Okta SAML Authentication with WatchGuard Access Portal Integration Guide
i WatchGuard Technologies, Inc.
Okta SAML Authentication with WatchGuard Access Portal Deployment Overview You can configure Single Sign-On to use SAML authentication and enable your users to log in through one portal and get access to multiple services. This document describes how to set up SAML authentication through the WatchGuard Access Portal with Okta as the Identity Provider. Integration Summary Hardware and Service versions: Okta Identity Cloud Release 2017.49 WatchGuard FireboxV : o Fireware OS v12.1 o Feature key with an Access Portal license Test Topology This integration uses Okta Identity Cloud services to communicate with a WatchGuard Firebox over a public internet connection. Okta SAML Authentication with WatchGuard Access Portal Integration Guide 1
Configure Your Firebox for Okta The WatchGuard Access Portal is a subscription service and needs an active license applied in your Firebox feature key before you can configure it on your Firebox. These steps describe how to set up Okta. From Fireware Web UI: 1. Select Subscription Services > Access Portal. 2. Select the Enable Access Portal check box. 3. Click Save. 4. Select the User Connection Settings tab. Click Configure. The SAML tab appears. 5. To enable SAML, select the Enable SAML check box. 6. In the Service Provider (SP) Settings section, type the IdP Name and Host Name. You add the IdP settings later in this process. IdP Name Specify a name for the SAML authentication to appear in other Firebox settings as the server name. Host Name Specify the fully qualified domain name that resolves to the Firebox external interface. 2 WatchGuard Technologies, Inc.
7. Click Save. 8. Go to https://<host name>/auth/saml. 9. Make sure you have this information from the /auth/saml page: SAML Entity ID in this format: https://<host name>/auth/saml. Assertion Consumer Service (ACS) URL in this format: https://<host name>/auth/saml/acs. Single Logout Service (SLS) URL in this format: https://<host name>/auth/saml/sls. Download the certificate Okta SAML Authentication with WatchGuard Access Portal Integration Guide 3
4 WatchGuard Technologies, Inc.
Configure Okta 1. Sign into your Okta account. 2. From the top navigation bar, select Applications. The Applications page appears.. 3. Click Add Application. 4. Click Create New App. The Create a New Application Integration dialog box appears. Because this application is unique to the Firebox, we must create a new application in Okta. 5. From the Platform drop-down list, select Web. 6. For the Sign on method, select SAML 2.0. Okta SAML Authentication with WatchGuard Access Portal Integration Guide 5
7. Click Create. The General Settings dialog box appears. 8. In the App name text box, type a descriptive name for the application. 9. (Optional) Upload an App logo. 10. In the App visibility section, select options to specify whether the application icon is visible to users or in the mobile app. 11. Click Next. 6 WatchGuard Technologies, Inc.
SAML Settings 1. On the SAML Settings page, in the General section, configure these settings: Single sign on URL Type the URL in this format: https://<host name>/auth/saml/acs The WatchGuard label is the Assertion Consumer Service (ACS) URL. Audience URI (SP Entity ID) Type the URI in this format: https://<host name>/auth/saml The WatchGuard label is the SAML Entity ID. Leave the Default RelayState blank. Name ID format Select x509subjectname. Application username Select Email. 2. Click Show Advanced Settings and specify these settings: Response Select Signed. Assertion Signature Select Signed. Signature Algorithm Select SHA256. Assertion Encryption Select Encrypted. Encryption Algorithm Select AES256-CBC. Encryption Certificate Click Browse and select the certificate you downloaded from the firewall SAML 2.0 Configuration for WatchGuard Access Portal in the previous section. Enable Single Logout Select the Allow application to initiate Single Logout check box. Authentication context class Select PasswordProtectedTransport. Okta SAML Authentication with WatchGuard Access Portal Integration Guide 7
Honor Force Authentication Select Yes. SAML issuer ID Keep the default setting. 8 WatchGuard Technologies, Inc.
2. At the right side of the SAML Settings dialog box, click Download Okta Certificate. Okta SAML Authentication with WatchGuard Access Portal Integration Guide 9
3. Save the certificate. Click Next. 4. In the Are you a customer or partner? section, select an option: I'm an Okta customer adding an internal app Most deployments are in this category. I'm a software vendor. I'd like to integrate my app with Okta Select this option if your company is deploying a service for general public use. 5. Click Finish. 10 WatchGuard Technologies, Inc.
