The Amazon Workspace App

The following steps prepare an existing EC2 instance for use with Active Directory, create an AWS Directory service as a connector that points to Active Directory, and launches an associated workspace.

Prepare an Amazon EC2 Instance

In your browser, navigate to Amazon Web Services console and login as an administrator.
Select Services > EC2.
In the left pane select INSTANCES > Instances.
Locate the Active Directory instance (referred to as Instance A), and select it.
In the Description tab, Note the Private IP address of the instance.
In the lower right, click the VPC ID value.
In the associated VPC page, note the IPv4 CIDR value.
Navigate to NETWORK & SECURITY > Security GroupsGroups allow you to organize your end users and the apps they can access. Assigning apps to large sets of end users is made easier with groups..
Open the Instance A security group and click Add to add inbound rules to enable UDP/TCP for ports 53, 88. and 389 against the IPv4 CIDR.

Create an AWS Directory Service

Return to the Services tab of the AWS Console.
Enter Directory Service into the search bar and click Directory Service.
Click Set up directory.
Select AD Connector as Directory type and click Next.
Choose an appropriate size and click Next.
Choose the Instance A VPC, subsets if reuqired, and choose Next.

In the Active Directory information step enter:

Field	Value
Connected Directory DNS	Required: Your domainA domain is an attribute of an Okta organization. Okta uses a fully-qualified domain name, meaning it always includes the top-level domain (.com, .eu, etc.), but does not include the protocol (https).. For example: biz.nicopowered.com
Connected NetBIOS Name	Option. Anything appropriate. For example: biz.
DNS Address	The private IP address of instance A, previously captured.
Service Account username	Username of the active directory account previously created.
Service Account password	Associated password.

Click Next when complete.

Review the values and click Create directory.
When complete the connector should resemble:

The Amazon Workspace is now ready for use.

Install the RADIUS Agent

The RADIUS Agent must be installed and configured on Instance B.

Installation notes:

Shared Secret	During the install of the RADIUS agent you will be required to enter a shared secret. The shared secret value will be required later in the procedure.
Port	The RADIUS agent requires a port. Any available port can be used. For the remainder of this procedure the value: 1899 will be used.

Installing the Okta RADIUS Agent

Caution

When installing the RADIUS Agent you must be logged in as one of the with Read-only AdminAn abbreviation of administrator. This is the individual(s) who have access to the Okta Administrator Dashboard. They control the provisioning and deprovisioning of end users, the assigning of apps, the resetting of passwords, and the overall end user experience. Only administrators have the Administration button on the upper right side of the My Applications page., Mobile Admin, App adminAn app admin can be granted access to all instances of an app, or just specific instances of that application. This allows for more granular access control., or Super admin roles.
In addition, Okta recommends the use of dedicated service account to authorize RADIUS agents. A dedicated account ensures that the API token used by the RADIUS agent is not tied to the life-cycle of a specific user account which could be deactivated when the user is deactivated. In addition, service accounts used for RADIUS agents must be given appropriate admin permissions.

Please refer to the Administrators permission table (MFA section) for specific permissions required.

From your Administrator Dashboard, select Settings > Downloads > Okta RADIUS Server Agent.
Click the Download button and run the Okta RADIUS installer.
Proceed through the installation wizard to the "Important Information" and "License Information" screens.
Choose the Installation folder and click the Install button.
On the Okta RADIUS Agent Configuration screen, enter your RADIUS Shared Secret key and RADIUS Port number. If you are using the RADIUS application, these elements are not required.

Note

As of EA version 2.9.6 EA RADIUS Shared Secret and Port are not required. When installing the RADIUS Agent v2.9.6 EA or later these screens will be not be displayed.

Note

Avoid the use of special characters when entering the shared secret. Certain special characters can cause the installation to fail with Error Code: 3.
On the Okta RADIUS Agent Proxy Configuration screen, you can optionally enter your proxy information. Click the Next button.
On the Register Okta RADIUS Agent screen, enter the following: Choose your orgThe Okta container that represents a real-world organization. version.
If setting this up to test on your Okta Preview SandboxA sandbox environment that you request from Okta. This sandbox is an org that lives in oktapreview. It gives you complete access to a fully functioning version of Okta to test things like AD integrations and application configurations prior to pushing them out to your full set of users. org, you'll need to enter the complete URL for your org. For example: https://mycompany.oktapreview.com

Enter Subdomain – For example, if you access Okta using https://mycompany.okta.com, enter "mycompany", as described below.

For Windows Server 2008 R2 Core only: Open a browser and add the provided URL into the address field. This authorizes the installer to use Okta.
Click the Next button to continue on to an Okta Sign In page.
Sign into the service specific Okta account on the Sign In screen.
Click the Allow Access button.

