Integrate Okta to Extend Active Directory Infrastructure into AWS
AWS Architecture BlogIntegrate Okta to Extend Active Directory Infrastructure into AWSby Pavankumar Kasani and Xiaozang Li | on03 DEC 2021| inAmazon VPC,Architecture,AWS Direct Connect,AWS Directory Service,AWS Site-to-Site VPN,Intermediate (200)|Permalink|ShareAre you ready to extend your on-premises Active Directory toAmazon Web Services (AWS)to remove undifferentiated heavy lifting? Would you like to maintain a highly available Directory Service for your applications? Companies who have already set up integration with Okta Identity Cloud for external or internal applications require Active Directory objects to be synced to Okta for authentication. To achieve centralized access for on-premises and cloud applications, you can extend your on-premises Active Directory toAWS Managed Microsoft Active Directory (AD)using atrust relationship.This blog shows an architecture pattern that you can use to synchronize your on-premises AD and AWS Managed AD objects. You can use Okta Identity Cloud using an Okta AD agent for syncing users and groups. The Okta AD agent can be installed and configured on a domain-joined on-premises server or anAmazon EC2instance on AWS (see Figure 1).AWS Directory Service lets you run Microsoft Active Directory (AD) as a managed service, and is powered by Windows Server 2012 R2. When you select and launch this directory type, it is created as a highly available pair of domain controllers connected to yourAmazon Virtual Private Cloud (VPC). The domain controllers run in different Availability Zones in an AWS Region of your choice.Okta is an enterprise-grade identity management service, which is compatible with many on-premises and cloud applications. The Okta AD agent enables you to integrate Okta with your on-premises AD. This way you can integrate your SaaS applications and your AD instances with Okta. You can simplify and centralize user management and share user credentials with other integrated cloud and on-premises applications.Figure 1. Active Directory objects synchronization to Okta identity cloudNetwork connectivity between corporate data center and AWS RegionsBefore getting started with configuring a trust relationship with on-premises AD and AWS managed AD, be sure you’ve read and understand theprerequisites for setting up trust. For example, it is highly recommended to have a VPN orAWS Direct Connectcircuit in place between your VPC and your on-premises environment. To create a resilient VPN connection, refer to theSite-to-Site VPN User Guide.AWS Site-to-Site VPNis a fully managed service that uses IP security (IPsec) tunnels to create a secure connection between your data center or branch office, and your AWS resources. When using Site-to-Site VPN, you can connect to Amazon VPC and alsoAWS Transit Gateway. Two tunnels per connection are used for increased redundancy. You can also create a dedicated or a hosted connectionusing AWS Direct Connect.Trust relationship between on-premises AD and AWS Managed ADA trust relationship is a link between two different domains. For example, a one-way trust scenario allows the user accounts from thetrusteddomain to access resources in thetrustingdomain. In a two-way trust scenario, user accounts and resources can be passed between the two domains bidirectionally. A two-way trust relationship is commonly set up between on-premises AD and AWS Managed AD to extend authentication. This is used for any directory-aware workloads in the AWS Cloud, providing users and groups access to resources in either domain using single sign-on (SSO).AWS Managed Microsoft Active Directory (AD) supports external and foresttrust relationshipswith your existing on-premises domain in all three trust relationship directions:One-way incomingOne-way outgoingTwo-way bidirectionalTo create a trust relationship, follow these steps:Prepare your on-premises domainfor the trust relationship. This includes preparing your firewall configuration, enable Kerberos pre-authentication, and configuring conditional forwarders.Prepare your AWS Managed Microsoft ADfor the trust relationship. This includes configuring your VPC subnets, security groups, and enabling Kerberos pre-authentication.Create the trust relationshipbetween your on-premises AD and your AWS Managed Microsoft Active Directory (AD).Install and configure Okta agentDownload and install Okta AD agent on your Amazon EC2 instance, which should be domain-joined with AWS Managed AD. One Okta AD agent can associate with multiple domains. Once the trust has been set up between on-premises AD and AWS Managed AD, you can associate multiple domains under the same Okta AD agent on Amazon EC2, instead of hosting and managing