Okta Device TrustConnector Integration withChrome Setup GuideOctober 2023

Table of Contents
Device Trust Connector Overview

03

Set-up04

Request service account and URL from Okta

04

Enabling Device Trust Connector in the Google Admin console05

Add Chrome Device Trust Connector in Okta Admin console

06

Verify that test device is configured correctly

07

FAQ

08

Additional Resources09

Device Trust Connector Overview

The Device Trust Connector is an integration

This document outlines the steps to follow to enable

between Chrome and a 3rd party IdP that provides

and use the Chrome Device Trust Connector in Okta.

attestation of the device identity and enables
access to context aware signals.
Okta can use the signals to implement Context
Aware Access (CAA) for use in Zero Trustarchitectures. Encrypted signals are delivered toOkta via a real-time HTTP header flow.

Note: This integration requires OIE (Okta IdentityEngine) Adaptive SSO or Adaptive MFA.

Set-up
Enable the Chrome Device
Trust connector in the Okta console

In order to setup up the connection from Chrome to Okta, a service account will need to be created foryou. Navigate to Security > Device Integrations and select Add endpoint integration.
1

Select Chrome Device Trust and the OS platforms for which you wish to enable the integration.

2

Copy the values in the URL patterns and Service account fields on the integration page. These values
are unique to your tenant and will be used to link Okta to your Google Admin console.

Enabling Device TrustConnector in the Google Admin console

1

Go to the Google Admin console.

2

Go to Devices > Chrome > Connectors.

3(If applicable) Accept the license agreement for using Connectors.

4

Hit the + New Provider Configuration button.

5

Choose the Okta device trust connector provider and click Set Up.

6

Provide a unique name for your configuration under “configuration name”.

7

Input the URL and service account information provided by your Okta contact.

8

Hit Add Configuration.

9

Now you can apply this provider configuration to your desired organizational unit.
aChoose your desired organizational unit on the tree UI widget to the left.

bScroll down to “Device trust connectors”, use the radio buttons in this section toapply the appropriate configuration.

cHit Save.

Add Chrome Device TrustConnector in Okta Admin console

12Create a Device Assurance policy for ChromeOS
aNavigate to Security > Device Assurance Policies and select Add a policy. Select ChromeOS.

b

Configure the device attributes in the policy editor and hit save.

Create a Device Assurance policy for Managed Chrome Browser on Windows/macOSaNavigate to Security > Device Assurance Policies and select Add a policy. Select Windows ormacOS.
b

Select Google as your Device attribute provider
iNote: If you select both Okta and Google as your providers, for any signals that overlap
between the providers ( e.g. OS version ), the source of truth will be Okta.

c3Configure the device attributes in the policy editor and hit save.

Add device assurance to an authentication policyaIn the Admin console, go to Security > Device Assurance Policies.

b

Select a policy and click Add Rule to add a new rule for device assurance. To add device
assurance to an existing policy rule, select the policy rule you want to modify, and then click Edit.

cFor AND Device assurance policy is, select Any of the following device assurance conditions,and then enter the name of a device assurance you have previously created.
i

You can add multiple platform-specific device assurance policies.

ii

If you add multiple sets of device assurance attributes to the same rule, they’re OR conditions.

iii

If the rule has other conditions, all of the conditions defined for the rule must be met for therule to be applied.

dSpecify any additional conditions and what should be done if the conditions are met.

e

Click Create Rule or Save to save your changes.

Verify scenario

1

Assign the Okta authentication policy you just edited to an application, or confirm that it’s alreadyassigned to an app you can test.

2

Log in to the application.

3Confirm in Okta system logs that Chrome Device Trust signals are in the recent access attempt.
Ensure the CHROME_DTC appears as a Device Integrator object in the authentication success event
created for your test access.

FAQ
How are managed browsers trusted?
The Chrome servers establish trust with managed browsers based on the Trust On First Usemechanism. When it detects that the Device Trust connector is enabled, a managed browser
will create an asymmetric key pair and upload the public key to be stored along with thebrowser’s record in the Google Admin console. That public key will subsequently be used tovalidate signatures and establish trust with regards to the origin of a payload.

Some Notes on Keys
Keys are only used on Windows and Mac. The ChromeOS
integration instead establishes trust using enterprisecertificates stored on managed devices.
The "Clear key" operation can be useful for admins who aretrying to unblock their users who, somehow, managed to lose
their initial key.

8Customer Setup Steps for Device Trust Connector

FAQ
How can I clear a trusted key?
Admins with access to the Google Admin console can clear a trusted public key for a specificbrowser. This troubleshooting step can prove useful if a user is experiencing access issues
which have the symptoms of a managed browser no longer having access to the trusted keypair.
The “Clear Key” action will simply delete the public key stored on the server for thecorresponding browser. This will allow the user to restart the browser and have it upload its
current public key to establish trust once again.

Key Revocation
WindowsMacCrOS (N/A)

Clearing a Trusted Key
To clear a key visit Cloud Browser Cloud Management and follow the steps:
1

Go to Devices > Chrome > Managed browsers.

2

Select the Organizational Unit where the browser(s) is located.

3

Select the browser with the key to be cleared.

4

Underneath the Managed Browser details box on the left hand side click Configure Key.

5

Select CLEAR KEY.

If the Configure Key is not clickable it is most likely because the key does not existon the server.
9Customer Setup Steps for Device Trust Connector

FAQ
How do I unenroll a device?
To unenroll a managed device from Chrome Browser Cloud Management navigate
to this page for more information. To unenroll a Chrome OS device follow these steps.

What
Whatplatforms
platformsisisDevice
DeviceTrust
TrustConnecter
Connectorsupported
supportedon?
on?
Windows

ChromeOS*Mac*Currently not available on ChromeOS Flex

Additional Resources
Chrome Browser Cloud Management

Chrome Device Management

Learn More at Chrome Enterprise Help Center

Learn More at Okta Help Center10 Customer Setup Steps for Device Trust Connector