The confirmation screen appears. Click the Finish button to complete the installation.

Note

If during the agent installation you encounter Error code 12: Could not establish trust relationship for the SSL/TLS service channel, ensure that you are running the latest version of the agent as older agent versions do not support TLS 1.2.
Configure a RADIUS app in Okta to configure the RADIUS agent port, shared secret, and advanced RADIUS settings .
For more information about configuring the RADIUS App in your okta tenant please see Configuring RADIUS applications in Okta

Additional Property Configurations

You can override the defaults on the following properties, if desired.

Important

Changes to the RADIUS Agent config.properties are only loaded on agent restart.
Always restart your agent after changing config.properties.

Open the folder where the Okta RADIUS agent resides. The default installation folder is C:\Program Files (x86)\Okta\Okta RADIUS Agent\.
From this folder, navigate to current\user\config\radius\config.properties. Before making changes, we recommend creating a back up of this file. Using a text application such a Notepad, open the file current\user\config\radius\config.properties residing in the Okta RADIUS agent installation folder.
Configure any of the properties shown below, as required.
When done, save the file.
Any changes are effective after restarting the Okta RADIUS Agent service using the available Windows administrative tools.

Property Description Default

ragent.num_max_http_connection The maximum number of HTTP connections in the connection pool. 20

ragent.num_request_threads The number of authentication worker threads available for processing requests. 15

ragent.total.request.timeout.millisecond
The maximum time the RADIUS agent is allowed to process a UDP packet after it has arrived from the RADIUS clientEssentially, a client is anything that talks to the Okta service. Within the traditional client-server model, Okta is the server. The client might be an agent, an Okta mobile app, or a browser plugin. .

For the Okta Verify with Push factor the actual value is interpreted by the RADIUS agent as one half (1/2) of the configured value.
For example: 60000 =60 seconds, divided in half =30 seconds.

For all other factors the value is used as specified.

60000

ragent.okta.request.max.timeout.millisecond
The socket timeout to set on the Okta API request. This property only applies if configured; otherwise, it is computed dynamically based on the total request timeout setting.
Dynamic, based on remaining TTL for request

ragent.request.timeout.millisecond The maximum time the RADIUS agent is allowed to process a UDP packet after it has arrived from the RADIUS client.

If specified, ragent.total.request.timeout.millisecond is ignored.
If not specified, default is to use ragent.total.request.timeout.millisecond.

Available since version 2.9.4. N/A defaults to value specified by ragent.total.request.timeout.millisecond

ragent.request.timeout.response.mode
The timeout response mode. Possible values include:

SEND_REJECT_ALWAYS - agent sends a reject message to the client after any timeout..

SEND_REJECT_ON_POLL_MFA- agent sends a reject message to the client if a timeout occurs during the MFA polling loop only (i.e. while the agent is polling Okta to determine if the user has correctly responded to an MFA challenge such as a push notification). If a timeout occurs at any other time, no response will be sent to the client.

NO_RESPONSE - no response will be sent to the client when the agent times out.

SEND_REJECT_ON_POLL_MFA

ragent.mfa.timeout.seconds Time, in seconds, that the agent will wait for the client to respond to an MFA challenge such as factor selection. 60

Property	Description	Default
`ragent.num_max_http_connection`	The maximum number of HTTP connections in the connection pool.	20
`ragent.num_request_threads`	The number of authentication worker threads available for processing requests.	15
`ragent.total.request.timeout.millisecond`	The maximum time the RADIUS agent is allowed to process a UDP packet after it has arrived from the RADIUS clientEssentially, a client is anything that talks to the Okta service. Within the traditional client-server model, Okta is the server. The client might be an agent, an Okta mobile app, or a browser plugin. . For the Okta Verify with Push factor the actual value is interpreted by the RADIUS agent as one half (1/2) of the configured value. For example: 60000 =60 seconds, divided in half =30 seconds. For all other factors the value is used as specified.	60000
`ragent.okta.request.max.timeout.millisecond`	The socket timeout to set on the Okta API request. This property only applies if configured; otherwise, it is computed dynamically based on the total request timeout setting.	Dynamic, based on remaining TTL for request
`ragent.request.timeout.millisecond`	The maximum time the RADIUS agent is allowed to process a UDP packet after it has arrived from the RADIUS client. If specified, ragent.total.request.timeout.millisecond is ignored. If not specified, default is to use ragent.total.request.timeout.millisecond. Available since version 2.9.4.	N/A defaults to value specified by ragent.total.request.timeout.millisecond
`ragent.request.timeout.response.mode`	The timeout response mode. Possible values include: `SEND_REJECT_ALWAYS` - agent sends a reject message to the client after any timeout.. `SEND_REJECT_ON_POLL_MFA`- agent sends a reject message to the client if a timeout occurs during the MFA polling loop only (i.e. while the agent is polling Okta to determine if the user has correctly responded to an MFA challenge such as a push notification). If a timeout occurs at any other time, no response will be sent to the client. `NO_RESPONSE` - no response will be sent to the client when the agent times out.	`SEND_REJECT_ON_POLL_MFA`
`ragent.mfa.timeout.seconds`	Time, in seconds, that the agent will wait for the client to respond to an MFA challenge such as factor selection.	60

