ErinK.53801 (Customer) asked a question.
FastPass Enrollment/Device Registration - Keys and Cert Inquiry (Non-MDM Workflow)
We are enrolling users in FastPass and I am trying to obtain some basic information with no luck in Okta Docs. Key note - We are NOT including our MDM in the workflow at this time.
With that being said I am looking for:
- Cryptographic Key Pair: (a) When is the keypair created - Is it when the user enrolls in the desktop version of Okta Verify or somewhere else? (b) Without using an MDM solution, because I was told it differs, where are the keys (private and public) stored/managed?
- Device Certificate Generation: Without using MDM and without having it use Okta as a CA to push it's certificate to the device/laptop, when someone registers/enrolls in FastPass/Okta Verify Desktop application, does Okta push an Okta originated certificate to the device to use as another validation/attestation check or no? I have read it does not but Okta support has told us it does but we are unsure of where to find it, if we can, to confirm.
If anyone has links to show details I would appreciate that as well. These seem very basic but I cannot find documentation for when MDM is not involved.
Thank you.
Hi @ErinK.53801 (Customer) , Thank you for reaching out to the Okta Community!
The Okta FastPass Technical Whitepaper might help with this. From I'm seeing here:
"Key pairs are generated on the device, and public keys are sent to the
Okta service." and is created during the "add account" stage.
"...the private keys are stored in a device’s hardware key store if
available. Some examples of this include the Trusted Platform Module (TPM)
or Secure Enclave (iOS). The private keys never leave the hardware keystore
and cannot be backed up or exported to other devices. If the device does
not have a hardware key store, the private keys are stored in a software
key store."
That being said, I recommend going through the "download the whitepaper" form to make sure you have the latest version of the document, as I've seen older versions floating around the internet.
As for the certificates, as far as I've been able to confirm, they are only used to satisfy the "Managed" condition. Since you aren't using an MDM, your devices are only "Registered," and Okta uses Key Attestation instead of a certificate. Info implied from Management Attestation FAQ, rather than explicitly mentioned.
I recommend reaching out to your Okta Account Executive to discuss the matter. They'll be able to check with the internal team and give you a definitive answer on this.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Just released: More Okta Community badges just added