Okta Configuration

• Prerequisites
• Creating Okta OIDC Application Client
• Creating API Authorization Server
• Setting up Refresh Token

Prerequisites

The following prerequisites are required to complete the integration:

• Running instance of Okta with users synced or created.

• Integrated user directory such as Active Directory.

Creating Okta OIDC Application Client

Perform the following steps to create OIDC application client for Okta:

1. Login to Okta Admin portal. Expand Applications and select Create App Integration.

   The Create a new app integration page is displayed.

   

2. Select OIDC - OpenID Connect and Native Application as Sign-in method and Application type, respectively, and click Next to create a new application.

3. Select this new application to edit the settings. The New Native App Integration page is displayed.

4. Enter the following details:

   1. Enter a name in App integration name and a logo if required.

   2. Select the Refresh Token check box as Grant type.

      For the OIDC method, the Authorization Code as Grant type is by default.

      

   3. Click + Add URI to add the required Redirect URL.
      URL structure: https://<server-host>/redirect
      For example: https://www.idpvserver.com/redirect
      URL structure: https://<server-host>/redirect
      For example: https://www.idpvserver.com/redirect
      Note: This URL is updated as per IDPV server host name.

      Both URLs are required in IDPV server.

      This URL is updated as per IDPV server host name.

   4. Select the desired option to assign the Controlled access, and click Save.

      

5. Select the application created above to edit the settings.

6. Under the General tab, Client ID is auto-generated.

   1. Select the Client secret check box as Client authentication.

   2. If required, click Generate new secret to generate a new client secret, and click Save.

      

7. Under the Assignments tab, click Assign to assign the application to the required Users or Groups.

   

8. Under the Okta API Scopes tab, click Grant/Revoke under Actions column to select/deselect the required scope.

   

Creating API Authorization Server

An authorization server is required to get the Access Token with the custom claims in it.

Perform the following steps to create an API authorization server:

1. Login to Okta Admin console. Expand Security, select the required API > Add Authorization Server.

2. Enter the values for the Name, Audience and Description fields, and click Save.

3. Select the added Authorization server then the following Authorization Server Settings page is displayed.

   

4. Under the Settings tab, the Metadata URI (well-known discovery URL) for this added server is displayed.

   1. Click the Metadata URI URL to see the well-known authorization server URLs.

5. Under the Scopes tab, click Add scope.

   1. Enter the name, select the Default scope check box and click Save.

   

   The User consent and Default scope fields are optional.

6. Under the Claims tab, add the following claims to the Access Token.

   • preferred_username

     1. Select Access Token in the Include in token type field.

     2. In the Value field, select the username to recognize the user and group membership for the IDPV server.

     3. Select the scope created above in the Include in field, and click Save.

     

   • Groups

     1. Select Access Token in the Include in token type field.

     2. Select the scope created above in the Include in field, and click Save.

        

7. Under the Access Policies tab, click Add new Access Policy.

   1. Enter a name and assign the policy to the client created initially.

   2. Click Update Policy.

      

   3. Click Add Rule.

      1. Enter a name and select the Authorization Code check box as a Grant Type.

      2. In the User is field, select the applicable check box, if required.

      3. In the Scopes requested field, select The following scopes: check box and include the required scopes (idpvserver containing claims preferred_username and groups, openid, offline_access).

         The email and profile scopes are optional.

      4. Enter the appropriate values in the Access token lifetime is and Refresh token lifetime is fields.

      5. Click Update rule.

         

The value entered here should match with the value of RefreshTokenExpirationDuration in idp-configuration.json.