topic Re: Okta integration with HiveManager (SAML Link) in Aerohive Migrated Content

Okta integration with HiveManager (SAML Link)

support140 — Fri, 24 Jan 2020 18:48:00 GMT

Hello Team,

For a customer of ours, we want to implement HiveManager with Okta.

The question we really need answered before we ask to activate SAML in HiveManager and we create the SAML link: when you create the SAML link, will the whole HiveManager be accessed through Okta authentication immediately? Or is it possible to create an (test)SSID to test the integration with Okta?

The situation which we want to avoid, is that immediately everybody needs to authenticatie through Okta before we tested the integration with a test SSID

Re: Okta integration with HiveManager (SAML Link)

samantha_lynn — Fri, 24 Jan 2020 22:21:25 GMT

When users log in to ExtremeCloud IQ (ECIQ) with OKTA, they would be given the access that was set in their user records within ECIQ which you can check by going to Global Settings> Account Management. For instance, if someone is set up to only see certain organizations in the ECIQ, they would still be limited to only those organizations and configuration items when they log in with OKTA. Is that what you were asking?

Re: Okta integration with HiveManager (SAML Link)

support140 — Fri, 24 Jan 2020 22:34:42 GMT

Hello Sam,

As I don't know ECIQ, I cannot fully answer you question, but I can provide the current and desired situation.

Current:

User of the network, access via Aerohive AP250 access points and login with a WPA2 Key.

Desired:

Users of the network, use Okta to authenticate before accessing the network.

The challenge is that we cannot test with the real "live" SSID. Therefore the question: When enabling SAML based authentication via Okta, can this be enabled for only 1 SSID or will this automatically be enabled for all SSID's?

Re: Okta integration with HiveManager (SAML Link)

samantha_lynn — Sat, 25 Jan 2020 00:29:02 GMT

We don't have a way to connect users to the SSID via OKTA that I'm aware of, that option would only be to allow ExtremeCloud IQ administrators to login to ExtremeCloud IQ with OKTA.

Re: Okta integration with HiveManager (SAML Link)

support140 — Mon, 27 Jan 2020 16:14:58 GMT

Hello Sam,

Is there perhaps then documentation about how to connect Okta and Aerohive via SAML basically as also asked via https://thehivecommunity.aerohive.com/s/question/0D50c00006dXOir/can-we-integrate-hivemanager-for-samlbased-saml-20-sso-with-okta ?

Re: Okta integration with HiveManager (SAML Link)

samantha_lynn — Mon, 27 Jan 2020 21:08:40 GMT

We don't have any documentation related to an OKTA set up at the moment, but to enable SAML you would want to open a support ticket so we can get that enabled for your VIQ. I can open a courtesy case for you to request SAML be enabled if you can:

Send federated metadata to communityhelp@aerohive.com
Confirm that you have IDP-initiated SSO set up
Confirm there is an admin and sub admin that will use the SSO already set up in ExtremeCloud IQ as admins
Provide a point of contact who has access to the network we're working with, for us to work with in case we have questions
Provide your VIQ to communityhelp@aerohive.com as well. You can find this in Global Settings> VIQ Management

Re: Okta integration with HiveManager (SAML Link)

support140 — Mon, 27 Jan 2020 22:16:51 GMT

Hello Sam,

Thank you for your response. But perhaps to make it more easy: can Aerohive authenticate users using the LDAP protocol? Or is this not possible?

Re: Okta integration with HiveManager (SAML Link)

samantha_lynn — Mon, 27 Jan 2020 22:36:55 GMT

We can authenticate users to the SSIDs using LDAP, but to log in as admins using LDAP we'd still need SAML enabled for it.

Re: Okta integration with HiveManager (SAML Link)

support140 — Mon, 27 Jan 2020 23:09:40 GMT

What do you exactly mean with "but to log in as admin"? Can we exclude the admin from the LDAP directory or do you mean that we need an admin in the idp (in this case Okta) to communicate between the idp and Aerohive? Thanks!