Okta is a popular choice for organizations that want top-of-the-line cloud identity management. It’s one of the largest identity providers with a modern cloud directory and a plethora of handy features and useful integrations. Okta services can be combined with Multi-Factor Authentication (MFA) for VPN access, which has risen in popularity due to the Covid-19 pandemic.
In the quest to enhance cybersecurity and reduce end user friction, organizations are relying less on outdated passwords and credentials and moving towards more secure digital certificates. PIV-compatible smart cards offer a simple solution for both IT and users to safely access integrated applications.
Why Use Smart Cards for 802.1x Authentication?
“Smart card” is a term that refers specifically to the secure cryptoprocessor chip found in a variety of devices, such as:
- Credit / debit cards
- SIM cards
- Security keys (like Yubikey)
- Federal PIV and CAC cards
Smart cards can be used either as a primary authentication factor or to supplement another primary factor, enabling two factor authentication (2FA) or multifactor authentication (MFA).
How to Configure a Smart Card for Okta Authentication
Just about every smart card has the ability to store x.509 digital certificates for use in authentication. Digital certificates are a superior form of security because they rely on a private-public key pair to encrypt and decrypt authentication requests between the smart card and the client. It’s effectively immune to over-the-air attacks and also makes phishing attempts a waste of time as certificates can’t be transferred off of the card with SecureW2’s certificate solutions.
The digital certificate is the lynchpin of smart card authentication because it positively identifies the user or device and, since it has inherited trust from another trusted certificate authority, can be used to access any compatible web service.
Okta has a native smart card authentication feature, though at the time of publishing, you have to specifically request access because the feature is still in development. It is somewhat limited in that it can only use PIV-compliant smart cards for primary authentication. Other smart card devices, like the ubiquitous Yubikey, can currently only be used as supplementary MFA authenticators (despite the fact that they support PIV as well as the more typical U2F that security keys use).
Okta Smart Card Authentication with Yubikey
That presents a bit of a problem since the vast majority of organizations, the US federal government notwithstanding, tend to use smart cards in the form of security keys like the Yubikey instead of PIV or CAC cards. And, yes, they can still be used to enable MFA, but there’s no reason they shouldn’t be able to completely replace weak, antiquated passwords.
That was the guiding philosophy behind our design process when we engineered SecureW2’s smart card management solution (SCMS). In our capacity as an official Okta (and Yubico) partner, we have created the industry’s first passwordless authentication solution for Okta that uses Yubikeys.
Our solution allows you to not just integrate Yubikeys into your Okta cloud directory for use as primary authentication, but it allows you to configure and manage the security keys at scale. This is a huge boon since many smart cards lack a native graphical user interface or the capacity to be configured remotely, Yubikeys included. The default process requires you to manually configure each key via command line interface.
Our Yubikey solution allows you to deploy automatic configuration packages that can overwrite the preconfigured Yubikey certificate slots with your own certificates (signed by your own CA if desired) for authentication, attestation, and more. We also have a customizable onboarding process that guides the end user through the process of validating their existing Okta credentials to integrate their Yubikey with the directory and replace or augment them with a digital certificate.
Passwordless Okta Authentication with Yubikey
Frankly, the time for passwords is long-past. Nobody likes them, neither end users who have to change them every 9 weeks nor IT who has to deal with support tickets. They also haven’t been considered secure in years – one widespread authentication protocol literally sends passwords over the air in plain text.
The SecureW2 SCMS solution for Yubikeys can eliminate passwords, enhance the user experience, reduce the burden on IT, and vastly strengthen the security of your network in one fell swoop. If you have a PKI already in place, we can easily integrate without any forklift upgrades because all of our products are totally vendor-neutral.
If you don’t have the luxury of a PKI yet, our own Cloud PKI is among the top-rated in the industry. We can integrate your Okta directory so your users suffer no interruption in service and you can begin reaping the benefits of certificate-secured 802.1x authentication in a matter of days.
