Skip to main contentSkip to search
Skip to main content

Okta Integration

Connect IronWiFi to Okta to let users authenticate to WiFi using their Okta credentials. This guide covers SAML setup for captive portals, user synchronization, and RADIUS integration for WPA-Enterprise networks.

Features​

  • SAML Single Sign-On - Enterprise SSO for captive portals
  • User Synchronization - Import users from Okta directory
  • Group Synchronization - Sync Okta groups to IronWiFi
  • RADIUS Authentication - WPA-Enterprise with Okta credentials

Prerequisites​

  • Okta administrator account
  • IronWiFi account
  • Okta plan that supports SAML (most plans)

SAML Single Sign-On (Captive Portal)​

Use Okta SAML for captive portal authentication.

Step 1: Get IronWiFi SAML URLs​

  1. Log into IronWiFi Console
  2. Navigate to Networks > Captive Portals
  3. Select your captive portal (or create one)
  4. Expand Authentication Providers
  5. Click Add Provider > SAML2 Single Sign-on
  6. Note these values (you'll need them for Okta):
    • Entity ID (e.g., 
      https://us-west1.ironwifi.com/api/signin/saml2
      )
    • ACS URL (e.g., 
      https://us-west1.ironwifi.com/api/signin/saml2?acs
      )

Region-specific URLs:

  • US West: 
    us-west1.ironwifi.com
  • Europe West: 
    europe-west2.ironwifi.com
  • Global/Default: 
    splash.ironwifi.com

Step 2: Create Okta Application​

  1. Log into Okta Admin Console
  2. Navigate to Applications > Applications
  3. Click Create App Integration
  4. Select SAML 2.0
  5. Click Next

Step 3: Configure General Settings​

  • App name: IronWiFi Captive Portal
  • App logo: Upload logo (optional)
  • Click Next

Step 4: Configure SAML Settings​

Enter these values:

FieldValue
Single sign-on URL
https://us-west1.ironwifi.com/api/signin/saml2?acs
(use your region)
Audience URI (SP Entity ID)
https://us-west1.ironwifi.com/api/signin/saml2
(use your region)
Default RelayStateLeave blank
Name ID formatEmailAddress
Application usernameEmail
Important

Change the base URL from the default to match your IronWiFi region:

  • us-west1
    for US West
  • europe-west2
    for Europe
  • splash
    for Global/Default

Step 5: Configure Attribute Statements​

Add these attribute statements:

NameName formatValue
emailUnspecifieduser.email
firstNameUnspecifieduser.firstName
lastNameUnspecifieduser.lastName

Click Next, then Finish.

Step 6: Get Okta SAML Metadata​

  1. In the application, click Sign On tab
  2. Scroll to SAML Signing Certificates
  3. Click Actions > View IdP metadata for the active certificate
  4. Copy or download the metadata XML

Alternatively, note these values manually:

  • Identity Provider SSO URL (e.g., 
    https://your-domain.okta.com/app/xxx/sso/saml
    )
  • Identity Provider Issuer (Entity ID)
  • X.509 Certificate - Download the certificate

Step 7: Configure IronWiFi​

  1. Return to IronWiFi Console > Captive Portals > your portal
  2. In the SAML2 provider you created, enter:
IronWiFi FieldOkta Value
SSO URLIdentity Provider SSO URL
IDP Entity IDIdentity Provider Issuer
CertificateX.509 Certificate content
NameID Format
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
  1. Click Save

Step 8: Assign Users in Okta​

  1. In Okta, go to the IronWiFi application
  2. Click Assignments tab
  3. Click Assign > Assign to People or Assign to Groups
  4. Select users or groups
  5. Click Done

Step 9: Configure Walled Garden​

Add these Okta domains to your access point's walled garden:

Replace 

your-domain
with your actual Okta subdomain.

