Okta Authentication (OIDC)

1. In Ivanti Neurons Platform navigate to Admin > Authentication.
   The Authentication page appears.
2. In the External Authentication (SSO) section, click Configure & Enable.
   The Enable External Authentication (SSO) page appears.
3. From the Provider drop-down list select Okta.
   The Okta Configuration Settings appear. It is recommended to leave this tab open for future reference when configuring the details in Okta console.

1. Log in to Okta.
2. Select Applications > Applications.
   The Applications dashboard appears.
3. Select Browse App Catalog.
   The Browse App Integration Catalog appears.
4. Search for Ivanti Neurons and select it.
5. Select Add Integration.
   The Add Ivanti Neurons page appears.
6. The Application label by default is Ivanti Neurons, change if required. Select Done.
   The Assignment page appears.
7. The Assignments page allows you to specify who can access the Ivanti Neurons application, you can allow access to individuals or groups.
   Select Assign to People or Assign to Groups.

   Remember to assign it to the person setting up the integration, they will need permissions to be able access the application.

8. Search for, and select, the people or group you want to assign the app to.
9. Select Assign.
10. Once you have assigned to all required people or group, select Done.
11. Select the Sign On tab.
12. Select Edit.
13. In Base URL paste the url copied from the Ivanti Neurons platform > Authentication page.
    
14. Select Save. The integration is created.
15. A Client ID and Client Secret are generated and displayed.
    

You need to record the Domain, Client ID and Client Secret ready to use in the next step of the setup in the Ivanti Neurons Platform.

Only SP-initiated SSO is supported.

1. Login to Okta as an Admin.
2. Expand the Applications drop-down, click Applications.
3. Click Browse App Catalog.
4. Search for Bookmark App, select it from the list of results, and click Add.
5. Enter an Application label, which will be the display name. For example, Ivanti Neurons <Company Name> Neurons tenant.
6. Copy the URL to directly link into the URL field. This should be the URL for the Neurons tenant you are attempting to connect to.
7. Click Save.
8. Assign users to test.

Okta setup is now complete and you can return to Ivanti Neurons Platform to continue setup.

Once you have created the Okta application you can continue with the Ivanti Neurons Platform configuration.

1. Return to the Okta Configuration Settings page (Ivanti Neurons Platform > Authentication > External Authentication (SSO) > Configure and Enable.
2. Enter the Okta Domain from the user profile drop-down in the top-right of the Okta app integration.
3. Leave the Auth Server ID blank. You only need to specify the tenant details if you are using a custom authorization server. For further details refer to Okta App setup - Custom authorization server.
4. Enter the Client ID that was generated and saved from the Okta app integration.
5. Enter the Client secret value, that was generated and saved from the Okta app integration.
6. Select Continue to display the Validate Connection Settings page.

You need to connect with your Okta credentials to validate your connection settings.

1. On the Validate Connection Settings page, click Validate Settings to access your organization's sign-in page via a new tab, enter your Okta credentials and proceed to sign-in. If you are already signed in credentials are not required and the validation takes place automatically, so make sure you are signed in to the account you want to authenticate.
   You will receive a confirmation screen if login is successful.

The Okta username must exactly match your Ivanti Neurons username.


2. Return to this tab (Validate Connection Settings).
3. Select the check box I confirm I have successfully validated my connection settings to confirm you have logged in successfully.
4. Click Continue to move on to convert Ivanti Neurons Platform accounts. The Enable Ivanti Neurons Platform accounts page displays.

Validation Troubleshooting

• E2018 Authentication failed: User failed to authenticate with Okta. Check the username and password are correct and that the user has permissions on the Okta Application Registration.
• E2020 Unable to link to Neurons Platform user account: The Okta user login, does not match with the Ivanti Neurons Platform user. The Ivanti Neurons Platform user account email address must match the email address used to login into Okta.

Okta is now configured, but it is not enabled.

To enable, you need to convert your Ivanti Neurons Platform accounts to use Okta instead.

1. On the Enable Ivanti Neurons Platform accounts page, click Sign Out & Enable.
   The Ivanti Neurons Sign In page appears.
2. Select to Sign In with Okta and enter your Okta credentials, the conversion will then be complete.
   All members will receive an email to confirm the account has been converted and that they must access the tenant with Okta credentials going forward. If the member does not have Okta credentials, they will not be able to access Ivanti Neurons.
   

External Authentication (SSO) will now display with an Enabled status.

1. Login to Okta.
2. In the sidebar menu select Applications > Applications.
   The Applications dashboard appears.
3. Select Create App Integration.
   The Create a new app integration page appears.
4. Select the Sign-in method OIDC - OpenID Connect.
5. Select the Application type Web Application.
6. Click Next.
   The New Web App Integration page appears.
7. Give the application a name in App integration name.
8. For the grant type select Implicit (hybrid).
9. Enter the Sign-in redirect URI; append the base url (as displayed in the Ivanti Neurons Platform Okta Configuration Settings) with /signin-okta.
10. Enter the Sign-out redirect URI; append the base url (as displayed in the Ivanti Neurons Platform Okta Configuration Settings) with /signout-okta.
11. In Assignments select the level of control you want over access.
12. Select Save. The application is created.
13. A Client ID and Client Secret are generated and displayed.

You need to record the Domain, Client ID and Client Secret ready to use in the next step of the setup in the Ivanti Neurons Platform.

Okta setup is now complete and you can return to Ivanti Neurons Platform.