Integrating Trusona and Okta Cloud IAM

This guide details the steps required to configure Trusona as a passwordless authentication solution for your Okta cloud instance.

By Daniel Fischpan
Updated Jul 9, 2019

1. What’s in this doc

• 1. Getting Started
  • 1.1. Step 1: Email Trusona
    • 1.1.1. Setting up a vanity url
  • 1.2. Step 2: Log into the Okta admin portal
  • 1.3. Step 3: Create API token
  • 1.4. Step 4: Add Origin
  • 1.5. Step 5: Create a group
  • 1.6. Step 6: Create an Identity Provider
    • 1.6.1. General Settings
    • 1.6.2. Authentication Settings
    • 1.6.3. JIT Settings
    • 1.6.4. SAML Protocol Settings
  • 1.7. Step 7: Create new Sign-On policy
    • 1.7.1. Navigate to “Security” > “Authentication” > “Sign on”
  • 1.8. Step 8: Send Trusona your configuration details
  • 1.9. Step 9: Create Routing Rule
  • 1.10. Step 10: Create a Trusona Registration application
    • 1.10.1. General Settings
    • 1.10.2. Configure SAML
    • 1.10.3. Feedback
  • 1.11. Step 11: Create an Assignment
  • 1.12. Step 12: Customizing your Trusona experience
  • 1.13. Provide images
  • 1.14. Provide hex values
• 2. Okta Identifier Registration

1. Getting Started

1.1. Step 1: Email Trusona

Send an email to support@trusona.com with the following information:

Subject: Okta Integration

1. Company name
2. Email domain(s) associated with your Okta users
3. Optional - Vanity url (url seen while on the Trusona gateway)

Example:

Gateway url: https://okta98098.gateway.trusona.net/sessions/new
or
Vanity url: https://login.yourcompany.com/sessions/new

1.1.1. Setting up a vanity url

Add a new CNAME DNS record for your domain.

1. Set the “host” value to the URL you’d like users to see when logging in
2. Set the “Answer” value to ssl.trusona.net
3. Set the TTL to 300

Here’s an example of a CNAME answer when retrieved by dig tada.trusona.com.

tada.trusona.com. 3600 IN CNAME ssl.trusona.net.

Trusona will send you the following via email:

1. IdP Signature Certificate
2. Origin URL (Is Vanity url. If you are not using Vanity url Origin URL will be provided)
3. IdP Single Sign-On URL

1.2. Step 2: Log into the Okta admin portal

If you are logged into the developer portal by default than select the dropdown that reads Developer Console and click Classic UI.

If you see this page and admin button, then click Admin button.

1.3. Step 3: Create API token

Navigate to “Security” > “API” and then click the Create Token button.

Copy your API token (“Token Value” in the above image) and save it somewhere safe. You will send this to Trusona along with other information in step 8.

1.4. Step 4: Add Origin

Navigate to “Security” > “API” > “Trusted Origins” and click the Add Origin button.

1. Name your Origin Trusona
2. Trusona will provide you with the Origin url
3. Check both CORS and Redirect checkboxes

1.5. Step 5: Create a group

Navigate to “Directory” > “Groups” > click Add Group and create a name and a description

1. Name the group Trusona
2. Provide a group description
3. Click Add Group

This group is used to prevent users, who are using Trusona for passwordless login, from being prompted for an additional second factor of authentication.

You don’t need to maintain the membership of this group. Group membership is automatically managed by Trusona via the Okta API. Do not add any members to the group.

1.6. Step 6: Create an Identity Provider

Navigate to “Security” > “Identity Providers” > Click Add Identity Provider > Click SAML 2.0 IdP

Note: If the “Add Identity Provider” button does not have a drop down then click “Add Identity Provider” and continue with the steps below.

Complete the form to add the new SAML IdP using the information below:

1.6.1. General Settings

Field	Value	Instructions
Name	Trusona

1.6.2. Authentication Settings

Field	Value
IdP Username	idpuser.subjectNameId
Filter	Unchecked
Match against	Okta Username
If no match found	Create new user (JIT)

1.6.3. JIT Settings

Field	Value	Instructions
Profile Master	Unchecked
Group Assignment	Assign to specific groups
Specific Groups	Your Group Name	Enter the group name created in step 5.
If no match found	Create new user (JIT)

1.6.4. SAML Protocol Settings

The email you receive back from Trusona will contain the IdP Single Sign-On URL and the IdP Signature Certificate

Field	Value	Instructions
IdP Issuer URI	https://gateway.trusona.net/saml/metadata
IdP Single Sign-On URL	https://<YOUR ORIGIN URL>/saml	This is unique to your integration with Trusona. It will be provided by Trusona, and will look something like https://example.gateway.trusona.net/saml
IdP Signature Certificate	Issued by Trusona

Once the information in the tables above has been entered into the form, click the Add identity provider button to continue.