For a complete list of all steps as well as detained steps for installing the Okta RADIUS agent see:

Add inbound rules on the AWS Instance

Instance B must be able to communicate with the AWS Directory Service. Inbound rules are used to configure the required ports/protocol to grant the required access.

In your browser, navigate to your AWS Workspace and login as an administrator.
In a browser Navigate to the AWS Workspace.
Select the Directories tab.
In the Details section for the selected directory note the Directory ID
. .
Navigate to the security groups page and determine the group ID for the associated group name.
Using the Group ID, navigate to the security group.
Create an inbound rule with values:

Field Value
Protocol UDP
Port Range 1899

When complete the new inbound rule will resemble:

Field	Value
Protocol	UDP
Port Range	1899

Note: You may be required to create a Windows firewall rule to allow UDP traffic on the required port.

Add the Amazon Workspace app in Okta

In your browser, Navigate to your Okta Org and Login as an Administrator.
From Applications menu, choose Applications.
On the Applications page, click Add Application.
In the left-side search field, enter the keyword Amazon Workspaces.
From the resulting list, choose Amazon Workspace by clicking the Add button.

In the Sign-On Options page enter:

Option	Value
AuthenticationAuthentication is distinct from authorization, which is the process of giving individuals access to system objects based on their identity. Authentication merely ensures that the individual is who he or she claims to be, but says nothing about the access rights of the individual. Authentication methods and protocols include direct auth, delegated auth, SAML, SWA, WS-Fed, and OpenID Connect. check box	Ensure that Okta performs primary authentication remains unchecked.
Port	1899. The port used for RADIUS agent integration.
Secret KeyAn Okta-generated string of characters that allows end users to set up (enroll) their mobile device in to Okta Verify. End users enter the Secret Key in the Okta Verify app during the set up process as an alternative to scanning a QR code.	Value used when installing RADIUS agent
Application Username Format	Use this drop down to specify the username format for users authenticating to Amazon Workspaces.

Click Save.

Note: Once the application has been added you must assign it to appropriate users or groups within the Active Directory instance.

Update the AWS directory configuration and enable MFA

Amazon Workspaces must be configured for MFA.

Caution

DUO MFA with Push/SMS/Call is not supported for Amazon Workspaces or RADIUS applications in general. When an end user, enrolled in Okta with DUO MFA, attempts to access Amazon Workspaces configured with RADIUS or any other RADIUS application, they must provide the six digit MFA passcode displayed on the DUO mobile app in addition to their primary password.

Return to the browser open to the Amazon Workspace.
Open the directory configuration.
Select enable Multi-Factor authenticationn.

Specify the following values:

Field	Value
RADIUS Server IP	Instance B's private IP address
Port	1899
Shared Secret	Value used when installing the Okta RADIUS agent.
Protocol	PAP

Save the updated configuration.

Configure Okta MFA factors and polices for MFA enrollment

To configure factors used for MFA:

In a browser, Navigate to your Okta Org and Login as an Administrator.
Click Security > Multifactor.
Select Factor Types tab.
For each factor being enabled,
1. Select the factor, for example Okta Verify.
2. Select Activate in the Inactive/Activate drop down.
  Note: For active factors this drop down includes Active/deactivate values.
3. Configure factor specific settings as appropriate.
Note; Okta recommends that at a Minimum Okta Verify be specified.
Select the Multifactor tab.
1. Click Add Multifactor Policy.
2. Name the policy appropriately.
3. In Assign to Groups, enter everyone and then click Add.
4. For Okta Verify select Required.
5. Click Create Policy.

After adding a policy you are directed to Add Rule automatically. You need not add a rule at this time.

Note: For more information on Multifactor Authentication see Multifactor Authentication .

Provisioning Users

AWS Workspace users are already managed in Active Directory. In live configurations configure Okta to pull users from Active directory as follows:

In a browser, Navigate to your Okta Org and Login as an Administrator.
Click Directory > Directory Integrations.
Click Add Active Directory.
Click Setup Active Directory.
Complete the wizard as required.

Note: For more information about integrating Active Directory with your Okta tenant see Install and configure the Okta Active Directory (AD) agent.

User Experience

The following describes the user experience once complete.

Amazon Workspace App

Overview

Prerequisites