In Citrix Endpoint Management
In All products
Product documentation
In Citrix Endpoint Management
In All products
Citrix Endpoint Management
View PDF

Authentication with Okta through Citrix Cloud

Endpoint Management supports authentication with Okta credentials through Citrix Cloud. This authentication method is available to users enrolling through Citrix Secure Hub. Endpoint Management uses the Citrix Cloud service, Citrix identity, to federate with Okta. To enable Endpoint Management authentication with Okta through Citrix Cloud, contact your Citrix support representative.

Citrix recommends that you use the Citrix identity provider instead of a direct connection to Okta.

Endpoint Management supports authentication with Okta for the following platforms:

  • iOS devices
  • Android Enterprise devices (Preview), for BYOD and fully managed modes
  • Android devices that run in the legacy Device Administration mode

Authentication with Okta through Citrix Cloud has these limitations:

  • Isn’t available For Endpoint Management local accounts.
  • Doesn’t support authentication through Okta for enrollment invitations. If you send users an enrollment invitation containing an enrollment URL, users authenticate through LDAP instead of Okta.

Prerequisites for authentication with Okta

  • Okta user credentials
  • Citrix Cloud account, with Citrix Cloud Connector installed for directory services synchronization
  • Citrix Gateway. Citrix recommends that you enable certificate-based authentication for a full single sign-on experience. If you use LDAP authentication on the Citrix Gateway for MAM registration, end-users experience a dual authentication prompt during enrollment. For more information, see Client certificate or certificate plus domain authentication.
  • Secure Hub
  • In enrollment profiles for Android Enterprise, set Allow users to decline device management to Off. If users decline device management, they can’t enroll using an identity provider to authenticate. For more information, see Enrollment security.

The rest of this article describes how to configure this feature. The general steps are:

  1. Configure Citrix Cloud to use Okta as your identity provider
  2. Configure Citrix identity as the IdP type for Endpoint Management.

After that configuration, Secure Hub users who are domain-joined can use Secure Hub to sign on with their Okta credentials. Secure Hub uses client certificate authentication for MAM devices.

Configure Citrix Cloud to use Okta as your identity provider

To configure Okta in Citrix Cloud, see the Citrix Cloud article Connect Okta as an identity provider to Citrix Cloud. If Endpoint Management is Workspace enabled, this article also contains the steps for configuring Okta as the authentication method for Citrix Workspace.

Configure Citrix identity as the IdP type for Endpoint Management

After you configure Azure Active Directory in Citrix Cloud, configure Endpoint Management as follows.

  1. In the Endpoint Management console, go to Settings > Identity Provider (IdP) and then click Add.

  2. In the Identity Provider (IdP) page, configure the following:

    IdP configuration screen

    • IdP Name: Type a unique name to identify the IdP connection that you are creating.
    • IdP Type: Choose Citrix Identity Platform.
    • Authentication Domain: Choose the Citrix Cloud domain. If you aren’t sure which one to choose, your domain appears on the Citrix Cloud Identity and Access Management > Authentication page.

  3. Click Next. In the IdP Claims Usage page, configure the following:

    IdP configuration screen

    • User Identifier type: This field is set to userPrincipalName. Ensure that you configure all users with the same identifier in both your on-premises Active Directory and in Okta. Endpoint Management uses this identifier to map users on the identity provider with on-premises Active Directory users.
    • User Identifier string: This field is automatically filled.

Secure Hub authentication flow

With Endpoint Management configured to use Citrix identity as its IdP, the Secure Hub authentication flow is as follows for a device enrolled through Secure Hub:

  1. A user starts Secure Hub.
  2. Secure Hub passes the authentication request to Citrix identity, which passes the request to Azure Active Directory.
  3. The user types their user name and password.
  4. Azure Active Directory validates the user and sends a code to Citrix identity.
  5. Citrix identity sends the code to Secure Hub, which sends the code to the Endpoint Management server.
  6. Endpoint Management obtains an ID token by using the code and secret, and then validates the user information that’s in the ID token. Endpoint Management returns a session ID.
Authentication with Okta through Citrix Cloud

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings
© 1999- Citrix Systems, Inc. All rights reserved.