Yes, you can link Okta credentials directly to your VPN with the use of digital certificates - as long as your VPN supports certificate-based authentication (EAP-TLS). SecureW2’s PKI can encode each certificate template with information from Okta at the time of certificate enrollment.

The configuration process varies depending on whether you are issuing certificates to managed or unmanaged devices. However, the end result is the same, allowing end-users to leverage their SAML single sign on credentials to log into your VPN. You’ll need to create a SAML app integration in Okta and link your Okta environment to our JoinNow Management Portal by adding your SP entity ID. From there on, you’ll need to set up policies in SecureW2, including authentication, role, and enrollment policies. You can read more in-depth about the configuration process in our Okta documentation.

If your VPN supports both certificate-based authentication and RADIUS authentication, we can take this integration a step further with Cloud RADIUS. Cloud RADIUS seamlessly integrates with all major SAML Identity Providers, including Okta. At the time of authentication, Cloud RADIUS will verify the status of a user or device in Okta, ensuring that any recent changes are applied to that user’s access.

SecureW2's certificate management simplifies VPN certificate distribution for Okta by automating the whole process. SecureW2 provides industry-leading self-service BYOD certificate enrollment and installation software for all major OS systems. This allows users with unmanaged devices to enroll for their own certificates in a matter of seconds. On the other hand, we have Gateway APIs that interact with all major MDM providers, allowing zero-touch certificate enrollment. This automation guarantees that certificates are provided and deployed seamlessly, minimizing administrative costs and improving user experience by eliminating the complexity involved with certificate distribution.

SecureW2 uses several ways to deliver certificates to managed and BYOD/unmanaged devices to guarantee seamless and safe authentication throughout an organization's network.

With devices managed by MDMs such as Intune, we offer class-leading API Gateways that support SCEP, Dynamic SCEP, OAuth, ACME, JSON, and much more. These gateways constantly scan sources like Intune, Jamf, or Crowdstrike to make sure that devices are low-risk and compliant, so a certificate doesn’t still exist on a device that was forgotten about or stolen. The MDM manages the distribution of network configuration profiles, making the process more streamlined and efficient.

SecureW2 provides a self-service gateway for BYOD and unmanaged devices to simplify certificate enrollment. Users authenticate once with their Okta credentials using a SAML-based procedure. This authentication method validates the user's identity and securely provides a certificate. The portal walks users through the process of installing the certificate on their devices, allowing even non-technical users to effortlessly set up their devices for a secure VPN connection. This technique allows remote workers to use a wide variety of devices while maintaining strict security standards.

SecureW2 uses these specialized approaches to ensure that all managed or unmanaged devices may safely and effectively connect to the organization's VPN.

SecureW2's PKI works flawlessly with Okta, providing certificates encoded with user information from the Okta directory. This connection guarantees that certificates, which are intrinsically secure and non-transferable, authenticate users, offering complete assurance about who is accessing your VPN or other services such as Wi-Fi. Certificates enable organizations to impose granular network access control policies, adjusting access based on specified user roles and attributes.

Furthermore, SecureW2's Cloud RADIUS is compatible with major Identity Providers, like Okta. During authentication, Cloud RADIUS provides real-time identity verification against Okta, guaranteeing that only authorized users with valid and current statuses in the identity provider are granted access. This two-tiered approach—PKI for safe certificate issuance and Cloud RADIUS for dynamic policy enforcement—improves security and simplifies authentication operations using Okta's sophisticated identity management capabilities.

Using Cloud RADIUS for Okta VPN authentication has various advantages, including increased security, smoother integration, and easier maintenance. SecureW2's Cloud RADIUS is intended to authenticate with cloud identity providers like Azure AD, G-Suite, and Okta. This system secures and streamlines authentication by implementing dynamic, real-time restrictions based on user and device characteristics found in your Identity Provider.

One of Cloud RADIUS's main benefits is its ability to eliminate credential disclosure during authentication, dramatically reducing the risk of credential theft. Furthermore, the Identity Lookup functionality analyses a user's Okta status during authentication to ensure the most recent policies are implemented. For example, if an employee quits the organization and is deactivated in Okta, their access will automatically be rejected if they attempt to authenticate again, as long as they’ve been deactivated in Okta.

However, this depends on whether your VPN supports RADIUS-based authentication. If it does, Cloud RADIUS can use its robust integration with Okta to automate user and device authentication, making it a viable solution for contemporary, cloud-focused organizations looking to improve VPN security.