PANCast™ Episode 52: How to Set up SP-Initiated SSO in Prisma Cloud (SaaS) with OIDC using Okta (IdP)

[RoshanT]

Episode Transcript:

John A.: 

Hello PANCasters, welcome back! Today we’re diving into another exciting topic about Prisma Cloud. We’ll be discussing how to set up SP-Initiated SSO in Prisma Cloud using OIDC with Okta as the Identity Provider. Joining us is our expert, Roshan. Welcome back, Roshan! Can you introduce yourself to our listeners?

Roshan T.:

Thank you, John! Hello, everyone. I’m Roshan, a Staff Technical Support Engineer for Prisma Cloud. I have several years of experience inRoshan Tulsani is a Staff Technical Support Engineer for Prisma Cloud and Compute, and has a vast experience in the Support Environment. He is passionate about sharing his knowledge and expertise with customers. cybersecurity and cloud security solutions, and I’m thrilled to share insights on this topic with you today.

John A.: 

Thanks, Roshan. Let’s start with the basics. What exactly is SP-Initiated SSO with OIDC?

Roshan T.:

Great question, John. SP-Initiated SSO, or Service Provider-Initiated Single Sign-On, is like having a master key that grants access to various applications. Here, Prisma Cloud acts as the Service Provider (SP), and Okta serves as the Identity Provider (IdP).

OIDC, or OpenID Connect, is the protocol used for authentication. It operates in the application layer of the OSI model and issues ID tokens and access tokens. These tokens carry user identity information and other attributes, enabling seamless and secure authentication.

John A.: 

That’s a helpful overview. Can you give us a fun analogy to understand this better?

Roshan T.:

Absolutely! Imagine John Wick, the legendary assassin, trying to access a high-security network of assassin hotels. Normally, he’d need a unique key and password for each hotel. But with SSO, he uses a master coin from the High Table—the Identity Provider.

Each hotel (Service Provider) trusts the High Table’s authentication. So, instead of verifying John Wick directly, they rely on the High Table to confirm the validity of his coin, granting him seamless access. In our scenario, Prisma Cloud is the hotel, and Okta is the High Table.

John A.: 

Great analogy! Now, can you walk us through the OIDC authentication flow?

Roshan T.:

Certainly! Here’s how it works:

1. Verification Request: When a user attempts to access Prisma Cloud (SP), it sends a request to Okta (IdP) containing details like:
   
• Client ID: The unique identifier for Prisma Cloud.
• Redirect URI: The URL where Okta should send its response.
• Scope: The type of access requested, such as profile or email.
• State: A token to prevent attacks.
• Response Type: Typically a verification code.
• Nonce: A unique string to link the session with the ID token, preventing replay attacks
2. Authentication Process: Here, the user is redirected to Okta, which validates their credentials and issues an ID token
3. Access Granted: Prisma Cloud receives the token, verifies it, and grants the user access.

John A.: 

Thanks for breaking that down! So how do we configure Okta and Prisma Cloud at a high level?

Roshan T.:

Setting up Okta and Prisma Cloud for SP-Initiated SSO involves two main steps:

1. Configuring Okta:

• Create a new application in Okta for Prisma Cloud using OIDC
• Add Prisma Cloud’s Callback URL in the application’s Sign-in Redirect URIs and enable Federation Broker Mode that allows users access to the application without explicit preassignment
• Retrieve essential metadata, such as the Client ID, Client Secret, and endpoints, from Okta's well-known URL

     2. Setting Up Prisma Cloud:

• Enable OIDC under SSO settings in Prisma Cloud and input the Client ID, Client Secret, and endpoints retrieved from Okta
• Enable Just-in-Time (JIT) provisioning to auto-create user accounts when they log in.
• Create a user with attributes matching those in Okta or let JIT provisioning handle it automatically

John A.: 

That sounds straightforward. However, as we know, real-world setups don’t always go smoothly. Are there any common mistakes or missteps people should watch out for when implementing this setup?

Roshan T.:

Absolutely, John. While the setup is relatively straightforward, there are some common misconfigurations to be mindful of. Thankfully, Prisma Cloud and Okta provide error messages that help pinpoint issues. For example, if the client secret copied from Okta to Prisma Cloud is incorrect, you might see an error like: "The client secret supplied for a confidential client is invalid."

Here are some of the common issues and how to address them:

1. Incorrect Client ID or Client Secret:
   Double-check that the Client ID and Client Secret are correctly copied from Okta and input into Prisma Cloud.
2. Missing or Incorrect Callback URL:
   Ensure Prisma Cloud’s Callback URL is added under the Sign-in Redirect URIs in Okta.
3. User Not Assigned to the Application in Okta: Assign users to the application in Okta or enable Federation Broker Mode
4. User Not Present in Prisma Cloud: Use Just-in-Time Provisioning or manually add users in Prisma Cloud

By keeping these points in mind, troubleshooting becomes much simpler, and you can resolve most issues quickly.

John A.: 

That’s incredibly useful, Roshan. Are there any additional resources or best practices you’d recommend?

Roshan T.:

Yes, always refer to the Prisma Cloud and Okta documentation for the most up-to-date information. Testing the integration in a staging environment before rolling it out to production is also a best practice

John A.: 

Roshan, before we wrap up, can you share the key takeaways from today's discussion for our listeners?

Roshan T.:

Here are the key takeaways:

1. Use Prisma Cloud with Okta via OIDC for secure authentication
2. Double-check credentials, callback URLs, and user assignments
3. Test the integration in staging environment while referring to documentation

John A.: 

Fantastic insights, Roshan. Thank you for sharing this knowledge with our listeners today.

Roshan T.:

Thank you, John. It’s always a pleasure to be here. I look forward to joining another episode of PANCast soon.

John A.: 

PANCasters, if you have topics you’d like us to cover, please share your feedback through the Ideas Submission page on LIVEcommunity. Until next time, goodbye!

Related Content:

• Get Started with OIDC SSO

Prisma Cloud