Step 2: Configure Okta application source in VMware Identity Manager

This is an Early Access feature. To enable it, in the Okta Admin Console, go to Settings Features, and then turn on Workspace1 Device Trust for your mobile platform(s).

Prerequisites

Step 1: Configure VMware Identity Manager as an Identity Provider in Okta

This step configures VMware Identity Manager to send device posture information in the SAML response to Okta after the user is authenticated.

This is a one-time, initial configuration task.

Configure Okta application source in VMware Identity Manager

Prerequisites

You have configured VMware Identity Manager as an identity provider in Okta as described in Step 1: Configure VMware Identity Manager as an Identity Provider in Okta.

Procedure

  1. In the VMware Identity Manager console, select the CatalogWeb Apps tab.
  2. Click Settings.
  3. Click Application Sources in the left pane.
  4. Click OKTA.

  5. In the OKTA Application Source wizard Definition page, enter a description if needed, then click Next.
  6. In the Configuration page:
    1. For Configuration, select URL/XML.
    2. In the URL/XML text box, copy and paste the SP metadata that you downloaded from Okta as described in Add an Identity Provider in Okta

  7. If you plan to configure device trust for iOS and Android mobile devices, click Advanced Properties and set the following options to Yes.

    These properties are mandatory for the device trust solution for iOS and Android devices.

    OptionDescription
    Device SSO ResponseSends device posture information in the SAML response to Okta after the user is authenticated.
    Enable Force Authn RequestEnable Force Authn request. The service provider can send the forceAuthn=true flag in the SAML request, which forces the user to be reauthenticated.
    Enable Authentication Failure NotificationReceive SAML response error messages when authentication fails.
  8. Click Next.
  9. In the Access Policies page, select the default access policy set.

    Authentication requests from Okta applications will be authenticated using this policy set.

  10. Click Next, review your selections, and then click Save.
  11. Click the OKTA Application Source again.
  12. In the Configuration page, modify the Username Value to match the value that Okta is matching against, such as Okta Username.

  13. Click Next twice and then Save to save your changes.

Assign Okta application source to all users

After you configure the Okta application source, assign it to all users in VMware Identity Manager.

Prerequisites

You have configured the Okta application source in VMware Identity Manager as described in Configure Okta application source in VMware Identity Manager.

Procedure

  1. In the VMware Identity Manager console, click the Users & GroupsGroups tab.
  2. Click the ALL USERS group.
  3. Click the Apps tab, then click Add Entitlements.
  4. Select the OKTA application and select Automatic as the Deployment type.
  5. Click Save.

Optional: You can allow end users to access apps from either the Okta dashboard or the Workspace ONE dashboard. Both experiences are fully supported. You can configure the Workspace ONE catalog to publish applications federated through Okta without the need to first import them into VMware Identity Manager.

For details, see Publish Okta apps to the Workspace ONE catalog