My OPSWAT Central Management can be easily integrated with an existing Okta - Access Gateway integration to ensure that a device is compliant with the organization's security policy before it is granted access to applications. This ensures that the device is not only authenticated by the IdP, but also tested for risks and vulnerabilities such as infections or unpatched versions of operating systems BEFORE it accesses an organization's cloud services.
To get started with implementing My OPSWAT Central Management integration to enforce device posture check before granting a device to access applications with Access Gateway with Okta Inbound SAML, you need to have Access Gateway configured with Okta Inbound SAML. If you haven't already done so, please follow the instructions on Okta Help Center to set it up.
You can learn more details for each step here at 3.1.1. How to set it up?
Step 1. Enable Access Control on your My OPSWAT Central Management account
Login to the My OPSWAT Central Management console.
Navigate to Access Control and then Configurations.
Check on "Enable access control" and configure a port for the cross-domain API. Note that you must select a port which no applications on endpoints is running.
Click SAVE.
Step 2. Add protected applications with IdP Method
Download Okta IdP certificate: the next step is importing an Okta X.509 certificate to My OPSWAT Central Management. This allows My OPSWAT Central Management to verify users signing though a trusted IdP, Okta. Each identity provider has a unique X.509 certificate. Download the Okta X509 certificate by following these steps:
Login to Okta as Administrator
Switch to Admin mode
3. Go to Applications dashboard
4. Select Access Gateway application
5. Go to Sign On tab and click View Setup Instruction **
**
6. Click Download certificate to download Okta certificate
Collect Access Gateway ACS URL
In Okta Administrator console, select Security > Identifier Providers
b. Expand the Okta Inbound SAML you configured for the Access Gateway. Then copy the Assertion Consumer Service URL
Collect IdP SSO login URL:
In Okta Administrator console, navigate to Applications > then select Access Gateway app
on General tab, scroll down to App Embed Link section
Copy the Embed Link there
Add the Okta Identity Provider. If you already have Okta IdP settings on your My OPSWAT Central Management account, go to 5 to add Access Gateway application.
Login to the My OPSWAT Central Management console.
Navigate to Access Control and then Configurations
On the Identity Providers tab, click "Add New Identity Provider" to add your IdP
Fill in required fields for the Identity Provider
IdP Name: an IdP name, for example, Okta
IdP Certificate: upload Okta certificate you downloaded in Step 2.1
Click Add IDP
Click SAVE CHANGES
Add the Access Gateway application:
Expand the Okta IdP settings you have just added in Step 2.4 above.
Click Add New Application
Fill required fields
Application: application name, for example, Access Gateway
IdP Login URL: IdP SSO login URL which you have from step 2.3
Application Login URL: application login URL which you have from Step 2.2
Access Mode: pick an access mode you prefer. See details on the access modes at Step 2. Add protected applications with IdP Method
Click SAVE CHANGES
After saving your changes successfully, click the Setup Instructions button of the Access Gateway application you have just added and then copy the URL MetaAccess generated there. This URL is used to replace Single sign on URL of the Access Gateway app on Okta in Step 4.
Note: you can add Access Gateway application (step 2.5) when you add Okta IdP settings.
Step 3. Configure Access Rules
On My OPSWAT Central Management console, navigate to Access Control and then Configurations
On Access Rules tab, click "ADD NEW RULE" to add a new rule for this application OR you can update existing access rules to add this application
With a new access rule, you need to specify how you would like to block/allow access a device from the application
Rule name: a rule name, for example Block non-compliant devices
Action: Block or Allow
Configure conditions to do the action. Details at Step 3. Configure Access Rules
Click ADD RULE
Step 4. Update Applications settings on Identity Provider
Login to Okta as administrator
Navigate to Applications dashboard
Select Access Gateway application
On General tab, click Edit on the SAML Settings section
Click Next on the first screen, then replace Single sign on URL with the My OPSWAT Central Management URL which you got from Step 2.6
Click Show Advanced Settings
Change Signature Algorithm to RSA-SHA1 and Digest Algorithm to SHA1
Click Next
Click Finish
Step 5. Configure SSO settings on applications
On My OPSWAT Central Management console, navigate to Access Control >Configurations
Click Download OPSWAT certificate to download a self-signed certificate My OPSWAT Central Management generated for your account
Log into Okta Administrator console
Navigate to Security > Identity Providers
Click Configure then select Configure Identity Providers on the Okta Inbound SAML you configured for the Access Gateway.
On the SAML PROTOCOL SETTINGS, replace IdP Signature Certificate to the certificate My OPSWAT Central Management generated for your account as you downloaded at step 5.2
Click on x icon to remove the current one
upload the new one
Click Show Advanced Settings
Change Request Signature Algorithm to SHA-1 and Response Signature Algorithm to SHA-1
Click Update Identity Provider
Step 6: Test your integration
Follow guideline at Step 6: Test your integration to test your integration to verify if it works as your expectation.
DONE! CONGRATULATIONS.