close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

Integrate Okta as an Identity Provider

date_range 18-Mar-25

Follow these steps to complete pre-requisites, configure your credential apps in Okta, and add your Identity Provider to your Juniper Mist organization.

You can use Okta Workforce Identity Cloud through the Juniper Mist dashboard to authenticate end users attempting to access the network. Juniper Mist Access Assurance uses Okta as an identity provider (IdP) to perform various authentication tasks.:

For credential-based (EAP-TTLS) authentication, Okta:
- Performs delegated authentication, that is, checks username and password by using OAuth.
- Retrieves user group membership information to support authentication policies based on this user identity.
- Gets the status—active or suspended—of an user account
For certificate-based (EAP-TLS or EAP-TTLS ) authorization, Okta:
- Retrieves user group membership information to support authentication policies based on this user identity
- Gets the status—active or suspended—of an user account

Prerequisites

Create a subscription for Okta and get your tenant ID. During subscription creation, you specify a tenant that is used to create a URL to access the Okta dashboard. You can find your ID at the top- right corner of the Okta dashboard. Note that the tenant ID must not include okta.com.

Note:
Your Okta login URL has the following format:
https://{your-okta-account-id}-admin.okta.com/admin/getting-started.
Replace {your-okta-account-id} with your Okta account ID.
You must have super user permission on the Juniper Mist portal.

OKTA Resource Owner Password Credential App Integration

Log in to the Okta administration console and select Applications > Applications.
Click Create App Integration.
The Create a new app integration page opens.
Under Sign-in method, select OIDC-OpenID Connect and under Application Type, select Native Application.
On the New Native App Integration page, select:
- App integration name—Enter a name that you resonate with.
- Grant Type—Select Resource Owner Password.
- Controlled Access—Select Allow everyone in your organization to access. In this example, we are granting everyone access to the application.
Click Save.
After the system is saved as a new app integration, the application reloads with the General tab selected.
On the General tab, click Edit and select following options: .
- Client Authentication—Select Client Secret
- Proof Key for Code Exchange—Select Require PKCE as Additional Verification
Click Save to continue.
Okta generates the client ID and the client secret after this step.
Note the client ID and client secret. You'll need this information later.
Go to the Okta API Scopes tab and select the following check boxes to grant read permissions:
- okta.roles.read
- okta.users.read
- okta.users.read.self

Now, go to the Juniper Mist cloud portal and start integrating Okta as an IdP.

Okta Client Credential App Integration

Log in to the Okta administration console and select Applications > Applications.
Click Create App Integration.
The Create a new app integration page opens.
Under Sign-in method, select API Services.
The New API Services App Integration page opens.
Enter a name for App integration name and then click Save.
Go to the General tab in the new app integration page and click Edit.
Click Edit and select the client authentication method as Public key / Private key and then click Add Key in the PUBLIC KEYS section.
Select the file format as PEM in the Private Key section, then copy the private key and save it in a safe place.
In a safe place, save the private key file that Okta generates.
You will not be able to retrieve this private key again.

Click Done.
Click Save to store and activate the key.

You can notice that the status of the key is now Active. Copy the Client ID and secret displayed on the screen,
Go to the Okta API Scopes tab and allow the following read permissions:
- okta.roles.read
- okta.users.read
- okta.users.read

Configuration on Juniper Mist Dashboard

From the left menu of the Juniper Mist portal, select Organization > Access > Identity Providers.
The Identity Providers page displays any configured identity providers.
Click Add IDP to add a new identity provider.

On the New Identity Provider page, enter the following information:

Name—Enter an IdP name.

IDP Type—Select an IdP type as OAuth.

Table 1: Settings for Identity Provider Type OAuth
Parameters	Description
OAuth Type	Select Okta
OAuth Tenant ID	Enter OAuth tenant ID. Use the ID you received during Okta application configuration.
Domain Names	Enter your Okta users domain name. Example: abc.com
Default IDP	Set the selected identity provider as default if user domain name is not specified.
OAuth Client Credential (CC) Client Id	Use the ID you received during Okta application configuration. Okta Client Credential App Integration
OAuth Client Credential (CC) Client Private Key	Enter the private key generated during Okta application configuration. See Okta Client Credential App Integration
OAuth Resource Owner Password Credential (ROPC) Client Id	Enter the secret ID you received and stored during Okta application configuration. See OKTA Resource Owner Password Credential App Integration.
OAuth Resource Owner Password Credential (ROPC) Client Secret	Provide client secret value you received and stored during Okta application configuration. See OKTA Resource Owner Password Credential App Integration

Click Create to save the changes.

In Juniper Mist portal, go to Monitoring > Insights > Client Events.

When a user authenticates using EAP-TLS with Okta, you can see the event called NAC IDP Group Lookup Success as shown below:

In case of EAP-TTLS authentication, you can see the NAC IDP Authentication Success event. This event indicates that Azure AD has validated user credentials. You can also see the NAC IDP Group Lookup Success event that fetches user group memberships.

arrow_backward PREVIOUS Identity Provider Integration

NEXT arrow_forward Integrate Google Workspace as an Identity Provider

English

Integrate Okta as an Identity Provider

OKTA Resource Owner Password Credential App Integration
Okta Client Credential App Integration
Configuration on Juniper Mist Dashboard

keyboard_arrow_right

Juniper Mist Access Assurance Guide

Integrate Okta as an Identity Provider

Prerequisites

OKTA Resource Owner Password Credential App Integration

Okta Client Credential App Integration

Configuration on Juniper Mist Dashboard

Integrate Okta as an Identity Provider

Stay in touch