{"id":193,"date":"2022-06-28T08:43:15","date_gmt":"2022-06-28T13:43:15","guid":{"rendered":"https:\/\/cloudlearning365.com\/?p=193"},"modified":"2022-10-14T09:39:20","modified_gmt":"2022-10-14T14:39:20","slug":"integrate-okta-idp-with-aviatrix-controller","status":"publish","type":"post","link":"https:\/\/cloudlearning365.com\/?p=193","title":{"rendered":"Integrate Okta IdP with Aviatrix controller"},"content":{"rendered":"\n

In this blog, I will show you step by step integrating Okta IdP (identity provider) with Aviatrix controller.<\/p>\n\n\n\n\n\n\n\n

Okta configuration<\/h3>\n\n\n\n

First sign up with okta. In this example, I’m signing up as a developer account:
https:\/\/developer.okta.com\/signup\/<\/a>
I’ve chosen to continue with my google account<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Once logged in, Applications -> Applications -> Create App Integration<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Choose SAML 2.0<\/strong> as Sign-in method<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Provide App name, such as Aviatrix<\/strong>
App logo<\/strong> is optional, and leave App visibility<\/strong> unchecked<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In SAML settings <\/p>\n\n\n\n

  • General<\/li><\/ul>\n\n\n\n
    Field<\/th>Value<\/th><\/tr><\/thead>
    Single sign on URL<\/td>https:\/\/[host]\/flask\/saml\/sso\/[Endpoint Name]<\/code><\/td><\/tr>
    Audience URI (SP Entity ID)<\/td>https:\/\/[host]\/<\/code><\/td><\/tr>
    Default RelayState<\/td>https:\/\/[host]\/#\/dashboard<\/code><\/td><\/tr>
    Name ID format<\/td>Unspecified<\/td><\/tr>
    Application username<\/td>Okta username<\/td><\/tr>
    Update application username on<\/td>Create and update<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    [host]<\/code> is the hostname or IP of your Aviatrix controller.<\/p>\n\n\n\n

    [Endpoint Name]<\/code> is an arbitrary identifier. This same value should be used when configuring SAML in the Aviatrix controller. The example uses aviatrix_saml_controller<\/strong><\/code> for [Endpoint Name]<\/code><\/p>\n\n\n\n

    https:\/\/[host]\/#\/dashboard<\/code> must be set as the Default RelayState so that after SAML authenticates, user will be redirected to dashboard.<\/p>\n\n\n\n

    • Attribute Statements<\/li><\/ul>\n\n\n\n
      Name<\/th>Name format<\/th>Value<\/th><\/tr><\/thead>
      FirstName<\/td>Unspecified<\/td>user.firstName<\/td><\/tr>
      LastName<\/td>Unspecified<\/td>user.lastName<\/td><\/tr>
      Email<\/td>Unspecified<\/td>user.email<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      In following example:
      [host]<\/code> = 22.2.2.2<\/strong>
      [Endpoint Name]<\/code> = aviatrix_saml_controller<\/strong><\/code><\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      Pick *anything* for feedback<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      In the newly created Aviatrix <\/strong>App Integration, scroll down to bottom, notice SHA-V2 is Active, click on it’s right side Actions drop down -> View IdP metadata<\/strong><\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      In newly opened browser window, copy the link, it would have following format. Save this link for next step.<\/p>\n\n\n\n

