Question:

We are working on a project that requires device trust as a factor for MFA/SSO, but we are facing challenges with Linux devices. We use Okta as our primary identity provider, but Okta Verify does not support Linux and there is no indication that it will in the future. Our IT team is already overwhelmed, so they are not keen on maintaining a separate solution for Linux device trust. (Which is understandable!) > > We have explored some products that can perform device status checks and report trust levels (such as CrowdStrike, Kolide, etc.), but we are under the impression that without Okta Verify running on the device, there is no way to communicate that information to Okta during login attempts to verify device trust. > > How do you handle device trust verification for Linux devices? Are we overlooking something, or is there a better way to tackle this problem?

Answer:

How to Verify Device Trust for Linux Devices with Okta

Device trust is a crucial factor for enabling secure and seamless access to cloud applications and resources. It allows organizations to enforce granular policies based on the security posture of the device, such as requiring multi-factor authentication (MFA) or single sign-on (SSO) only for trusted devices.

Okta is a popular identity and access management (IAM) platform that provides device trust capabilities through its Okta Verify app. Okta Verify is a mobile app that acts as a second factor for authentication and also collects device attributes and signals to determine the device trust status. Okta Verify supports iOS, Android, Windows, and macOS devices, but not Linux devices.

This poses a challenge for organizations that use Linux devices and want to leverage device trust as a factor for MFA/SSO. How can they verify the trust status of Linux devices and communicate that information to Okta during login attempts?

There are two possible approaches to solve this problem:

One option is to use a third-party device trust solution that can perform device status checks and report trust levels for Linux devices, and also integrate with Okta to exchange device trust information. Some examples of such solutions are CrowdStrike, Kolide, Duo, and VMware Workspace ONE.

These solutions typically require installing an agent or a certificate on the Linux device, which then communicates with the device trust solution’s server to assess the device’s compliance with the organization’s policies. The device trust solution then sends the device trust status to Okta via an API or a webhook, which Okta can use to enforce access policies based on device trust.

The advantage of this approach is that it leverages existing device trust solutions that have robust features and support for Linux devices. The disadvantage is that it requires managing a separate solution for device trust, which may increase the complexity and cost of the IT infrastructure.

Approach 2: Use a custom script or a lambda function to verify device trust and send it to Okta

Another option is to use a custom script or a lambda function that can verify device trust for Linux devices and send it to Okta via an API or a webhook. This option requires more technical expertise and customization, but it may offer more flexibility and control over the device trust verification process.

The basic steps for this option are:

• Write a script or a lambda function that can run on the Linux device and collect device attributes and signals, such as OS version, patch level, firewall status, antivirus status, etc.
• Define the criteria for device trust based on the organization’s policies, such as requiring the latest OS updates, firewall enabled, antivirus installed, etc.
• Compare the device attributes and signals with the device trust criteria and determine the device trust status (trusted or untrusted).
• Send the device trust status to Okta via an API or a webhook, which Okta can use to enforce access policies based on device trust.

The advantage of this option is that it does not require using a third-party device trust solution, which may reduce the complexity and cost of the IT infrastructure. The disadvantage is that it requires more technical skills and effort to implement and maintain the custom script or lambda function.

Conclusion

Device

trust is an important factor for MFA/SSO, but it is not supported by Okta Verify for Linux devices. There are two possible approaches to verify device trust for Linux devices and communicate it to Okta: using a third-party device trust solution that integrates with Okta, or using a custom script or lambda function that verifies device trust and sends it to Okta. Both approaches have their pros and cons, and the choice depends on the organization’s preferences, resources, and requirements.