Views:
Configure assertion encryption to secure data transferred between Okta and Trend Cloud One.
Configuring SAML assertion encryption allows you to further secure the connection between Okta and Trend Cloud One by specifying the data encryption algorithm and the key transport algorithm.
Set up Okta with SAML first. For more information, see Okta setup guide.
Important
Important
Install OpenSSL before starting setting the SAML assertion encryption.
To set up SAML assertion encryption:

Procedure

  1. In Trend Cloud One Administration, go to Account Settings → Identity Providers
  2. Click Download Metadata XML for Trend Cloud One
  3. Download the metadata.xml file.
  4. Open metadata.xml with a text editor.
    Important
    Important
    Do not use a browser, as it may cause the CSR (Certificate Signing Request) format to be incorrect.
  5. Copy and save the CSR as saml_encryption.csr
  6. Open the command line interface.
  7. Generate the private key file: by running the following:
    openssl genpkey -algorithm RSA -out ca_private_key.pem
                        -pkeyopt
                        rsa_keygen_bits:2048
  8. Generate the certificate file:
    1. Enter the following command:
      openssl req -x509 -new -nodes -key ca_private_key.pem -sha256 -days 1024 -out ca_certificate.pem
      -days 1024 sets the validity period of the certificate to 1024 days.
    2. Provide the following information when prompted.
      • Country Name (2 Letter code) [AU]: US
      • State or Province Name (full name) [Some-State]: (leave blank)
      • Locality Name (for example, city) [ ]: (leave blank)
      • Organization Name (for example, company) [Internet Widggits Pty Ltd]: Trend Micro
      • Organizational Unit Name (for example, section) [ ]: (leave blank)
      • Common Name (erg. server FODN or YOUR name) [ ]: (leave blank)
      • Email Address [ ]: (leave blank)
  9. Generate the encryption certificate file by running the following:
    openssl x509 -req -in saml_encryption.csr -CA
                    ca_certificate.pem -CAkey ca_private_key.pem -CAcreateserial -out
                    certificate.crt -days 1024 -sha256
    where -days 1024 sets the validity period of the certificate to 1024 days.
  10. Configure the assertion encryption in Okta:
    1. Log in to your Okta organization as a user with administrative privileges.
    2. Go to Applications → Applications and in the ACTIVE section, select sso-beta.
    3. In the SAML Settings section of the sso-beta screen, click Edit.
    4. On the General tab of the Configure SAML screen, click Show Advanced Settings.
    5. Next to Assertion Encryption, select Encrypted.
    6. Next to Encryption Algorithm, select AES256-CBC
    7. Next to Key Transport Algorithm, select RSA-OAEP
    8. Next to Encryption Certificate, click Browse files... and elect the certificate.crt file you previously generated.
    9. Click Next.
    10. Click Finish.