I have written about setting up SSO using Okta to access Nile Portal and Wi-Fi access using SSO using Okta. With this setup I ran into a scenario with Two Factor Authentication, where Wireless users were having to go through the Two Factor Authentication as well since that was the default setting in Okta.

While this scenario works, it can be bit challenging for the wireless users trying to authenticate via SSO. I can disable it, but it will also disable the Two Factor Authentication when someone wants to access the Nile Portal as well. This can easily be fixed by creating a separate group for the wireless access.

Okta Configuration:

Directory/Groups:

Under Directory –> Groups, create a new Group and call it something like WLANAccess or Wi-FiAccess.

Next under the Group add the people that belong to this group and will be accessing the WLAN.

Under Applications, add the Nile app (Note: it worked without this step but I went ahead and added the app to keep it consistent).

Security/Authentication Policies:

My default policy under Authentication Policies is doing Two Factor Authentication. I created another policy for the Wireless Access.

First I added a new policy, call it something that will make sense. I named it WLANAccess

Open the policy and add the Nile App. NOTE: You can’t assign an app to two different Authentication Policies. So as soon as I assign the Nile App to this policy, it will remove it from the Default Policy and the Portal login will default to Two Factor Authentication any ways.

Under Rules, create a new rule to override the default Rule and use only the Password, do not use/choose Additional Factor Types.

Now when the Admins try to log into the Nile Portal, they will use the default policy and go through the Two Factor Authentication. All the users accessing Wi-Fi will only have to specify their username and password.

You can easily test this by forcing an existing connected user to go through the authentication process from the Nile Portal.

NOTE: I could have also simply updated my default policy and added a rule for WLANAccess, but I decided to separate it from the default rule. Some of the flow will depend on different organizational requirements. Different ways to configure this, but this shows a general process of splitting the authentication methods.

Feel free to leave your feedback, hope this will be helpful.