Testing Delinea PAS and Okta Federation

Identity Provider to Service Provider Authentication Confirmation

To confirm authentication between identity provider to service provider, perform the following steps:

1. Log into the Okta portal and click on the Delinea icon.

2. Verify that you are redirected to the Delinea PAS tenant dashboard.

Service Provider to Identity Provider Authentication Confirmation

To confirm service provider to identity provider authentication, perform the following steps:

1. Log into Delinea PAS with the domain given in partner federation and verify that you are redirected to the Okta login page.

2. Log into the Okta portal and verify that you are redirected to the Delinea PAS dashboard.

Okta Multi-Factor Authentication (MFA) Setup

To set up Okta MFA, perform the following steps:

1. Log in as the administrator to the Okta portal. At the top left, select Classic UI.

2. Select the Applications tab.

3. Click Add Application.

4. Search for RADIUS Application and click Add.

5. Enter Delinea RADIUS MFA for the Application label, click Next.

6. Check Okta performs primary authentication. (This configuration works for versions 19.4 and below when Delinea PAS is not federated to thedomain. Version 19.5 and above can be federated to the domain and use Okta as the master authenticator.)

7. For UDP Port enter 1812.

8. For Secret Key enter a secret key (will be entered into Delinea PAS also).

9. For Application username format select Email.

10. For Update application username on select Create and Update.

11. Click Done.

12. Install the Okta RADIUS Agent on an accessible host (for example, an active connector host). For instructions on how to install the agent, see the Oktadocumentation: https://help.okta.com/en/prod/Content/Topics/Directory/Agent_Installing_the_Okta_Radius_Agent.htm.

Delinea Privileged Access Service Setup

To set up Delinea PAS, perform the following steps:

1. Log into the Delinea PAS console as administrator.

2. Navigate to Settings > Network > Delinea Connectors. Select an active Connector. Select the RADIUS tab. Check the box "Enable connections to external RADIUS servers." Click Save.

3. Navigate to Settings > Authentication. Select the RADIUS Connections tab, select Servers, and click Add.

4. Set Name to Okta, enter the hostname or IP address of the host where the Okta RADIUS Agent was installed.

• Set Port to 1812.

• set the Server Secret to the same value entered into the Okta portal.

• Set the Receive Timeout to 30.

• set User Identifier Attribute to Email.

• set Response Input Label to Password.

• Click Save.

5. Navigate to Settings > Authentication > Authentication Profiles and click Add Profile.

• For Profile Name enter Okta MFA Authentication Profile.

• For Challenge 1 check third Party RADIUS Authentication.

• Do not check any other authentication mechanisms.

• Click OK.

6. Navigate to Access > Roles and create Role Okta MFA User. Set administrative rights to allow Admin Portal Login at a minimum. Add one ormore users as members of the role (in this example: oktamfa@okta.demo). Click Save.

7. Navigate to Access > Policies and click Add Policy Set.

8. Enter the name Okta MFA Policy for the policy, and for Policy Assignment select Specified Roles.

9. Click Add and select a role containing the Okta MFA users (in this example: Okta MFA User).

10. Navigate to Authentication Policies > Delinea Services. Set Enable authentication policy controls to Yes and set the Default Profile to Okta MFA Authentication Profile.

11. Under User Security Policies > RADIUS, set Allow Third Party RADIUS Authentication to Yes.

12. Save the policy.

Testing Okta MFA

To test Okta MFA, perform the following steps:

1. Verify that the Okta username is enrolled in your Okta MFA mobile application.

2. Open an incognito browser window and go to the Admin Portal.

3. Enter the PIN from the Okta application or enter 1 and approve the request in the Okta application.

4. On successful MFA, the user will be logged into the Delinea PAS portal.