Skip to main content

BlastShield Documentation

Okta Configuration

BlastShield™ is SCIM 2.0 enabled and supports integration with identity providers such as Okta, Azure AD and One Identity.  SCIM support allows user accounts to be automatically created in BlastShield™ when new user accounts are assigned to the SCIM application in the IdP.   User account status and their information are automatically updated in BlastShield™ based on updates in the IdP.   BlastShield supports OIDC (OpenID Connect) to authenticate the SSO of the IdP for the user registration with the Orchestrator.  Once registered, users will authenticate via MFA with the BlastShield™ Mobile Authenticator app and the BlastShield™ Desktop Client.

Okta Configuration Pre-requisites

  1. Your Orchestrator must have an SSO portal hostname configured for your network. Please contact support@blastwave.com to get one configured.

  2. You must have administrative read/write access to the BlastShield™ Orchestrator and to the Okta configuration portal.

Summary

  1. Set up OpenID Authentication

  2. Configure the SCIM Provisioning

  3. User registration

Set up OpenID Authentication

  1. Find your Okta domain and copy it. To find your Okta URL (also called an Okta domain), sign in to your Okta organization with your administrator account, and look for the Okta domain in the global header located in the upper-right corner of the dashboard.

  2. Open the BlastShield™ Orchestrator and from the settings menu on the left, go to the “Identity Provider” settings page..

    1. Click on the Enable External Identity Provider checkbox.

      enable_external_identity_provider.png

    2. Under USER AUTHENTICATION METHOD, select the option for BlastShield Authenticator:

      user-authentication-method-blastshield-authenticator.png

    3. In the OpenID configuration section, enter your Okta tenant domain (i.e mycorporation.okta.com) as the “Domain”. Make sure to leave out any trailing slashes.

      Enter_your_Okta_tenant_domain.png

  3. In Okta, click “Create App Integration” and select “OIDC - OpenID Connect” followed by “Web Application” and click “Next”.

    Mike-select_OIDC_-_OpenID_Connect_followed_by_Web_Application.png

    1. Name the App integration “BlastShield OIDC”.

    2. Find the "Redirect URI" from the OpenID configuration in the BlastShield™ Orchestrator. This is in the format https://<your-domain>.blastshield.app/api/signin-authorized and is located as shown here:

      Mike-Copy_the_redirect_URI_from_the_Orchestrator.png

    3. Copy the “Redirect URI” from the BlastShield™ Orchestrator and paste it in as the “Sign-in redirect URI” in Okta. Remove any default “Sign-out redirect URIs”.

      Mike-Copy_the_Redirect_URI_from_the_BlastShield_Orchestrator_and_paste_it.png

  4. Under “Assignments” select your preferred option and click “Save”.

  5. Copy the “Client ID” and the generated “Client Secret” from Okta and paste it into the corresponding text fields in BlastShield.

    Mike-Copy_the_Client_ID_and_the_generated_Client_Secret-1.png
    Mike-_Copy__the__Client__ID__and__the__generated__Client__Secret-_2-release1-7.png

  6. Click “Back to Applications”.

Configure the SCIM Provisioning

  1. In Okta, click “Create App Integration” and select “SWA - Secure Web Authentication” and click “Next”.

    Mike-Create_App_Integration_and_select_SWA.png

  2. Enter BlastShield SCIMas the “App name” and copy the “REGISTRATION PORTAL > Registration URL” from the BlastShield Orchestrator and enter it as the “App’s login page URL” in Okta and click “Finish”.

    Mike-Enter_BlastShield_SCIM_as_the_App_name_and_copy_the_Sign-in_URL.png

  3. Click on the “General” tab and select “Edit” in the “App settings” box. Select “Enable SCIM provisioning” and click “Save”.

    Mike-Enable_SCIM_provisioning.png

  4. Click on the “Provisioning” tab and select “Edit” next to “SCIM Connection”.

    1. Copy the “SCIM Endpoint” from BlastShield and enter it as the “SCIM connector base URL” in Okta.

    2. Enter userName as the “Unique identifier field for users”.

    3. Under “Supported provisioning actions”, check “Push New Users”, “Push Profile Updates” and “Push Groups”.

    4. Select “HTTP Header” as the “Authentication Mode”.

    5. In BlastShield, click the “Generate Token” button and copy the token to the clipboard. Click “Save Changes” before going back to Okta.

    6. Paste the copied token into “Authorization” field and click on “Test Connector Configuration”.

      Mike-scim-connector-base-url.png

  5. Make sure that the test results show “Connector configured successfully”, then click “Save”.

    Mike-test-connector-configuration.png

  6. Click “Edit” next to “Provisioning to App” and enable “Create Users”, “Update User Attributes” and “Deactivate Users”, then click “Save”.

    Mike-provsioning-to-app.png

  7. Click on the “Assignments” tab and assign the users and/or groups that you want to give access to your BlastShield Network.

    Mike-assign-to-groups.png

  8. Optionally click on the “Push Groups” tab and push the groups that you want to import into BlastShield.

    Mike-push-groups-1.png
    Mike-push-groups-2.png

Note

When this configuration is completed, users and groups which are assigned to the BlastShield™ application in Okta will be automatically provisioned into the BlastShield™ Orchestrator, and will be available to use in BlastShield™ policies. It is not possible to modify the provisioned groups from the Orchestrator, but you can add a provisioned user to Blastshield™ created groups.

User registration

New users provisioned by the Identity Provider are registered via the the BlastShield™ registration SSO portal. The BlastShield™ registration URL is unique to your deployment and is specified in the Identity Provider > REGISTRATION PORTAL > Registration URL attribute in the Orchestrator as shown here:

sign-in-url.png

Use the following process to register each user.

  1. The new user should open the BlastShield™ Registration URL https://<your-domain>.blastshield.app in their browser.

    register-1.png

  2. Click on Sign in.

  3. Then login with the regular company SSO credentials.

    register-2.png

  4. Scan the displayed QR code with the authenticator app.

    register-3.png

  5. Complete the biometric check when prompted.

  6. The user will then be registered on the BlastShield™ network.

    register-4.png
In this section: