Tenable Security Center: Okta IdP

One of the most common IdPs used to configure SAML with Tenable Security Center is Okta. The following steps guide you through the configuration process from start to finish.

Manual configuration requires the following:

  • Login URL: A custom URL in the following format:

    https://PLACEHOLDER/saml/module.php/saml/sp/saml2-acs.php/1

    Where PLACEHOLDER is the IP address or hostname for your Tenable Security Center instance.

  • Audience URI (SP Entity ID): A custom ID in the following format:

    https://tenable.sc

  • A certificate within the SAML metadata object that matches the data originally sent to Tenable.

    Note: Tenable does not support the use of multiple certificates and only extracts the first certificate from the metadata object. If the object includes multiple certificates, you must specify which certificate to use if it is not the first one listed.

Okta: Create Initial Application Integration

To create an application integration in Okta:

  1. In your browser, navigate to the Okta Admin portal.

  2. In the left navigation menu, click Applications > Applications.

  3. Click Create App Integration.

    The Create a new app integration window appears.

  4. Select the SAML 2.0 radio button.

  5. Click Next.

    The General Settings options appear.

  6. In the App name text box, type a name for your application.

  7. (Optional) To add a custom logo for the application, in the App logo section, upload a .png, .jpeg, or .gif file and click Apply.

  8. Click Next.

    The Configure SAML options appear.

  9. In the Single sign-on URL text box, type the following URL:

    https://PLACEHOLDER/saml/module.php/saml/sp/saml2-acs.php/1

    Where PLACEHOLDER is the IP address or hostname for your Tenable Security Center instance.

  10. Select the Use this for Recipient URL and Destination URL checkbox.

  11. In the Audience URI (SP Identity ID) text box, type the following placeholder text:

    https://tenable.sc

  12. Ensure the Default RelayState text box is blank.

  13. In the Name ID format drop-down, select Unspecified.

  14. In the Application username drop-down, select Email.

  15. In the Update application username on drop-down, select Create and update.

  16. Do not change any other configuration options.

  17. Click Next.

    The Feedback options appear.

  18. (Optional) Provide any feedback you want to include.

  19. Click Finish.

    Okta saves your application configuration.

  20. In the applications list, select the newly added application configuration.

    Application details appear.

  21. In the Actions drop-down menu, click View IdP Metadata.

    Okta redirects you to another page, where you can view the metadata file.

  22. In your browser, save the resulting file as metadata.xml.

    Your browser downloads the metadata.xml file.

Enable Tenable Security Center SAML

Once you have downloaded your medata.xml file, you can use it to configure SAML in Tenable Security Center. You can configure this directly in the Tenable Security Center application.

To set up the Tenable Security Center SAML configuration:

  1. In your browser, navigate to Tenable Security Center.

  2. In the left navigation, click System > Configuration.

    The Configuration page appears.

  3. Click the SAML button.

    The SAML Configuration page appears.

  4. In the General section, confirm the SAML toggle is enabled.

  5. In the Source drop-down box, select Import.

    The page updates to display additional options.

  6. In the Type drop-down box, select SAML 2.0.

  7. Click Choose File and browse to the SAML metadata file from your identity provider.

    Note: The metadata file must match the Type you selected. If Tenable Security Center rejects the file, contact your identity provider for assistance.

  8. Click Submit.

    Tenable Security Center saves your configuration.

  9. For the configuration you just created, click Download SAML Configuration XML.

    Your browser downloads the metadata.xml file. You can now use this file for final configuration in your IdP.

Okta: Configure Final Application Integration and Upload Metadata

Now that you have downloaded the completed metadata file, you can use that file to create a permanent Tenable application in Okta.

  1. In your browser, navigate to the Okta Admin portal.

  2. In the left navigation menu, click Applications > Applications.

    The Applications page appears.

  3. Click Browse App Catalog.

  4. Select the application you previously created.

  5. In the SAML Settings section, click Edit.

    The Edit SAML Integration window appears.

  6. Click Next.

    The Configure SAML options appear.

  7. In the Single sign-on URL text box, type the URL listed in the metadata.xml file that you downloaded from Tenable Security Center.

    Tip: This URL is in the following format: https://PLACEHOLDER/saml/module.php/saml/sp/saml2-acs.php/1

  8. In the Audience URI (SP Identity ID) text box, type ID listed in the metadata.xml file that you downloaded from Tenable Security Center.

    Tip: This ID is in the following format: https://tenable.sc

  9. Click Save.

    Okta saves your changes to the application.

Assign the Okta Application to your Users

To assign the application to your users or groups:

  1. In the left navigation menu, click Applications > Applications.

  2. Next to your newly created application configuration, click the button.

  3. Assign the application to one or more users or groups:

    • Click Assign to Users.

    • Click Assign to Groups.

    An Assign window appears.

  4. Next to the user or group to which you want to assign the application, click Assign.

    A confirmation window appears.

  5. Click Save and Go Back.

  6. Repeat for each user or group to which you want to assign the application.

  7. Click Done.

    Okta saves your changes, and you can now configure the final piece of the SAML configuration within Tenable Security Center.

Finalize the Tenable Security Center SAML Configuration

Once you've set up your application within your IdP, you can finalize your SAML configuration via the Tenable Security Center interface.

To finalize the Tenable Security Center SAML configuration:

  1. Log in to Tenable Security Center via the user interface. 

    Note: You must log in with a user account belonging to the organization where you want to create a new user.

  2. Click Users > Users.

    The Users page appears.

  3. Click Add.

    The Add User page appears.

  4. (Optional) Type a First Name and Last Name for the user.

  5. In the Type drop-down list, select SAML.

  6. In the Username box, type the user's SAML username exactly as it appears in the IdP user configuration that you created for the user.

  7. Select a Time Zone.

  8. (Optional) Select a Scan Result Default Timeframe.

  9. (Optional) Enable Cached Fetching.

  10. Select a Role. For more information, see User Roles in the Tenable Security Center User Guide.

  11. Select a Group. For more information, see Organizations and Groups in the Tenable Security Center User Guide.

  12. (Optional) To customize the user's object and user account management permissions, modify the Group Permissions. For more information, see Custom Group Permissions in the Tenable Security Center User Guide.

  13. (Optional) To share an asset list with the user, select an Asset. For more information, see Assets in the Tenable Security Center User Guide.

  14. (Optional) Type Contact Information for the user.

  15. Click Submit.

    Tenable Security Center saves your changes, and your SAML configuration is ready for use.

Additional Resources

For more information on Okta IdP configuration, see the following resources: