This article describes how to integrate Cloud Access Service (CAS) as a step-up authenticator with Okta using a SAML Relying party. In this use case, users first authenticate to Okta. When they access an application requiring additional assurance, Okta redirects them to RSA ID Plus for step-up authentication. After successful verification, the user returns to Okta and is granted access to the application.

Configure CAS

Perform these steps to configure CAS.

Procedure

1. Sign in to the RSA Cloud Administration Console.

2. Click Authentication Clients > Relying Parties.

   

3. On the My Relying Parties page, click Add a Relying Party.

4. In the Relying Party Catalog, click Add for Service Provider SAML.

   

5. On the Basic Information page, enter a name for the application, and then click Next Step.

   

6. On the Authentication page, configure the following settings:

   1. Select Service provider manages primary authentication, and RSA manages additional authentication.

   2. In the 1.0 Access Policy for Additional Authentication drop-down list, select a previously configured access policy.

   3. Click Next Step.

   

7. On the Connection Profile page, under Data Input Method, choose Enter Manually.

   Note: The ACS URL and SP Entity ID that you enter in the next step are temporary. After you configure Okta, import the Okta metadata to replace these values automatically.

8. In the Service Provider section, configure the temporary values:

   1. For Assertion Consumer Service (ACS) URL, enter any valid URL.

   2. For Service Provider Entity ID, keep the default value.

   

9. In the SAML Response Protection section, choose IdP signs SAML assertions, and then click Download Certificate. Save the certificate for the Okta configuration.

   

10. Expand Advanced Configuration. In the User Identity section, configure the following settings:

    1. Identifier Type: Auto Detect

    2. Property: Auto Detect

    

11. In the Statement Attributes section, add the following attributes:

    1. Attribute Name: firstName
       Attribute Source: Identity Source
       Property: givenName, or the equivalent first-name attribute in your directory

    2. Attribute Name: lastName
       Attribute Source: Identity Source
       Property: sn, or the equivalent last-name attribute in your directory

    3. Attribute Name: email
       Attribute Source: Identity Source
       Property: mail, or the equivalent email attribute in your directory

    

12. In the Identity Provider section, make a note of the Entity ID and Identity Provider URL. You need these values when you configure Okta.

13. Click Save and Finish.

14. Click Publish Changes, and wait for the operation to finish.
    After publishing, your application is enabled for SSO. 

       

Configure Okta

Perform these steps to configure Okta.

Procedure

1. Log in to the Okta Admin Console with an administrator account.

2. Create a group for the users who require RSA step-up authentication:

   1. Go to Directory > Groups, and then click Add Group.

   2. Enter a name and description for the group, and then click Save.

   3. Open the group and assign non-administrative users.

   Important: Do not add Okta administrators to this group. The group scopes the enrollment policy and application authentication policy that you configure later.

3. Go to Security > Identity Providers, and then click Add Identity Provider.

   

4. Click SAML 2.0 IdP, and then click Next.

   

5. In General settings, enter a name for the RSA Cloud Access Service IdP.

   

6. In Authentication Settings, configure the following settings:

   1. In IdP Usage, select Factor only.

   2. Clear Use Persistent Name ID (Higher Security).

   

7. In SAML Protocol Settings, configure the following settings:

   1. IdP Issuer URI: Enter the RSA Identity Provider Entity ID.

   2. IdP Single Sign-On URL: Enter the RSA Identity Provider URL.

   3. IdP Signature Certificate: Upload the certificate that you downloaded from RSA.

   4. Request Binding: HTTP POST

   5. Request Signature: Select Sign SAML Authentication Requests.

   6. Request Signature Algorithm: SHA-256

   7. Response Signature Verification: Response or Assertion

   8. Response Signature Algorithm: SHA-256

   9. Okta Assertion Consumer Service URL: Trust-specific

   10. Click Finish.

   

8. In the Summary section, click Download metadata. Save the Okta SP metadata for the RSA configuration.

   

9. Create the IdP authenticator:

   1. Go to Security > Authenticators, and then click Add Authenticator.

   2. Choose IdP Authenticator.

   3. On the Add IdP Authenticator page, select the factor-only RSA IdP that you created.

   4. Enter a name for the authenticator. Optionally, upload a logo.

   

10. Create an authenticator enrollment policy:

    1. Go to Security > Authenticators > Enrollment, and then click Add a policy.

    2. Enter a name for the policy.

    3. For Assign to groups, select the group that you created for RSA step-up authentication.

    4. Keep the appropriate organizational settings for the other authenticators.

    5. For the RSA IdP Authenticator, set Enrollment to Required.

    

11. Add a rule to the enrollment policy:

    1. In the enrollment policy, click Add Rule.

    2. Enter a name for the rule.

    3. For User is accessing, select Applications > Specific applications.

    4. Select the application for which users can enroll the RSA IdP Authenticator.

    

12. Create an application authentication policy:

    1. Go to Security > Authentication Policies > App sign-in.

    2. Click Create policy, enter a name for the policy.

    Okta creates a catch-all rule automatically.

    Important: A rule such as Any 2 factor types does not require RSA specifically. Another possession factor, such as Okta Verify, can satisfy that requirement. 

13. Click Add rule.

    

14. On the Add Rule page, configure the rule:

    1. Enter a name for the rule.

    2. For User's group membership includes, select the group that you created for RSA step-up authentication.

    3. Configure the remaining conditions according to your organization's requirements.

    

15. Configure the authentication method chain:

    1. For Access is, select Allowed after successful authentication.

    2. In User must authenticate with, select Authentication method chain.

    3. In First authentication method, select the primary authentication method required by your organization.

    4. In Next authentication method, select the RSA IdP Authenticator.

    

16. Assign the authentication policy to the application:

    1. Go to Applications > Applications.

    2. Open the target application, and then click the Sign On tab.

    

    3. In the User authentication section, click Edit.

    4. In Authentication policy, select the application authentication policy that you created, and then save the change.

    

17. Complete the RSA connection profile:

    1. Return to the RSA Cloud Administration Console and open the Okta relying party that you created.

    2. On the Connection Profile page, under Data Input Method, click Import Metadata.

    3. Click Choose File, and upload the Okta SP metadata file.

    4. Accept the changes that replace the temporary ACS URL and SP Entity ID.

    5. Click Save and Finish.

    6. Click Publish Changes and wait for the operation to finish.

The configuration is complete.