Next, configure the Sign On settings for the app you added in the previous section. 1. Select the Sign On tab. SAML 2.0 is not configured. 2. Below the View Setup Instructions button, copy the Identity Provider metadata link. The link is in this format: https://<okta account name>.okta.com/app/<random value>/sso/saml/metadata. Okta SAML Authentication with WatchGuard Access Portal Integration Guide 11
Complete the WatchGuard SAML Setup From Fireware Web UI: 1. Select Subscription Services > Access Portal. 2. Select the User Connection Settings tab. 3. Click Configure. 4. Select the SAML tab. 5. In the Identity Provider (IdP) Settings section, in the IdP Metadata URL text box, type the IdP Metadata URL from the Okta setup. 6. Click Save. 12 WatchGuard Technologies, Inc.
Test the Integration If you do not already have a user account or a group set up, you can follow these steps to test the authentication. Okta User and Group 1. Login as the Okta Administrator. 2. From the top navigation bar, select Directory > Groups. 3. Click Add Group. 4. Specify a name and a description for this group. Click Save. 5. From the top navigation bar, select Directory > People. 6. Click Add Person. The Add Person dialog box appears. 7. Type the First name, Last name, Username (this is an email ID), and Primary email. Secondary email and Groups are optional. Okta SAML Authentication with WatchGuard Access Portal Integration Guide 13
8. Click Save 14 WatchGuard Technologies, Inc.
Add the Group to the Firebox From Fireware Web UI: 1. Select Authentication > Users and Groups. Click Add. The Add User or Group dialog box appears. 2. Type the Name and Description for this group. 3. From the Authentication Server drop-down list, select the SAML authentication server. 4. Click OK. The Users and Groups page appears. 5. Click Save. 6. Select Subscription Services > Access Portal. The Access Portal page appears with the Applications tab selected. 7. Click Add and select Host Desktop Access (RDP). The RDP Host page appears. Okta SAML Authentication with WatchGuard Access Portal Integration Guide 15
8. On the Access Portal page, select the User Connection Settings tab. 9. Select Specify the applications available to each user and group. Click Add. The Add User or Group page appears. 10. From the Authentication Server drop-down list, select the name of the SAML configuration. 11. From the Type drop-down list, select Group. 12. In the Name text box, type the name you specified for the group in the previous section. 16 WatchGuard Technologies, Inc.
13. Click OK. 14. Click Save. Okta SAML Authentication with WatchGuard Access Portal Integration Guide 17
After you have completed these configurations steps, your users can sign in either to Okta Identity Cloud, or to a resource that is configured with Okta SAML Single Sign-On. 1. Type the URL for the portal in this format: https://<host name>. The Log In page appears with the name of the SAML portal you configured at the top of the page. 2. To log in, click the name of the SAML portal. In this example, click MY_OKTA_NAME. The user can now get access to the resource. 18 WatchGuard Technologies, Inc.
About This Guide Guide Type Documented Integration WatchGuard or a Technology Partner has provided documentation demonstrating integration. Guide Details WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product. Information in this guide is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc. Guide revised: 1/12/2018 Copyright, Trademark, and Patent Information Copyright 1998 2018 WatchGuard Technologies, Inc. All rights reserved. All trademarks or trade names mentioned herein, if any, are the property of their respective owners. Complete copyright, trademark, patent, and licensing information can be found in the Copyright and Licensing Guide, available online at http://www.watchguard.com/wgrd-help/documentation/overview. About WatchGuard WatchGuard Technologies, Inc. is a global leader in network security, providing best-in-class Unified Threat Management, Next Generation Firewall, secure Wi-Fi, and network intelligence products and services to more than 75,000 customers worldwide. The company s mission is to make enterprisegrade security accessible to companies of all types and sizes through simplicity, making WatchGuard an ideal solution for Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America. To learn more, visit WatchGuard.com. For additional information, promotions and updates, follow WatchGuard on Twitter, @WatchGuard on Facebook, or on the LinkedIn Company page. Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them at www.secplicity.org. Address 505 Fifth Avenue South Suite 500 Seattle, WA 98104 Support www.watchguard.com/support U.S. and Canada +877.232.3531 All Other Countries +1.206.521.3575 Sales U.S. and Canada +1.800.734.9905 All Other Countries +1.206.613.0895 Okta SAML Authentication with WatchGuard Access Portal Integration Guide 19