0bzsa (0bzsa) asked a question.
So I got this somewhat to work. I can authenticate using the OKTA Radius and use MFA to successfully log into the device. However there is no way to pass the authorization piece needed because OKTA Radius APP only ALLOWs OKTA groups to come back in a response. To get this to work I locally assigned my username with a privilege level. This option would be annoying as you would have to put each individual locally on the switch to be able to configure the switch. The other option you have is to to no authorization NONE. Really if you are using the switch to just sign in and do MFA that would work. I find it silly that OKTA isnt looking into making the attribute cisco-av-pair = shell:priv-lvl=* not an optional response for the group as this could be a big marketing ploy for them. I got this work without OKTA support as they were not much help in this matter. Has anyone else been able to get this to work on a cisco switch/router. I am trying to figure out how to reference the group name coming back into giving that authorization with aaa.
Hello,
You can find a possible solution for your inquiry:
https://community.cisco.com/t5/network-access-control/routers-switch-to-ise-okta-for-mfa/td-p/4056987
If you want a more Okta related approach I suggested you open a case with support.
If by chance what you require is not possible, I will also suggest to make/find a feature request for implementing what you require.
Thanks.
Also, yes as per article https://help.okta.com/en/prod/Content/Topics/Security/Okta_Radius_App.htm when include groups in Radius response but it should be configured its action for these specific group in their appliance or application
Note: This means that if a user belongs to four groups, but you only list two of the four in this field, Okta will only pass the two groups to your RADIUS-enabled app. Likewise, if your user doesn’t belong to either of the two groups you listed in this field then Okta will not return any group for that specific user.
4.Configure the Response Format and Group Name Format you would like to use to pass this information along to your RADIUS application or infrastructure. Like the RADIUS attribute, this can vary depending on your setup and the specific vendor’s hardware. For help in configuring this setting, contact the vendor’s technical support team.