survey stated more than 78% of people tend to forget their latest passwords within 21 days of inactivity .

Amidst such scenarios , securing and monitoring the access for any external users like partners, contractors and customers who have access to organizational resources have always been a challenge for many organizations thereby increasing the demand for a centralized login system. Single sign-on (SSO) is an authentication process that allows a user to access multiple applications with one set of login credentials. 

Okta is the one of the leading provider for user authentication and standards-based single sign-on (SSO) for employee, partner and customer identity types. Okta supports and manages SSO for the enterprises with wide range of applications thereby providing a single secured centralized login system.

SailPoint IdentityIQ  supports Single sign-on as one of its supported login configurations . The SSO is based on the SAML protocol which is a standard protocol for the SSO and other security assertions.

In this blog we are going to take a look at the integration of SailPoint IdentityIQ with Okta for Single Sign on.

The following presentation discusses in detail about the integration between SailPoint IdentityIQ and Okta.

The following is the demonstration of steps for configuring Okta as an Identity Provider for SailPoint IdentityIQ

SailPoint IdentityIQ Plugins

Posted on by Pranith Patel in Identity Governance, Sailpoint, Technology

Introduced with IdentityIQ 7.1, the plugin framework provides the infrastructure and tools to enable developers to extend the Open Identity Platform to meet a variety of specialized use cases that one might encounter in a non-standard deployment.

SailPoint IdentityIQ 7.1 Plugin Framework provides a dynamic, plugin-specific class loader. It also introduces a simple, supportable, and upgrade-able user experience. The dynamic class loader provides protection for the base classes from modification, and allows for additional security and upgrade-ability.

continue reading

SailPoint IdentityIQ SSO Integration with PingFederate

Posted on by Mohit Kayla in Sailpoint, Technology

Nowadays, almost every website requires some form of authentication to access its features and content. With the number of websites and services rising, a centralized login system has become a necessity. Single sign-on (SSO) is an authentication process that allows a user to access multiple applications with one set of login credentials. PingIdentity’s PingFederate allows the SSO for the enterprises which have the multiple applications and API’s to protect.

PingFederate is the leading enterprise federation server for user authentication and standards-based single sign-on (SSO) for employee, partner and customer identity types.

Continue reading →