Step 10: Test SAML Authentication​

  1. Connect to your WiFi network
  2. The captive portal should appear
  3. Click the Okta/SSO login button
  4. Enter Okta credentials
  5. Verify successful authentication and internet access

User Synchronization (Connector)​

Import users from Okta for RADIUS authentication or pre-provisioning.

Step 1: Generate Okta API Token​

  1. In Okta Admin Console, navigate to Security > API
  2. Click Tokens tab
  3. Click Create Token
  4. Name: "IronWiFi Connector"
  5. Click Create Token
  6. Copy the token immediately (it won't be shown again)

Step 2: Create IronWiFi Connector​

  1. In IronWiFi Console, navigate to Users > Connectors
  2. Click New Connector
  3. Select Okta
  4. Configure:
    • Name: Okta Directory
    • Domain: 
      your-domain.okta.com
      (your Okta domain)
    • API Token: Paste the token from Step 1
    • User Filter: 
      status eq "ACTIVE"
      (optional, syncs only active users)

Step 3: Select Groups to Sync​

  1. After saving, click Configure or Edit
  2. Select which Okta groups to import
  3. Configure sync options:
    • Auto-sync: Enable for scheduled sync
    • Sync interval: Hourly, daily, etc.
  4. Click Save

Step 4: Run Initial Sync​

  1. Click Sync Now
  2. Monitor progress
  3. Review imported users in Users section

Group Mapping​

Map Okta groups to IronWiFi groups for VLAN assignment and policies:

  1. In the connector, navigate to Group Mapping
  2. Add mapping rules:
    • Okta Group → IronWiFi Group
    • Example: "WiFi-Employees" → "Corporate VLAN"
  3. Enable Auto-create groups if needed
  4. Save and run sync

RADIUS Authentication​

For WPA-Enterprise using Okta credentials:

Option 1: Okta RADIUS Agent​

  1. Download Okta RADIUS Server Agent from Okta
  2. Install on a Windows server in your network
  3. In Okta, navigate to Security > Multifactor > RADIUS
  4. Configure the RADIUS application
  5. In IronWiFi, configure RADIUS proxy to your Okta RADIUS agent

Option 2: IronWiFi with Synced Users​

  1. Sync users from Okta to IronWiFi (see User Synchronization above)
  2. Configure authentication method:
    • Generated Passwords: IronWiFi creates unique passwords
    • Client Certificates: EAP-TLS with SCEP

Client Configuration​

Configure devices for WPA-Enterprise:

  • Security: WPA2-Enterprise
  • EAP Method: PEAP
  • Inner Authentication: MSCHAPv2
  • Identity: user@domain.com (Okta email)

Troubleshooting​

SAML Errors​

Invalid Signature:

  • Re-download certificate from Okta
  • Verify certificate hasn't expired
  • Check certificate format (PEM/X.509)

User Not Found:

  • Verify user is assigned to the app in Okta
  • Check NameID format is EmailAddress
  • Confirm attribute mapping includes email

SAML Response Error:

  • Verify Entity ID matches exactly
  • Check ACS URL uses correct region
  • Ensure Okta app is active

Sync Issues​

No Users Imported:

  • Verify API token is valid and not expired
  • Check token has read permissions
  • Test network connectivity to Okta

Partial Sync:

  • Review user filter settings
  • Check group selection
  • Verify users are active in Okta

Walled Garden Issues​

Okta Login Page Not Loading:

  • Verify all Okta domains are in walled garden
  • Check for typos in domain names
  • Add 
    *.oktacdn.com
    for static assets

Best Practices​

  1. Use groups - Manage access via Okta groups, not individual users
  2. Enable auto-sync - Keep users current with scheduled sync
  3. Monitor token expiration - Okta API tokens can expire
  4. Test with pilot group - Verify with small group before full rollout
  5. Document configuration - Record all settings for disaster recovery
  6. Use MFA - Enable Okta MFA for additional security
  7. Review logs - Monitor authentication logs for issues

Was this page helpful?