Enabling SAML Authentication(OKTA) for BigFix Inventory

Usage and Config BFI
1

I am trying to setup the single sign-on for our BigFix Inventory Server using SAML as the protocol(OKTA).

The app runs on port 9082, so I provided the following URL to our OKTA Administrator in order to create a new entry in OKTA for this.

https://hostname.com:9082/ibm/saml20/defaultSP

And I received from him the IdP SSO URL and the IdP Issuer URL, along with the cert file generated by OKTA.
I then followed the documentation in the BigFix Inventory Administrator’s guide

I created a single sing-on admin user and a local admin user. And Enabled the configuration. I restarted the server and after that every time I hit the BigFix Inventory URL, I land in an error page with the message:

Error 404: SAML20_AUTHENTICATION_FAIL

Has anyone properly configured SAML Authentication using OKTA for the BigFix Inventory Server?
I have done it for WebUI, the Console and Web Reports but the BFI server is not working.

This is the current configuration:

Screenshot 2023-11-30 100502
Screenshot 2023-11-30 100502987×258 18.6 KB

2

Hi @fermt, try to use the documentation that we have to configure BigFix Compliance with Okta as Inventory shares a very similar architecture and configuration:
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099139
-Gus

3

I will try that and report back

4

One suggestion - if you need further troubleshooting tools, I found SAML Tracer extension for browser to be excellent (available in Chrome, Edge, FF, etc) - it allows you to check the exact SAML Request sent to Okta and SAML Response sent back to BFI, so you can actually compare them and spot mismatches.

1 Like
5

Thanks for this useful tip!

6

Using the documentation for BigFix Compliance worked. Hopefully the HCL BigFix team creates a similar and updated document for BigFix Inventory as this will reduce the time it takes to properly setup the configuration.

2 Likes