separate Okta AD agent servers in your own data center and AWS.For a highly available architecture, a redundant Okta AD agent running in your corporate data center is recommended. This will help you avoid the impact of network connectivity failure between data centers and AWS Regions. Okta recommendsinstalling multiple Okta AD agentson each domain server to achieve high availability and failover protection.ReadOkta AD integrationstep-by-step setup for installing and configuring Okta agent.Validate AD objectsOnce the Okta agent is installed and configured on the Amazon EC2 instance, log in to the Okta admin console. Under theprovisioningto Okta tab, do a full import of users from AWS Managed AD (see Figure 2, Figure 3). The subsequent objects synchronization will be done through scheduled import with a minimum interval of one hour. After the import is done, if there are any user account overlaps between AWS Managed AD and Okta, manually assign the AD users to Okta users. You can create matching rules to automatically map the users from AD to Okta. ReadImport AD users to Okta.Figure 2. Import users under Okta admin consoleFigure 3. Import users results under Okta admin consoleMatching rules are used in the import of users from all apps and directories that provide importing. If there is an existing Okta account, AD allows you to import and confirm users automatically (see Figure 4).Figure 4. User creation and matching under Okta admin consoleYou can import groups from any forest or domain connected to Okta. The Okta AD Agent detects all groups in the domain or the organizational units (OUs) that you select. If you register an Okta AD Agent for more than one domain and you have the root OU selected for all domains, all groups will be imported. ReadImport AD Groups to Oktato synchronize groups from AD to Okta.Synchronize passwords to OktaWhen you sign in to Okta using your organization’s AD credentials, the authentication process is delegated to the connected on-premises AD. Okta does not see or store the credentials.In some cases, the credentials must be synchronized from a directory across Okta to an application. If a user changes the password stored in Active Directory and then tries to access applications using the same single sign-on session, they will receive a password error message. This is because the new password has not been synchronized to the application, so a new sign-in process is required for password validation.To avoid a disruptive user experience, use the Okta AD Password Sync Agent to synchronize passwords from AD to Okta and to integrated apps. The Okta AD Password Sync Agent will track password changes in AD and then synchronize to Okta.For more details on the password synchronization and password reset workflow, you can read step-by-step instructions onSynchronize passwords from Active Directory to Okta.SummaryIn this blog post, we discussed a way for synchronizing users and credentials from on-premises Active Directory and AWS Managed AD to Okta Identity Cloud. With synchronization, you can centralize access of cloud and on-premises applications and provide seamless access to AD-aware services within AWS.Customers can also migrate on-premises AD to AWS using Active Directory Migration Tool (ADMT) along with the Password Export Server (PES) service.Read more:Migrate your on-premises domain to AWS Managed AD using ADMTThree Ways to Modernize IdentityTAGS:OktaPavankumar KasaniPavankumar Kasani is an AWS Solutions Architect based out of New York city. He is passionate about helping customers to design scalable, well-architected and modernized solutions on the AWS Cloud. Outside of work, he loves spending time with his family, playing cricket, table tennis, and also testing out new recipes in the kitchen.Xiaozang LiXiaozang Li is a Solutions Architect at Amazon Web Services (AWS), where he is obsessed with helping enterprise customers kick off their cloud journey to achieve agility, elasticity, and faster innovation. Prior to AWS, Xiaozang worked in the content delivery network (CDN) space, helping companies deliver web and streaming content in a fast, reliable, and secure way. Xiaozang lives in Boston and spends his wintertime snowboarding and skiing in the mountains.
Are you ready to extend your on-premises Active Directory to Amazon Web Services (AWS) to remove undifferentiated heavy lifting? Would you like to maintain a highly available Directory Service for your applications? Companies who have already set up integration with Okta Identity Cloud for external or internal applications require Active Directory objects to be synced […]
Pavankumar Kasani
Amazon VPC Architecture AWS Direct Connect AWS Directory Service AWS Site-to-Site VPN Intermediate (200)