Add a Smart Card Identity Provider in Okta

Updated on 11 Jul 2023
1 Minute to read

Print
Share
Dark
Light
PDF

Article summary

Did you find this summary helpful?

Thank you for your feedback

Open the Axiad Cloud welcome page for your tenant. Your URL looks like the following example, and is sent via email:
http://crl.{tenantName}.{platform}.axiadids.net/welcome.html
In the Resources section, click Root CA Certificate
The root.cer file downloads.
In the Resources section, click Issuing CA Certificate.
The issuing.cer file downloads.
Sign into your Okta admin portal.
From the left menu, click Settings > Features.
Locate the Smart Card Authenticator feature, and enable it.
TIP
This is a preview feature, but it is highly recommended that you enable it. This allows you to use/require smart cards (CBA) in authentication policies. It also allows smart cards to fulfill MFA requirements, including both Phishing resistant and Hardware protected requirements in authentication policies.
From the left menu, click Security > Identity Providers.
Click + Add identity provider.
Click Smart Card IdP:
WARNING
If Smart Card IdP is not available, contact Okta support and ask them to enable smart cards for your Okta tenant.
Click Next.
In the Name field, enter Axiad Cloud CBA.
Click Browse... next to the Upload certificate chain files.
Select the root.cer file you downloaded.
Click + Add Another.
Click Browse...
Select the issuing.cer file you downloaded.
Click Build certificate chain.
Optionally, change the Cache CRL for setting to match your requirements.
NOTE
This setting specifies the total amount of time Okta will consider the CRL valid after successful download. Okta will automatically attempt to download the latest CRL every hour in the background, but if the download fails for any reason you can still allow the cached CRL to be used for login attempts until it reaches the age specified here.

The default value is 6 hours.
In the IdP username field, select idpuser.subjectAltNameUpn.
In the Match against field, select Okta Username.
In the Security Characteristics field, ensure PIN protected and Hardware protected are both selected.
Confirm the settings are correct.
When finished with the entries, your screen should look like the following example:
Click Finish.
From the left menu, click Security > Authenticators.
Click Add authenticator.
Find Smart Card IdP and click Add.
In the Smart Card Identity Provider (IdP) field, click the text box to show a drop-down list, and select the Smart Card IdP created in the previous steps.
Click Add.
CBA authentication is now enabled. You can now configure your Okta Authentication policies to support/require Smart Card authentication.

TIP

To use CBA to sign into Okta, see Okta's official documentation: Sign in with a Smart Card/PIV as an end user (okta.com).

Was this article helpful?

What's Next

Okta Integration FAQs