05 Explain External Directories (Single Directory Integration)

Question 1

Demo 1A: Demonstrate knowledge of the Active Directory integration options with Okta

Answer 1

Incremental Imports

Question 2

Demo 1B: Demonstrate knowledge of the Active Directory integration options with Okta

Answer 2

Install and Configure the Okta Active Directory Agent

Question 3

Demo 1C: Demonstrate knowledge of the Active Directory integration options with Okta

Answer 3

Import Active Directory users

Question 4

Demo 1D: Demonstrate knowledge of the Active Directory integration options with Okta

Answer 4

End user account states

Question 5

Demo 1E: Demonstrate knowledge of the Active Directory integration options with Okta

Answer 5

Install and configure the Okta Active Directory agent

Question 6

Demo 1F: Demonstrate knowledge of the Active Directory integration options with Okta

Answer 6

Okta Essentials Module 3: Configure External Directories

Question 7

What primary tasks does the Okta AD agent do?

Answer 7

Authentication Provisioning

Question 8

What are the benefits of the Okta AD integration?

Answer 8

a. Enables you to integrate Okta with your on-prem AD services.
b. Provides delegated Authentication support, allowing users to sign in to Okta with their AD credentials.
c. Allows for provisioning and de-provisioning
d. The ability to import AD security groups

Question 9

What does the Okta AD integration enables you to do?

Answer 9

1. It allows you to integrate Okta with your on-premises AD service.
2. The integration also allows you to delegate AuthN support allowing users to sign in to Okta with their AD credentials.
3. Ability to do user provisioning and de-provisioning
4. The ability to import AD security groups.
5. Ability to apply security controls to directory-mastered users. Provision AD-mastered users into Okta.

Question 10

What exactly is an agent?

Answer 10

a. Windows Services

Question 11

All Agents maintain a continuously active connection back to Okta Cloud service?

Answer 11

True

Question 12

Okta recommends that you set up 2 or more AD agents for each domain?

Answer 12

True

Question 13

If you create the Okta Service account with the first AD agent, then you are prompted to enter your pw on the 2nd agent installation?

Answer 13

True/false

Question 14

Installing multiple agent in close geographical proximity to your users does not enhance performance

Answer 14

True

Question 15

When you have multiple agents installed, the system will automatically select the appropriate agent based on user location?

Answer 15

True

Question 16

Agents send periodic messages to the service. If the service does not receive a message for 60 seconds, it is marked as unavailable.

Answer 16

True

Question 17

The AD agent selects which domain controller to communicate with?

Answer 17

True

Question 18

What are the steps that a user takes to get authenticated through AD and Okta to cloud apps.

Answer 18

a. User logs into Okta using their AD username and password
b. AD agents. Looking for authN requests, one agent picks the requests up an sends it to the AD Domain Controller for authN. This is Delegated Athentication. Best Practice is to have at least 2 Okta AD agents running at all times. They use an Active/Active protocol so both agents are polling the Okta org looking for requests. There is automatic load balancing happening between the Agents, so no need for a load balancer. The agents use outbout port 443, which is https, so there is no need to change firewall settings. The agents can be install on any member server. c. The AD domain controller accepts the AuthN request from the Okta AD agent and Authenticates the user. It returns a token to the Okta AD agent with a “yes”. The user was successfully authenticated or a “no” the user was not successfully authenticated. d. The Okta AD agent returns the token to Okta. e. Authenticated. If the user was successfully authN, Okta displays the dashboard. If the user was not successfully authenticated, Okta returns SignOn failed to the user.

Question 19

What happens after the agent picks up a request for authentication?

Answer 19

It sends it to the Domain Controller for Authentication.

Question 20

What is delegated authentication?

Answer 20

a. An agents after picking up a request from Okta AD agent, sends it to the Domain Controller for authentication.

Question 21

What protocol does the AD agent do to poll Okta org?

Answer 21

AD agents use an active/active protocol so both agents are polling the Okta org looking for requests.

Question 22

There is no automatic load balancing so you have to set up load balancing

Answer 22

False. There is automatic load balancing so no need to set up load balancing

Question 23

What port does the agent use outbound to communicate?

Answer 23

a. Port 443, which is https, so no need to change firewall settings.

Question 24

What are the steps to installing and configure the Okta AD agent?

Answer 24

a. Go to domain installer and install the agent. (Best practice is not to install on main controller). b. Go to Okta Org to download the agent. i. ==> directory ==> integrations c. Click “Add Active Directory” ==> Active Directory d. See architecture slides e. Click “Setup Active Directory” f. Click “Download Agent” g. Save h. Run as Admin i. Install on default path j. Detects the AD domain k. Detects the entire tree structure and the domain. l. Ask to create a password m. Proxy or not n. Pick preview o. Enter subdomain. p. Enter ad.admin@oktaice / okta.com

Question 25

Why is it important to remember which local directory you installed your AD agent?

Answer 25

a. This is the default installation folder. The reason why this is important is because it does local logging so if you ever have a problem and you want to be able to look at the local logs you need to know where you installed it so it’s OK if you change it just remember where you changed it to.

Question 26

What is the server requirements for installing the Okta AD agent?

Answer 26

a. Windows Server 2008 R2 or later b. Don’t need to install the agent on the domain controller itself. c. Must be a member of the AD domain I.e. the agent host server must be a member of the same windows domain as your AD users. d. Consider the agent as part of your IT infrastructure I.e. It has to be on all the time. Must have a continuous connection e. Recommend browser installation. If not, transfer the agent installer to the agent host, then run the installer.