Rationale​

Okta is the IAM platform we use for managing access to hundreds of applications used across our company. It allows us to give access to applications without disclosing credentials and maintaining a least privilege approach.

The main reasons why we chose it over other alternatives are:

1. It is SaaS, allowing us to forget about maintaining the infrastructure it relies on.
2. Being a SSO platform, talent only need to remember their Okta password. Everything else can be accessed once they're inside.
3. It provides a universal directory that allows us to have users, departments, applications and permissions in a single place.
4. It supports Multi-factor authentication by using OTP's that regenerate every thirty seconds and Push notifications through its Okta Verify app on both IOS and Android.
5. As Multi-factor authentication can be done on the user's phone, we do not need to manage independent security tokens.
6. Its Multi-factor authentication uses OOBA, a state of the art authentication process that uses two different communication channels, one for the application itself and a separate one for the verification method. Such process reduces the chances of identity theft, as both channels would need to be compromised by an attacker.
7. It enforces Biometric MFA for both face and fingerprint if the device supports it.
8. It supports serverless automatic provisioning, allowing us to keep other directories from services like Google Workspace and AWS IAM automatically synchronized without additional effort.
9. It supports SAML and OAuth, allowing us to give users access to applications without having to manage credentials.
10. It supports thousands of preconfigured integrations.
11. It provides in-depth reports and logging regarding security and overall user usage.
12. It provides a RADIUS agent for authenticating on external infrastructure like VPN's.
13. It allows strong password enforcement.
14. It can be managed using Terraform.

Alternatives​

1. OneLogin: We used it for three years. It did not support as many integrations. It's automatic provisioning was not as flexible.
2. Duo: It did not support as many integrations. It's automatic provisioning was not as flexible.
   
3. Authentik: It did not support as many integrations. It did not support automatic user provisioning to Google Workspace, which would force us to manually keep its directory synced with Google. It is not part of the Cloudflare ZTNA IAM list, which would force us to use a generic approach towards provisioning users.

Usage​

We use Okta for:

1. Managing apps, groups, users and permissions
   
2. Managing AWS roles with SAML
   

We do not use Okta for:

1. Managing users via universal directory: We are currently returning from JumpCloud.
   
2. Managing RADIUS: The Okta RADIUS Agent only supports PAP as authentication protocol, being the reason why we decided to look for other RADIUS providers once returning from JumpCloud is finished.