<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008G7VMTSA3Okta Classic EngineAdministrationAnswered2018-09-05T01:28:35.000Z2016-10-26T19:47:16.000Z2018-03-16T08:37:41.000Z

Michael Mongeau (Customer) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:20 AM
Can you restrict the users can authenticate via RADIUS?
We are using a Microsoft Forefront TMG server as a RADIUS client to protect some internal web sites.  The audience for these web sites is a small subset of the valid users in Okta.  The current Okta RADIUS agent does not support group membership.  Is there any other way to restrict the users can authenticate via RADIUS, such as security policy?

 

Thanks,

 

 Michael

  • 2 answers
  • 854 views

  • Wils (Okta, Inc.)

    Hi Michael,

     

    You can restrict authentications to Okta via RADIUS in the Okta Sign On Policy (https://support.okta.com/help/articles/Knowledge_Article/99245886-Configuring-Sign-On-Policies). Note this is for getting a new Okta session, not logging into a specific app managed by Okta. If that fits your use case, you'll want to setup policies something like:

     

    1. Policy for Approved RADIUS users (assigned to "RADIUS Approved" group) a) Allow RADIUS rule IF User located ANYWHERE AND Authenticating via RADIUS

    THEN Allow access 2. Policy for Everyone else (assigned to "Everyone") a) Deny RADIUS rule IF User located ANYWHERE

    AND Authenticating via RADIUS

    THEN Deny access b) Other access rule IF User located ANYWHERE

    AND Authenticating via ANY mechanism

    THEN Allow access 

    In this way users in the "RADIUS Approved" group will be allowed to create an Okta session via RADIUS, while everyone else will not. The users in the "RADIUS Approved" group will fall through to the "Other access rule" when they are not logging in via RADIUS and be allowed, in this case. You could also require MFA, have more complex rules around network segments, and many more things with additional rules and policies.

     

    Hopefully that helps,

    Wils
    Expand Post

  • Michael Mongeau (Customer)

    This may work.  Only users in the "RADIUS Approved" group will be allowed to authenticate via RADIUS, and users in that group will also be allowed to authenticate normally to access other applications they may be granted.  I will do some testing of these policies in our preview org.

     

    Thanks,

     

     Michael
    Expand Post
This question is closed.
Loading
Can you restrict the users can authenticate via RADIUS?