To establish a relying party trust between vCenter Server and an Okta server, establish identifying information and a shared secret between them. Create an OpenID Connect application in Okta. The OpenID Connect application specifies the vCenter Server redirect URIs that must be invoked during authorization code flows; and a client identifier and shared secret that vCenter Server uses to communicate with the Okta server. To push the Active Directory users and groups in the Okta domain to the vCenter Server that manages vCenter Server objects, also create a SCIM 2.0 application.
Please follow the below mentioned steps to:
Use this KB article in conjunction with Configure vCenter Server Identity Provider Federation for Okta.
If the Active Directory and Okta were integrated previously, or to use the users and groups provided by Okta, skip this step and go to Create the OpenID Connect Application.
To integrate the Active Directory with Okta, please refer to Manage your Active Directory integration for more information.
Log in to the Okta Admin console and follow the Okta documentation, Create OIDC app integrations, to create an OpenID Connect application. When creating the OpenID Connect application in the Create a new app integration wizard:
After creating the OpenID Connect application:
To assign groups and users to the OpenID Connect application:
Okta assigns the group(s).
To add the identity provider in vCenter Server for Okta, go to Configure vCenter Server Identity Provider Federation for Okta and start with Step 2.
When you are done adding the Okta identity provider in vCenter Server, return to this KB article and continue with Update the Okta Redirect URI.
After you create the Okta identity provider configuration on vCenter Server, you update the Okta OpenID Connect application with the Redirect URI that you copy from the Okta Identity Provider Configuration page in vCenter Server.
In the Okta Admin console:
Creating a SCIM 2.0 application enables you to specify which Active Directory users and groups to push to vCenter Server.
To create the SCIM 2.0 application, log in to the Okta Admin console, browse the app catalog for SCIM 2.0 Test App (OAuth Bearer Token), and click Add Integration.
Note: The word "Test" is of Okta's choosing. The SCIM application you create using this "Test" template is of production quality.
a. In the Okta SCIM 2.0 application, under Provisioning, click Configure API integration.
b. Check the Enable API integration checkbox.
c. Enter the SCIM 2.0 Base Url and OAuth Bearer Token.
You previously copied items from the vCenter Server Identity Provider page. vCenter Server calls the SCIM 2.0 Base Url the "Tenant URL," and the OAuth Bearer Token the "Secret Token."
Note: If the network is not publicly available, create a network tunnel between the vCenter Server system and the Okta server, then use the appropriate publicly accessible URL as the Base Uri.
d. Leave Import Groups selected.
e. To verify the SCIM credentials, click Test API Credentials.
f. Click Save.
a. Select the Provisioning tab and select To App, then click Edit.
b. Check Create Users, Update User Attributes, and Deactivate Users.
c. Do not check Sync Password.
d. Click Save.
a. Select the Assignments tab and select Assign to Groups from the Assign drop-down.
b. Enter the group to search for in the Search field.
c. Select the group and click Assign.
d. If necessary, enter attribute information, then click Save and Go Back.
e. Search for, and select and assign, other groups as needed.
f. When done assigning groups, click Done.
g. Under Filters, select People and Groups to view the users and groups assigned.
Unless you uncheck the Push group memberships immediately check box, the selected membership is pushed immediately, and the Push Status shows Active. For more information, see Enable Group Push.
To authorizing Okta users to log into vCenter Server, return to Configure vCenter Server Identity Provider Federation for Okta, Step 5 and complete setting up the Okta identity provider by assigning group membership. You can then assign and permissions (inventory-level and global) to the Okta users.