      https://dev-<accountid>.okta.com\/app\/<idstring>\/sso\/saml\/metadata<\/code><\/pre>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Aviatrix Controller Configuration<\/h3>\n\n\n\n
      Log into Aviatrix controller, eg: https:\/22.2.2.2, you will be greeted with login for local account<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      After login, check user profile, shows as User<\/strong>: admin, which means you are using  a local Aviatrix controller account logged in.<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Settings -> Controller -> SAML Login -> Add new<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      <\/p>\n\n\n\n
      Endpoint Name<\/td>aviatrix_saml_controller<\/strong><\/td>Note: as we used earlier in Okta<\/td><\/tr>
      IDP Metadata Type<\/td>URL<\/td><\/td><\/tr>
      IDP Metadata URL<\/td>https:\/\/dev-<accountid>.okta.com\/
      app\/<idstring>\/sso\/saml\/metadata<\/td>      		Note: As recorded earlier<\/td><\/tr>
      Entity ID<\/td>Hostname<\/td><\/td><\/tr>
      Access set by<\/td>Controller<\/td><\/td><\/tr>
      RBAC Groups<\/td>admin<\/td>Note: Permission assigned to this endpoint<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      <\/p>\n\n\n\n
      <\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Once the SAML Endpoints have been created, click on Test button<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      You will be greeted by this. As I did already login to Okta as my gmail account, however, I didn’t assign my gmail to Aviatrix application in Okta<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Switch back to Okta -> Aviatrix application -> Assignments -> Assign -> Assign to People -> Selected my google account.<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Goes back to Aviatrix SAML Endpoints page, and run Test again. The screen gets redirected, and you may see your email flash by<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      You can see your login indicates admin:<email> , which means SAML is working.<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      If you choose Sign out, it will return to login screen, notice that in the bottom, it listed the endpoint name: aviatrix_saml_controller<\/strong> we created earlier. Below it have a button to Sign in as SAML<\/strong> using this endpoint.<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      While this is working, since each endpoint is now mapping to a permission group defined in the Aviatrix controller, this would means for each permission group we have to create it’s own endpoint. People have to select a permission group from the drop down box before entering their login information, not very convenient. <\/p>\n\n\n\n
      Let’s take a look how we can utilize SAML IDP attribute to make this experience easier for end users.<\/p>\n\n\n\n
      Use SAML IDP attribute<\/h2>\n\n\n\n
      Summary:<\/p>\n\n\n\n
      1. Modify Aviatrix Controller SAML Endpoints to use SAML IDP attribute<\/strong><\/li>
      2. Create permission group, eg AWS_UsefulTools<\/strong>, assign it with permissions and access accounts<\/li>
      3. In Okta, add additional directory attribute (eg aviatrixPermissionGroup<\/strong>) for user profile, so it can be used to match Aviatrix permission group<\/li>
      4. In Okta, add this additional attribute (eg aviatrixPermissionGroup<\/strong>) to Aviatrix App SAML integration<\/li>
      5. In Okta, add user profile with this additional directory attribute. (eg aviatrixPermissionGroup<\/strong>)<\/li>
      6. Validation<\/li><\/ol>\n\n\n\n
        Modify Aviatrix Controller SAML Endpoints to use SAML IDP attribute<\/h3>\n\n\n\n
        Settings -> Controller -> SAML Login -> Select the SAML endpoint aviatrix_saml_controller<\/strong> created earlier, then choose Edit<\/strong><\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Switch Access set by from Controller <\/strong>to SAML IDP<\/strong> attribute<\/strong>, then click OK<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Create permission group, eg AWS_UsefulTools, assign it with permissions and access accounts<\/h3>\n\n\n\n
        Let’s create a permission group: AWS_UsefulTools<\/strong>, let’s say this permission group will only have access to an AWS access account, and only have permission to Useful Tools<\/strong> section<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Select the newly created AWS_UsefulTools<\/strong> permission group, click on Manage Permission<\/strong>, check “Useful Tools<\/strong>“, then click OK<\/strong><\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Select the newly created AWS_UsefulTools<\/strong> permission group, click on Manage Access Accounts<\/strong>, check the AWS account to grant access, then click OK<\/strong><\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Now this AWS_UsefulTools<\/strong> permission group can only perform Useful Tools operation with selected AWS account.<\/p>\n\n\n\n
        In Okta, add additional directory attribute (aviatrixPermissionGroup) for user profile, so it can be used to match Aviatrix permission group<\/h3>\n\n\n\n
        In Okta, we need to make sure each Okta user account using Aviatrix application would have a custom attribute, let’s call it aviatrixPermissionGroup<\/strong><\/p>\n\n\n\n
        Okta -> Directory -> Profile Editor -> Users -> Apps -> Locate the Aiviatrix <\/strong>app created earlier, since it’s related to Users, click on it’s name Aviatrix User<\/strong><\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Click on Add attribute<\/strong><\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Leave data type as string, make sure variable name<\/strong> is aviatrixPermissionGroup<\/strong>, and fill in corresponding Display name and Description<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Now we have additional custom attribute aviatrixPermissionGroup<\/strong> created for each Okta users using Aviatrix application<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        In Okta, add this additional attribute (aviatrixPermissionGroup) to Aviatrix App SAML integration<\/h3>\n\n\n\n
        Next we need to make sure Aviatrix application pass this custom attribute
        Okta -> Applications -> Applications -> Find and click on Aviatrix <\/strong>application<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        General <\/strong>tab -> SAML Settings<\/strong> -> Edit -> 1 General Settings -> Next<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        2 Configure SAML -> Attribute Statements (optional), previously we have:<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Click Add Another <\/p>\n\n\n\n
        Name<\/td>Name format<\/td>Value<\/td><\/tr>
        Profile<\/td>Unspecified<\/td>appuser<\/mark>.aviatrixPermissionGroup<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Remember to click Next and Finish to complete SAML Settings change<\/p>\n\n\n\n
        In Okta, add user profile with this additional directory attribute. (aviatrixPermissionGroup)<\/h3>\n\n\n\n
        Now we have to add user, and make sure this custom attribute would <\/p>\n\n\n\n
        Okta -> Directory -> People -> Add person<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Then click on the user just created, it will be in pending status. Click on Set Password & Activate<\/strong>, a temporary password will be generated for next login<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Applications -> Assigned Applications -> Assign Application<\/strong><\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Assign Aviatrix <\/strong>application<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        In the customized profile field “Aviatrix Permission Group”, add AWS_UsefulTools <\/strong>permission group we created earlier in Aviatrix permission group.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Validation<\/h3>\n\n\n\n
        Login to Aviatrix Controller using incognito mode, click on Sign in with SAML<\/strong><\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Login as the user account created earlier with temporary password, and reset password<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        In the redirection screen, if you are fast enough, you can see Profile -> AWS_UsefulTools<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Once logged in to controller, on top right side, it shows logged as RBAC User and belong to RBAC Groups: AWS_UsefulTools<\/strong>.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        You may now validate that this account will only be able to use Useful Tools for the AWS access account you granted in permission group. Example, when tried to create a VPC in an Azure access account, will get access denied.<\/p>\n\n\n\n
        \"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
        In this blog, I will show you step by step integrating Okta IdP (identity provider) with Aviatrix controller.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[2],"tags":[],"class_list":["post-193","post","type-post","status-publish","format-standard","hentry","category-aviatrix"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/193","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=193"}],"version-history":[{"count":9,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/193\/revisions"}],"predecessor-version":[{"id":695,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/193\/revisions\/695"}],"wp:attachment":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=193"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=193"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=193"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}