Migrate your Okta IDP from the Legacy Custom Authentication to the Modern Authenticator Framework

1. Configure Okta to communicate with Cylance Endpoint Security

In your Okta administration console, you must add a new single sign-on URL for Cylance. Add  https://idp.blackberry.com/_/resume

By default, the Cylance management console requires all SAML responses to include the user’s email addresses. Important: The email addresses in Okta must match the addresses that are registered in the Cylance management console. 

In this example, we are adding the new single sign-on URL to the existing list of URLs.

In the image, the numbers correspond to the Step number in the procedure; not all steps are represented in the image. 

1. In the Okta administration console, open your existing SAML application and update the SAML settings.
2. Add the new single sign-on URL to the list as a secondary option. In the Other Requestable SSO URLs, URL field, enter   https://idp.blackberry.com/_/resume and leave the Index at 0 (see the image to the left). BlackBerry does not send an index.
3. Record the Audience URI (SP Entity ID).  We will be checking it against the Authenticator configuration in the Cylance console in the next step (see the image to the left).

2. In the Cylance console, update the "Migrated Custom Authentication Connector: Okta-Configuration Required" authenticator.

1. Sign in the to Cylance console.
2. On the menu bar, click Settings > Authentication.
3. Open Migrated Custom Authentication Connector: Okta- Configuration Required.
4. In the SP Entity ID field, verify that the value matches the value you recorded in the Audience URI (SP Entity ID) field in the Okta console. If it does not match, change the SP Entity ID field in the Cylance console to match the Audience URI (SP Entity ID) field in Okta.
5. (Optional) Change the Name of this Authenticator in the Cylance console. The name can be anything you deem appropriate. BlackBerry recommends that you at least remove the “Configuration Required” text from the name.

3. Create an authentication policy and assign it to users and groups.

Create a policy that includes the required authenticators for your environment. You can create a user policy or add the authenticator to the default authentication policies for the console, CylancePROTECT Mobile app or CylanceGATEWAY agent. Assign the policy to one administrator to verify the sign in policy is functioning as expected. You can then assign the authentication policy to your users.

In the image, the numbers correspond to the Step number in the procedure; not all steps are represented in the image.

1. On the menu bar, click Policies > User Policy.
2. Click the Authentication tab.
3. Click Add Policy.  
4. Enter a name and description for the policy (for example, Console Authentication Policy).
5. In the Authenticator rules section, click Add Authenticator. In the Add authenticator dialog box, select the “Migrated Custom Authentication Connector: Okta - Configuration Required” authenticator or find the name that you changed the Authenticator to in the last step (see image to the left).
6. Click Save.
7. To create the authentication policy, click Save.
8. Assign the policy to one administrator and then verify the sign in is working as expected. Complete the following steps: 

a. In the Assign the authentication policy dialog box, click Yes.

b. Click Add User or Group.

c. Start typing a name to search for the user that you want to add.

d. Select the user from the search results.

e. Click Add.

f. Log out of the console, or open an In Private window and access the Console log in page

g. Enter the email address of the administrator that you assigned the authentication policy to above and click Sign In.

h. When prompted, enter your credentials from Okta.

i. Complete the sign in with your Okta credentials and verify that the administrator can successfully sign in to the Cylance console.

For more information on additional authentication policy settings, see Create an authentication policy.

Important: Make sure that the Allow Password Login check box (Settings > Application > Custom Authentication) is selected. This option allows you to log in to the console directly and use SSO. If this option is not enabled before you test your SSO settings, users cannot sign in to the console using SSO. For more information on managing authentication policies, see Manage authentication polices for your tenant. 

Optionally, it is recommended that you create a user policy (User policy > Authentication) that requires only a Cylance console password and assign it to one or more designated administrators. You should use a strong password for the user policy. You can use this policy as a failsafe while you migrate Okta to an authenticator.   

That's it!

You have successfully configured an Okta SAML authenticator based on the existing custom authentication and assigned the authentication policy to users and groups. 

Users can now sign-in to the Cylance console using their Okta credentials from the sign-in page.

Next steps: Disable Custom Authentication.

After you have verified that you can sign in to the Cylance console from the primary login page using your Okta credentials, you can go to Settings > Application and clear the Custom Authentication check box.

Sign out and sign in to the Cylance console from the sign-in page using the administrator account with the new authentication policy that was applied in step 3 of this workflow and your Okta credentials.

Warning: Make sure that you sign in to the Cylance console from the primary sign-in page using you external IDP credentials. If you test the sign in from the “Or sign in with your External Identity Provider” page and then Disable Custom Authentication, you may become locked out of the console.

BlackBerry recommends you secure the Administrator account that you created with the password-only policy by assigning the Okta policy or changing the password-only policy to add an OTP code for better security.