WatchGuard Account SSO Integration with Okta

This document describes how to set up multi-factor authentication (MFA) for your WatchGuard accounts with Okta as an identity provider.

Contents

WatchGuard Account Authentication Data Flow with Okta

Okta communicates with various cloud-based services and service providers with the SAML protocol. This diagram shows the data flow of an MFA transaction for WatchGuard Cloud.

Before You Begin

Before you begin these procedures, make sure that:

  • A token is assigned to a user in Okta.
  • You have a tier-1 WatchGuard Cloud account and an operator with the Owner or Administrator role.

Additional charges might apply to use Okta.

Configure Okta

Before you configure Okta, you must copy the WatchGuard Service Provider SAML Metadata URL from the WatchGuard Account SSO Configuration Wizard.

To copy the WatchGuard Service Provider SAML Metadata URL:

  1. Log in to the WatchGuard Cloud with your WatchGuard user account credentials.
  2. Select Administrator > SSO.
    The SAML SSO page opens.

Screenshot of WGID, picture1

  1. Click Configure SAML SSO.
    The Important dialog box opens.

Screenshot of WGID, picture2

  1. Click Continue.
    The WatchGuard Account SSO Configuration Wizard page opens.
  2. In the WatchGuard Service Provider SAML Metadata text box, copy the WatchGuard Service Provider SAML Metadata URL.
  3. On a new tab on your browser, enter the WatchGuard Service Provider SAML Metadata URL you copied in the previous step.
  4. To save the WatchGuard Service Provider SAML metadata file to your local computer, right-click the file, then select Save As.
    Keep the WatchGuard Account SSO Configuration Wizard page open. You need to complete the configuration on this page after the Okta configuration is complete.

Screenshot of WGID, picture2

To configure Okta:

  1. Log in to the Okta Admin Console.
  2. Select Directory > Groups > Add Group.
    The Add Group page opens.

Screenshot of Okta, picture1

  1. In the Name text box, type a group name.
  2. Click Save.
  3. To add a user in Okta, select Directory > People > Add Person.
    The Add Person page opens.

    For every user you add in Okta, you must create a user with the same information in WatchGuard Cloud as an operator.

Screenshot of Okta, picture2

  1. To set the password, select the I Will Set Password check box. To set the password later, do not select this check box.
  2. Click Save.
  3. Select Applications > Applications.
    The Applications page opens.

Screenshot of Okta, picture3

  1. Click Create App Integration.
    The Create a New App Integration page opens.

Screenshot of Okta, picture4

  1. For the sign-in method, select SAML 2.0.
  2. Click Next.
    The Create SAML Integration page opens.

Screenshot of Okta, picture5

  1. In the App Name text box, type a name.
  2. (Optional) To upload a logo, in the App Logo option, click the Upload icon, then select an image to upload.
  3. Click Next.
    The Configure SAML page appears.

Screenshot of Okta, picture6

  1. In the Single Sign On URL text box, type or paste the value of the AssertionConsumerService Location parameter. You can copy this value from the WatchGuard Service Provider SAML Metadata file you saved in this section.
  2. In the Audience URI (SP Entity ID) text box, type or paste the value of the entityID parameter. You can copy this value from the WatchGuard Service Provider SAML Metadata file you saved in this section.
  3. From the Application Username drop-down list, select Email.
  4. Keep the default values for all other settings.
  5. Click Next.
    The Feedback page opens.

Screenshot of Okta, picture7

  1. From the Are You a Customer or Partner? section, select one of these options:
    1. I'm an Okta Customer Adding an Internal App — Most deployments are in this category.
    2. I'm a Software Vendor. I'd Like to Integrate My App With Okta — Select this option if your company is deploying a service for general public use.
  2. Click Finish.
    The application you created opens.

Screenshot of Okta, picture8

  1. Select the Sign On tab.
  2. From the SAML 2.0 section, copy the Metadata URL.
    The link is in this format: https://<okta account name>.okta.com/app/<random value>/sso/saml/metadata
  3. Select the Assignments tab.

Screenshot of Okta, picture9

  1. Select Assign > Assign to Groups.
    You can also select Assign to People.
  2. Select a group, then click Assign.
  3. Click Done.

Configure SSO for Your WatchGuard Account

To configure SSO for your WatchGuard account:

  1. From the WatchGuard Account SSO Configuration Wizard page, in the Metadata URL text box, type or paste the Okta metadata URL you copied in the previous section.

Screenshot of WGID, picture3

  1. Click Next.
    The SAML Configuration options open.

Screenshot of Okta, picture6

  1. In the IDP Name text box, type a name to identify your identity provider. In our example, we name the IDP idpokta.
  2. Keep the default values for all other settings.
  3. To proceed through the Contact Information, Support Message pages and the SSO Reference URLs page, click Next three times.
    The SSO Reference URLs page opens.

    The SSO reference URLs provide you with the direct links to the SSO log in pages for each account.

Screenshot of WGID, picture5

  1. Click Save.
  2. Click Back to WatchGuard Cloud.
  3. Select The screenshot of user icon > My Account.
  4. Select SSO. Make sure the Enable SAML SSO toggle status is green.
  5. To add the operators in WatchGuard Cloud, follow the steps in Add Operators to your Account. After you add an operator, make sure the Enable Login With SAML SSO check box is selected.

Screenshot of WGC, add operators

To log in with SSO, you must have a WatchGuard Cloud Operator account and an Okta person account. Both accounts must have the same email address.
When you configure SAML SSO for your WatchGuard account, users can either log in with SSO or with their local user account. We recommend users log in with SSO so they do not have to re-authenticate after their initial login.

Test the Integration

To test Okta MFA with WatchGuard account, you can authenticate with a mobile token on your mobile device. You can choose push, or Time-based one-time password (TOTP).

In this example, we show the push authentication method.

  1. In a web browser, go to WatchGuard Cloud.
  2. Click Log In With SSO.
    The Log In With SSO page opens.

Screenshot of WGC, test sso

  1. In the IDP Name text box, type the IDP name.
  2. Click Log In.
  3. In the Sign In text box, type your email address.
  4. Click Next.
  5. Select Get a Push Notification.
  6. Open your Okta Authenticator app, then click Yes, It's Me.
  7. In the Password text box, type your password.
  8. Click Verify.
    You are logged in to WatchGuard Cloud.