Okta Authentication with Okta API Token¶
Overview¶
There are two methods to authenticate a VPN user against Okta: Using an Okta API Token or the Aviatrix VPN SAML Client.
Okta API Token is a method where the Aviatrix VPN gateway authenticates against Okta on behalf of VPN clients using the standard Okta API. When this method is used, you can continue to use a native OpenVPN® client such as Tunnelblick while enjoying MFA authentication.
This document shows you how to set up authentication using Okta API Token.
Follow these steps to configure Okta authentication and MFA on a User VPN Gateway in your environment:
- Obtain an API token from your Okta account
- Setup Okta authentication
- Create VPN Users for this Aviatrix Gateway
- Test connectivity
Important
Okta authentication can be enabled both at the Aviatrix gateway launch time and after the Aviatrix gateway is launched. We highly recommend you configure Okta after the gateway is launched.
Obtain API Token from Okta¶
Follow the steps outlined in the Okta documentation to create a new API token.
Log in into your Okta account as a Super Admin. This allows the privilege to create a Token for API access.
Go to Security > API and click the Create Token button. Give the token a name (for example, Aviatrix).
Setup Okta Authentication¶
Follow the steps in this guide to create a new Aviatrix VPN gateway.
When you are ready to configure Okta, login to the Controller. At the main navigation bar, go to OpenVPN® -> Edit Config -> MODIFY AUTHENTICATION. From the dropdown option, select Okta.
Enter details about your Okta environment:
Field Description URL Your Okta account login URL. (For example, https://aviatrixtest.okta.com) Token The token value you copied earlier Username Suffix If provided, the VPN username will be the account ID without the domain name.
For example, if your Okta account is demoaviatrix@aviatrixtest.com and aviatrixtest.com is your Username Suffix, the VPN username should be demoaviatrix.
If no value is provided for this field, you must enter the full username including domain name (for example, demoaviatrix@aviatrixtest.com).
Create User(s)¶
Login to your Aviatrix Controller
Expand OpenVPN and select VPN Users
Click + Add New button
Select the VPC (or VNet) where the VPN was created in the previous step
Select the Aviatrix Gateway or Load Balancer
Enter the username.
Important
This username must match the username in Okta.
(Optional) Enter the user’s email where the .ovpn file will be emailed.
Note
If an email is not provided, users will need to download their .ovpn file from the Controller.
(Optional) Select a profile for this user
Click OK
Validate¶
Use the .ovpn file emailed to your test account or download it from Aviatrix VPN Users
Add the configuration to your VPN client
Connect and login
Note
Since Aviatrix Okta authentication uses API authentication, it uses the default sign on policy of Okta. If you have configured Multi factor Authentication in Okta, then during VPN login, the end user needs to append his MFA token to the password during authentication.
OpenVPN is a registered trademark of OpenVPN Inc.