Configure Okta as an enterprise identity provider so that users can sign in to the IDaaS EIAM user portal through the OIDC protocol.
Step 1: Start binding
1. Go to your IDaaS EIAM instance. In the Identity Providers menu, click Other Identity Providers - OIDC IdP.
2. Enter a Display Name. You can select any Authentication Mode. Proof Key for Code Exchange (PKCE) is an optional security feature. Okta supports only SHA-256 for PKCE code challenge generation.
For Authorization mode, select Authorization code mode.
3. At the bottom of the form, copy the IDaaS Redirect URI. Okta sends authentication requests and ID tokens to this URI.
The redirect URI uses the format https://{instance identifier}.aliyunidaas.com/login/common/oauth2/callback. A prompt below the field reads, "You need to add this URI to your OIDC service."
Step 2: Create an Okta application
1. Log in to the admin console in Okta.
2. In the Applications menu, click Create App Integration.
3. For Sign-in method, select OIDC - OpenID Connect. For Application type, select Web Application.
4. Enter a name in the App integration name field.
5. In the Sign-in redirect URIs field, paste the IDaaS Redirect URI that you copied in Step 1.
6. In the Controlled access section, configure access permissions. For testing or when you have no specific access control requirements, select Allow everyone in your organization to access. If you select another option, grant access to specific users or groups.
7. Confirm your settings and click Save. You are automatically redirected to the application details page.
Step 3: Enter OIDC IdP information
1. On the Okta application details page, find the following information and enter it in the OIDC IdP configuration form in IDaaS EIAM.
-
Client ID: On the General tab in Okta, copy the Client ID and paste it into the corresponding field on the IDaaS EIAM form. If you enabled PKCE in Step 1, you must also select Require PKCE as additional verification in Okta.
-
Client Secret: Also on the General tab, copy the Client Secret and paste it into the corresponding field on the IDaaS EIAM form.
-
Issuer: On the Sign On tab, scroll down to the OpenID Connect ID Token section. Click Edit, change the Issuer to Okta URL, copy the URL, and then paste it into the Issuer field on the IDaaS EIAM form.
Okta also supports a Dynamic mode for the Issuer. To use this mode, you must find the Issuer URI from the Authorization Servers section of the Security > API menu. If you use a custom authorization server, you must add an access policy for the Okta application in the authorization server.
2. In the IDaaS EIAM form, click Parse next to the Issuer field to automatically populate the endpoint information.
3. After confirming the information, click Next to proceed to the scenario selection step. For configuration details, see Select scenario.
User sign-in flow
The following steps describe how an Okta user signs in to IDaaS EIAM.
1. When a user accesses the IDaaS EIAM user portal, the Okta sign-in option appears.
A third-party sign-in entry named okta test appears in the Other sign-in options area at the bottom of the sign-in page.
2. The user clicks the sign-in option and is redirected to Okta for authentication. If the user is not signed in to Okta, the Okta sign-in page appears. If already signed in, the user is redirected back to IDaaS EIAM.
On the Okta sign-in page, enter the Username and Password, and click Sign In.
3. If the Okta account is already bound to an IDaaS EIAM account, the user is signed in directly. If not, IDaaS EIAM first attempts automatic binding. If automatic binding fails, the user must manually bind the accounts, or IDaaS EIAM automatically creates a new account. For details about binding logic, see Select scenario.