1.7. Step 7: Create new Sign-On policy

1.7.1. Navigate to “Security” > “Authentication” > “Sign on”

To create the new policy, click the Add New Okta Sign-On Policy button.

1. Enter “TrusonaUsers” for the Policy Name
2. Choose a meaningful description for the Policy Description
3. Add the group you created in step 5 in the “Assign to Groups” section
4. Click Create Policy and Add Rule
5. Rule Name: Name rule (This rule allows users to authenticate from anywhere)
6. Ensure that “Prompt for Factor” is unchecked. (If “Prompt for Factor” is checked, users may see unnecessary 2FA prompts after using Trusona to login to Okta.)
7. After creating a rule make sure the new rule is activated

1.8. Step 8: Send Trusona your configuration details

Using https://onetimesecret.com send the following information to support@trusona.com:

1. API Token Key
2. Group URL [Located in Directory > Groups > Trusona > copy the URL from the browser]
3. SAML metadata [Located in Security > Identity Providers by expanding the SAML IdP row]

Once this information is received, Trusona will provision your Okta integration and notify you by email when the Trusona integration is ready for use.

1.9. Step 9: Create Routing Rule

Note: Do not move onto step 9 until you have received confirmation from Trusona that your information from step 8 has been provisioned. Otherwise you may be locked out of your account.

1. Navigate to “Security” > “Identity Providers” > “Routing Rules”
2. Click the Adding Routing Rule button.
3. Match the fields below
4. Click Create Rule

Field	Value
Rule Name	Trusona
User’s IP is	Anywhere
User’s device platform	Any device
User is accessing	Any application
User matches	Anything
Use this identity provider	Trusona

Trusona recommends that this newly created routing rule be placed above existing routing rules. This ensures that users are redirected to the Trusona IdP for authentication. Your specific implementation and/or deployment needs may require the rule to be placed somewhere other than first in the list.

1.10. Step 10: Create a Trusona Registration application

The Trusona Registration application helps your users link their Okta account to their Trusona Account. This process guarantees that users are identified by the Trusona IdP with a known and valid Okta identifier. All users that intend to use Trusona to login with Okta should complete the registration process described below before attempting to use Trusona to login to Okta.

1.10.1. General Settings

1. Applications > Applications > Add Application
2. Click Create New App
3. Select “Web” from the “Platform” list
4. Choose the “SAML 2.0” radio button option
5. Click Create
6. Click Next

Field	Value
App name	Trusona
App logo	Trusona logo
App visibility	Unchecked

1.10.2. Configure SAML

1. Enter IdP Single Sign-On url. To find it navigate to “Security” > “Identity Providers” > “Configure Identity Provider” > “SAML Protocol Settings” > “IdP Single Sign-On url”
2. Change the end of the URL from “saml” to “registrations” then click Next
3. Check on “Use this for Recipient URL and Destination URL”
4. Audience URI (SP Entity ID): Enter https://gateway.trusona.net/saml/metadata
5. Click Next

1.10.3. Feedback

1. Click the radio button “I’m an Okta customer adding an internal app”
2. Click Finish

1.11. Step 11: Create an Assignment

Within the new Trusona application > Assignment > Assign

1. Assign to Groups
2. Select Everyone
3. Click Assign
4. Click Done

1.12. Step 12: Customizing your Trusona experience

The Trusona Gateway (pictured below) includes default styling that will be familiar to your users using the Trusona App.

Optionally, it’s possible to provide a custom branded experience for your users including things like:

• A custom vanity URL
• Custom secure QR code colors
• Your company logo and colors

In order for Trusona to create your custom gateway you need to provide to Trusona hex values and images for the following:

1.13. Provide images

• Hero image: 1440 x 1800 px
• Logo image: 500 x 500 px

1.14. Provide hex values

• Animated dot color: this is the color dots that animate
• List of QR colors: multiples of the same color will appear more (provide 2 hex values)
• Link color: also changes the Okta widget button colors
• Text color:
• Background color: affects background behind the QR, usually we just do pure white (#FFFFFF)

2. Okta Identifier Registration

Users who intend to use Trusona to login to Okta must complete these required one-time steps.

1. Download and install the Trusona App
2. Register in the Trusona App
3. Login to Okta using their existing username and password
4. Find, and click on, the Trusona application “chiclet” created in Step 10
5. Scan the QR code with the Trusona App
6. Accept and complete the Trusonafication

The user’s Okta identifier has now been linked to their Trusona account and they are now ready to use Trusona to login with Okta.

---