Teleport

Setting up the Okta Service

Available for:
Enterprise
Cloud

Teleport can import and grant access to Okta applications and user groups. Okta applications can be accessed through Teleport's application access UI, and access to these applications along with user groups can be managed by Teleport's RBAC along with access requests.

This guide will help you set up the Okta Service and provide some basic configurations to enable it.

In Teleport Team and Teleport Enterprise Cloud, Teleport manages the Okta integration for you, and you can enroll the Okta integration from the Teleport Web UI.

Visit the Teleport Web UI and find the dropdown menu on the upper left of the screen. Select the Management option.

On the left sidebar, click Enroll New Integration to visit the "Enroll New Integration" page:

On the "Select Integration Type" menu, click the tile for your integration. You will see a page with instructions to set up the integration, as well as a form that you can use to configure the integration.

Prerequisites

A running Teleport Enterprise cluster. For details on how to set this up, see the Enterprise Getting Started guide.
The Enterprise tctl admin tool and tsh client tool version >= 14.2.1. You can download these tools by visiting your Teleport account. You can verify the tools you have installed by running the following commands:
```
tctl version
Teleport Enterprise v14.2.1 go1.21

tsh version
Teleport v14.2.1 go1.21
```

A Teleport Enterprise Cloud account. If you do not have one, visit the signup page to begin a free trial of Teleport Team and upgrade to Teleport Enterprise Cloud.
The tctl admin tool and tsh client tool version >= 14.1.3. To download these tools, visit the Downloads page.
```
tctl version
Teleport Enterprise v14.1.3 go1.21

tsh version
Teleport v14.1.3 go1.21
```

To check that you can connect to your Teleport cluster, sign in with tsh login, then verify that you can run tctl commands using your current credentials. tctl is supported on macOS and Linux machines. For example:
```
tsh login --proxy=teleport.example.com --user=[email protected]
tctl status
Cluster  teleport.example.com
Version  14.2.1
CA pin   sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678
```
If you can connect to the cluster and run the tctl status command, you can use your current credentials to run subsequent tctl commands from your workstation. If you host your own Teleport cluster, you can also run tctl commands on the computer that hosts the Teleport Auth Service for full permissions.
A running Teleport cluster with Okta login configured.
An instance where you will run the Okta Service. This can live anywhere with outbound access to Okta and must be running Linux.
An Okta organization with an Okta API token created.

Okta API tokens inherit the permissions of the user who created them. These can be controlled by using custom admin roles and assigning them to a user who will then create the API token. We recommend creating a user dedicated to the Teleport Okta API service to manage this token.

The permissions required are:

User permissions

View users and their details
Edit users' group membership
Edit users' application assignments

Group permissions

View groups and their details
Manage group membership

Application permissions

View applications and their details
Edit application's user assignments

Additionally, the resource set associated with the target user must have unconstrained access to Users, Applications, and Groups.

One caveat here is that it's impossible to assign API token creation permissions to a custom role. However, the Okta built in role "Group Membership Admin" has permissions to create an API token. See more information about built in roles here.

Step 1/3. Create Okta import rules

Before setting up the Okta Service, you should create Okta import rules in order to ensure that our Okta applications are set up with appropriate labeling before you attempt to synchronize them. First, you'll need to get the group and application IDs from Okta. The easiest way to do this is to use the okta-api-token that was created when when evaluating the prerequisites.

To get group IDs:

curl -H "Authorization: SSWS okta-api-token" okta-endpoint-url/api/v1/groups | jq '[.[] |  {"id": .id, "label": .profile.name}]'
...[  {    "id": "111111",    "label": "Developers"  },  {    "id": "222222",    "label": "Admins"  },  {    "id": "333333",    "label": "Everyone"  },  {    "id": "444444",    "label": "HR"  },  ...]

curl -H "Authorization: SSWS okta-api-token" okta-endpoint-url/api/v1/apps | jq '[.[] |  {"id": .id, "label": .label}]'
...[  {    "id": "111111",    "label": "Okta Admin Console"  },  {    "id": "222222",    "label": "Okta Browser Plugin"  },  {    "id": "333333",    "label": "Okta Dashboard"  },  {    "id": "444444",    "label": "SAML test"  },  ...]

From here, you can copy the IDs from the output of the curl commands and use these to create the Okta import rule. Put this in a file called okta-import-rule.yaml:

kind: okta_import_rule
version: v1
metadata:
  name: import-rule
  description: "Okta import rule for all groups and applications"
spec:
  mappings:
  - match:
    - app_ids: ["111111", "222222", "333333"] # Replace these with your Okta application IDs.
    add_labels:
      app_label: app-label-value
  - match:
    - group_ids: ["111111", "222222", "333333"] # Replace these with your Okta group IDs.
    add_labels:
      group_label: group-label-value

This will ensure that the applications and groups, once synchronized to Teleport, will be given the specified labels.

Step 2/3. Set up the Okta Service

In this step, you'll set up the Okta Service. The Okta Service will interact with Okta's API to import applications and groups, as well as update memberships to those applications and groups. The Okta Service connects back to the Teleport cluster over a reverse tunnel.

Get a join token

Establish trust between your Teleport cluster and the new Okta Service instance by creating a join token:

tctl tokens add --type=okta --ttl=1h --format=text
abcd123-insecure-do-not-use-this

On the host where you will install the Teleport Okta Service, create a file called /tmp/token that consists only of your token:

echo join-token | sudo tee /tmp/token

Configure the Okta Service

First, on the host where you will run the Okta Service , create a file at okta-api-token-path with the contents of the API token.

Install Teleport on the host:

Use the appropriate commands for your environment to install your package:

Teleport Edition

Download Teleport's PGP public key
sudo curl https://apt.releases.teleport.dev/gpg \-o /usr/share/keyrings/teleport-archive-keyring.asc
Source variables about OS version
source /etc/os-release
Add the Teleport APT repository for v14. You'll need to update this
file for each major release of Teleport.
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v14" \| sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null

sudo apt-get update
sudo apt-get install teleport-ent