Install the On-Prem MFA Agent

The On-Prem MFA Agent supports proxy configuration with your RADIUS-enabled on-prem MFA server, including RSA Authentication Manager for RSA SecurIDs.

Before you begin

Ensure that you have the common UDP port and secret key values available and that the Okta RADIUS agent port 1812 is open.

Install the agent

Complete these tasks to install the On-Prem MFA Agent.

Determine the instance ID

The On-Prem MFA Agent installer requires an instance identifier.

  1. Sign in to your Okta org as an admin.
  2. Select SecurityAuthenticators.
  3. Select ActionsEdit for either the On-Prem MFA or RSA SecurID authenticators. Select the same authenticator that you used in Add and configure On-Prem MFA/RSA SecurID.
  4. Click Add new Agent.
  5. Copy the instance ID.

Run the installer

  1. Go to the directory where you saved the On-Prem MFA Agent installer. Run the installer as an administrator.
  2. Click Next.
  3. Click Next on the Important Information and License Information pages.
  4. Accept the default installation folder or browse to a different folder and then click Install. If you use a proxy server, note the installation path. You need it to enable proxies.
  5. Enter the instance ID on the Okta On-Prem Agent Configuration page. You can find this value in the app's Settings page in your Okta org.
  6. In the Register Okta On-Prem MFA Agent dialog, enter the fully qualified URL for your org.
  7. Click Next.
  8. If you use a proxy server, modify the settings to include a proxy.
    1. Open a File Explorer window.
    2. Find the config.properties file, like <AGENT_INSTALL_PATH>\current\user\config\rsa-securid\config.properties.
    3. Open the file in a text editor.
    4. Add proxy configuration key-value pairs to the end of the file. If all the properties are on a single line, add the key-value pairs below them. A proxy includes the following key-value pairs: proxyAddress = http://<ipaddress:[port]> proxyUsername = <username> proxyPassword = <password of proxyUsername>
    5. Save the file.
    6. Open Internet Options.
    7. Click Connections.
    8. Click LAN.
    9. Click Proxy.
    10. Enter the proxy settings.
    11. Click Save on each dialog until the Internet Options dialog appears.
    12. Close Internet Options.

  9. Optional. Extend the timeout period for the client session. You may need to increase the default value in situations where you use push.

    1. Open the config.properties file in a text editor.
    2. Edit the radiusSocketTimeoutMs field to a value between one and 30000 milliseconds. If the parameter is missing, add it at the bottom of the file.
  10. Sign in to Okta with super admin, app admin, or API access management admin privileges. See OpenID Connect end-to-end scenario.
  11. Click Allow Access.
  12. Bring the installer to the front and wait for the installation to finish.
  13. The Installation Completed page appears.
  14. Click Finish.
  15. Restart Windows to complete the installation.

Specify proxies for existing agents

  1. Open the C:\Program Files (x86)\....\Okta On-Prem MFA Agent\current\user\config\rsa-securid\config.properties file in a text editor.
  2. Add your proxy configurations to the bottom of this file. Example keys are proxyAddress, proxyUsername, or proxyPassword. If all the properties are on a single line, add the proxy settings below them.
  3. Save this file and run the installer for the On-Prem MFA Agent.
  4. When the installation completes, a success message appears.

Troubleshoot installation and upgrade issues

Follow these steps if you encounter issues while installing or upgrading the On-Prem MFA Agent.

New installation

If you encounter an error during installation, verify your proxy settings. You can also retry the installation using the sslPinningEnabled = false setting. Only use this option if you have previous experience using it.

Upgrade (proxy only)

If you entered proxy properties that are inaccurate, the installer may appear to succeed, but the On-Prem MFA Agent eventually fails. To verify these properties, examine the last connected timestamp on your list of agents in the Admin Dashboard.