This guide applies to Mac computers
About Passport with Okta
Passport with Okta enables users to log into Mac computers using their Okta credentials instead of separate local passwords. This integration streamlines authentication by connecting your Okta identity provider directly to macOS login.How It Works
Passport integrates with your Okta organization to authenticate users at the macOS login screen. When users enter their Okta credentials, Passport verifies them against your Okta tenant and creates or updates the local Mac user account accordingly.- Okta
- Iru Endpoint
Okta Application Configuration
When configuring the Passport Library Item, you need the Client ID and Identity provider URL. In Okta, the client identifier may be labeled Application ID. Use these steps to configure the OIDC app and collect the required information.1
Access Applications
In your Okta Administrator Console, in the left menu pane, expand the Applications section and select Applications.
2
Create App Integration
Click Create App Integration.
3
Select Sign-in method
For Sign-in method, select OIDC - OpenID Connect.
4
Select Application Type
For Application Type, select Native Application.
5
Continue to next step
Click Next.
6
Enter app name
In the App integration name field, enter a name such as Iru Passport.
7
Configure Grant type
In the Grant type section, confirm that the checkbox for Refresh Token is deselected. This option must be turned off to ensure that Passport prompts users to update their Mac password while logged in if their Okta password changes.
The Store user password setting in the Passport Library Item needs to be set to Securely store password for users to receive the password update prompt.
8
Access Advanced options when using OIE
If you’re using Okta Identity Engine, click Advanced to show additional options.
9
Select Resource Owner Password
In the Other grants section, select the checkbox for Resource Owner Password.
If your Okta instance hasn’t yet been updated from Classic to Okta Identity Engine, also referred to as OIE, the Interaction Code grant type and other options will not be displayed.
10
Add redirect URI
In the Sign-in redirect URIs section, click Add URI.
11
Enter redirect URI
In the new field that appears, enter the following:
The same Sign-in redirect URI must be used in the Passport Library Item in the Redirect URI field in the Authentication mode section.
12
Configure assignments
In the Assignments section, select whether to assign the app integration to everyone in your org, only to selected groups, or skip assignment until after app creation.
13
Save configuration
Click Save.
Collecting Configuration Details
1
Prepare secure document
Open a secure text document that you can use to store values for this OIDC app. You will need these details when you configure the Passport Library Item.
2
Copy Client ID
In the General tab of the OIDC application you just created, on the right side of the Client ID field, click the copy icon that looks like a clipboard.
3
Store Client ID
Paste the value into your secure text document.
4
Copy Identity provider URL formula
Copy the formula for your Identity provider URL from the following text:
5
Store Identity provider URL
Paste the text into your secure text document.
6
Replace domain placeholder
In your secure text document, replace yourOktaDomain with your Okta domain.
If you do not need to configure MFA, open the Iru Endpoint tab. Follow the next section if you do need to configure MFA.
Enable Multi-Factor Authentication
When you use MFA with Passport, update Okta and the Passport Library Item. For more on how they can differ, see Okta’s Differences Between Okta Classic and OIE article. Expand the section for your Okta engine, or use the Okta Identity Engine or Classic Engine links.Okta Identity Engine, OIE
Okta Identity Engine, OIE
Okta AuthenticatorsOkta Global Session PolicyAuthentication Policies
1
Access Security section
Expand the Security section from the left-hand navigation.
2
Open Authenticators
Click Authenticators.
3
Verify MFA methods
Ensure that at least one multifactor authentication method, such as Okta Verify, is listed.
4
Add authenticator when needed
If no multifactor method is listed, click the Add authenticator button.
5
Select authenticator
Click the Add button below each authenticator you need.
6
Complete setup
Complete any additional steps for the authenticator.
7
Confirm addition
Click Add.
1
Access Security section
Expand the Security section from the left-hand navigation.
2
Open Global Session Policy
Click Global Session Policy.
3
Create or edit policy
Click Add policy to create a new policy, or to edit the existing Default Policy, continue to the next step.
4
Edit existing Default Policy
To edit the existing Default Policy, click the pencil icon in the Actions column for the Default Rule.
5
Set MFA requirement
Set multifactor authentication to Required.
6
Set MFA prompt frequency
Set Users will be prompted for MFA to At every sign in.
7
Save policy
Scroll down and click Update rule or Create rule.
1
Access Security section
Expand the Security section from the left-hand navigation.
2
Open Authentication Policies
Click Authentication Policies.
3
Access Applications
Click Applications.
4
Switch policy for Passport
Click Switch policy next to your Iru Passport application.
5
Select Password only policy
Select Password only for the Use this policy for Iru Passport policy.
6
Save policy
Click Save.
Classic Engine
Classic Engine
Okta MFA Settings
1
Access Security section
Expand the Security section from the left-hand navigation.
2
Open Authentication
Click Authentication.
3
Access Sign On
Click Sign On.
4
Add new policy
Click Add New Okta Sign-on Policy.
5
Configure policy details
Enter a Policy name similar to MFA Required.
6
Add policy description
Enter a Policy Description.
7
Select groups
Select the groups that will be assigned to this MFA requirement.
8
Create policy
Click Create policy and add rule.
9
Enter rule name
Enter the Rule name.
10
Set MFA requirement
Select Required for multifactor authentication.
11
Set MFA frequency
Select At every sign in for the Users will be prompted for MFA setting.
12
Create rule
Click Create rule at the bottom of the window.
Switch to the Iru Endpoint tab and work through the Passport Library Item steps there. Start at the top of that tab. When you are done, return to this tab and continue with Configure the Group Claim Filter in Okta below.
Configure the Group Claim Filter in Okta
In your Passport OIDC application, configure the Groups claim filter so Okta sends the group claims Passport expects. This article uses names starting with Mac- as an example.1
Access Applications
In your Okta Administrator Console, in the left menu pane, expand the Applications section if necessary, then select Applications.
2
Select Passport application
Select the Iru Passport application that you previously created.
3
Open Sign On tab
Click the Sign On tab.
4
Edit ID Token
In the OpenID Connect ID Token section, click Edit.
5
Configure Groups claim filter
In the Groups claim filter section, leave the default value: groups.
6
Set filter condition
Leave the middle field at the default: Starts with.
7
Enter group prefix
In the right-most field, enter Mac if the Okta groups you use or will use start with Mac.
8
Save configuration
Click Save.
