You can configure your ExtraHop Command and Discover appliances to enable users to log into the appliance through the Okta identity management service.
Before you begin
- You should be familiar with administrating Okta. These procedures are based on the Okta Classic UI. If you are configuring Okta through the Developer Console, the procedure might be slightly different.
- You should be familiar with administrating ExtraHop appliances.
These procedures require you to copy and paste information between the ExtraHop Admin UI and the Okta Classic UI, so it is helpful to have each UI open side-by-side.
- Log into the Admin UI on the Discover or Command appliance.
- In the Access Settings section, click Remote Authentication.
From the Remote authentication method drop-down list, select
Important: If you are migrating from an existing remote authentication provider (such as LDAP), contact your ExtraHop account team for assistance in transferring your existing appliance customizations.
- Click Continue.
- Click View SP Metadata. You will need to copy the ACS URL and Entity ID to paste into the Okta configuration in the next procedure.
This procedure requires you to copy and paste information between the ExtraHop Admin UI and the Okta Classic UI, so it is helpful to have each UI open side-by-side.
- Log into Okta.
In the upper-right corner of the page, change the view from
Developer Console to Classic
- From the top menu, click Applications.
- Click Add Application.
- Click Create New App.
- From the Platform drop-down list, select Web.
- For the Sign on method, select SAML 2.0.
- Click Create.
- In the General Settings section, type a unique name in the App name field to identify the ExtraHop appliance.
- Optional: Configure the App logo and App visibility fields as required for your environment.
- Click Next.
In the SAML Settings sections, paste the Assertion Consumer Service (ACS) URL
from the ExtraHop appliance into the Single sign on URL field in Okta.
Note: You might need to manually edit the ACS URL if the URL contains an unreachable hostname, such as the default appliance hostname "extrahop". We recommend that you specify the fully qualified domain name for the ExtraHop appliance in the URL.
- Paste the SP Entity ID from the ExtraHop appliance into the Audience URI (SP Entity ID) field in Okta.
- From the Name ID format drop-down list, select Persistent.
- From the Application username drop-down list, select Email.
In the Attribute Statements section, add the following statements exactly as
shown. The first four attributes are required. The
user.packetsLevel attribute is optional and is only
required if you have connected Trace appliances. If you have a Trace appliance
and you do not configure the user.packetsLevel attribute, users
will be unable to view or download packet captures in the ExtraHop Web UI.
Name Name format Value urn:oid:0.9.2342.19200300.100.1.3 URI Reference user.email urn:oid:22.214.171.124 URI Reference user.lastName urn:oid:126.96.36.199 URI Reference user.firstName urn:extrahop:saml:2.0:writelevel URI Reference user.writeLevel urn:extrahop:saml:2.0:packetslevel URI Reference user.packetsLevel
The following figure shows a completed example.
Click Next and then click
You are returned to the Sign On settings page.
In the Settings section, click View Setup
A new browser window opens and displays information that is required to configure the ExtraHop appliance.
- Return to the Admin UI on the ExtraHop appliance. Close the Service Provider metadata window if it is still open, and then click Add Identity Provider.
Type a unique name in the Provider Name field. This name appears on the
ExtraHop appliance login page.
- From Okta, copy the Identity provider single sign-on URL and paste into the SSO URL field on the ExtraHop appliance.
- From Okta, copy the Identity Provider Issuer URL and paste into the Entity ID field on the ExtraHop appliance.
- From Okta, copy the X.509 certificate and paste into the Signing Certificate field on the ExtraHop appliance.
Choose how you would like to provision users from one of the following
- Select Auto-provision users to create a new remote SAML user account on the ExtraHop appliance when the user first logs into the appliance.
- Clear the Auto-provision users checkbox and manually configure new remote users through the ExtraHop Admin UI or REST API. Access and privilege levels are determined by the user configuration in Okta.
- The Enable this identity provider option is selected by default and allows users to log into the appliance. To prevent users from logging in, clear the checkbox.
- Click Save.
- Save the Running Config.
You must add ExtraHop privilege attributes to Okta. These attributes enable you to assign write-level and packet-level access to your Okta users. You only need to configure user privilege attributes once in your Okta environment. These attributes can then be assigned to any Okta user profile.
- Return to the main administration page in Okta.
- From the Directory menu, select Profile Editor.
- Click Okta in the left pane to locate the built-in Okta user.
In the Actions column, click Profile.
- In the Attributes section, click Add Attribute.
- From the Data type drop-down menu, select string.
- In the Display Name field, type Write Level.
In the Variable name field, type writeLevel.
- Optional: If you have a connected Trace appliance and want to configure the packet access attribute, click Save and Add Another and continue with the rest of the procedure. Otherwise, click Save to finish.
- From the Data type drop-down menu, select string.
- In the Display Name field, type Packets Level.
In the Variable name field, type packetsLevel.
- Click Save.
We assume that you already have users configured in Okta. If you do not, refer to the Okta documentation to add new users.
- From the Directory menu, select People.
- Click the name of the user.
- Click Assign Applications.
- Locate the name of the application you configured for the ExtraHop appliance and click Assign.
- Confirm the email address in the User Name field and then click Save and Go Back.
- Click Done.
- Click Profile.
- Click Edit.
In the Write Level field, type one of the following user types:
For information about user privileges, see Users and user groups.
If you configured the user.packetsLevel attribute in the first
procedure, configure the Packets Level field by typing one of the following user
Make sure the user is active and that they have a valid password in Okta before they log into the ExtraHop appliance.