Okta Authentication

Overview

Aviatrix User VPN Gateway supports Okta authentication as part of multi-factor authentication for OpenVPN® access.

Follow these steps to configure Okta authentication and MFA on a User VPN Gateway in your environment:

  1. Obtain an API token from your Okta account
  2. Create a new Aviatrix VPN Gateway
  3. Create VPN Users for this Aviatrix Gateway
  4. Test connectivity

Important

Currently, Okta authentication can only be enabled when the Aviatrix Gateway is created. It cannot be changed after the Gateway has been provisioned. This will be addressed in a future version.

Obtain API Token from Okta

Follow the steps outlined in the Okta documentation to create a new API token.

  1. Log in into your Okta account as a Super Admin. This allows the privilege to create a Token for API access.

  2. Go to Security > API and click the Create Token button. Give the token a name (for example, Aviatrix).

    Note

    Copy the generated token value. You’ll need this token to allow the Aviatrix Gateway to access Okta.

    image1

Create Aviatrix VPN Gateway

  1. Follow the steps in this guide to create a new Aviatrix VPN gateway.

  2. Under MFA Authentication select Okta from the dropdown options.

    GWOktaMFA

  3. Enter details about your Okta environment:

    Field Description
    URL Your Okta account login URL. (For example, https://aviatrixtestaccount.okta.com)
    Token The token value you copied earlier
    Username Suffix

    If provided, the VPN username will be the account ID without the domain name.

    For example, if your Okta account is demoaviatrix@aviatrix.com and aviatrix.com is your Username Suffix, the VPN username be demoaviatrix.

    If no value is provided for this field, you must enter the full username including domain name (for example, demoaviatrix@aviatrix.com).

    GWOktaAdditionalFields

Create User(s)

  1. Login to your Aviatrix Controller

  2. Expand OpenVPN and select VPN Users

  3. Click + Add New button

  4. Select the VPC (or VNet) where the VPN was created in the previous step

  5. Select the Aviatrix Gateway or Load Balancer

  6. Enter the username.

    Important

    This username must match the username in Okta.

  7. (Optional) Enter the user’s email where the .ovpn file will be emailed.

    Note

    If an email is not provided, users will need to download their .ovpn file from the Controller.

  8. (Optional) Select a profile for this user

  9. Click OK

    AddVPNUser

Validate

  1. Use the .ovpn file emailed to your test account or download it from Aviatrix VPN Users

  2. Add the configuration to your VPN client

  3. Connect and login

    Note

    Since Aviatrix Okta authentication uses API authentication, it uses the default sign on policy of Okta. If you have configured Multi factor Authentication in Okta, then during VPN login, the end user needs to append his MFA token to the password during authentication.

OpenVPN is a registered trademark of OpenVPN Inc.