Resources
🤖 For AI agents: The complete documentation index is available at /docs/llms.txt. A markdown version of this page is available at /docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-oidc.md.

Add an OpenID Connect with Okta IdP

Edit on GitHub
View Markdown

Once you have completed this configuration, you may enable an OpenID Connect Login with Okta button for one or more FusionAuth applications. See Okta - Generic OpenID Connect as an additional reference.

Here's a diagram of the login flow between:

  • the user
  • your application
  • FusionAuth and
  • a remote identity provider
ProviderFusionAuthAppUser/BrowserProviderFusionAuthAppUser/BrowserUser Is Logged In And App Can ProceedDelivering Data And FunctionalityView Initial PageClick LoginDisplays Login PageIncluding Link To 'Login With Provider'Clicks On 'Login With Provider'Redirect To Provider Authorization URLEnters CredentialsValidate CredentialsRedirect to App With Authorization CodeRequests Page, Has Authorization CodeCalls Complete LoginWith Code And Redirect URIExchanges Code AndRedirect URI For Provider TokenReturns Provider TokenStores Provivider Token, Calls Lambda, Creates User And Registrations (If Needed), Generates FusionAuth TokensReturn FusionAuth TokensCreate Session OrOtherwise Log User In

Although this looks complex, the user only sees a few screens, such as the FusionAuth login screen, the provider login screen, and your application.

Prerequisites#

Okta Configuration#

Log in to Okta and navigate to the Admin panel.

Okta admin button.

Okta admin button.

Navigate to Applications -> Applications and click the Create App Integration button.

create app integration.

create app integration.

Select OIDC - OpenID Connect and Web Application then click Next .

OIDC and web application.

OIDC and web application.

Enter an App integration name and ensure that Authorization Code is checked. Then, supply a Sign-in redirect URI of the form <YOUR_FUSIONAUTH_URL>/oauth2/callback, where YOUR_FUSIONAUTH_URL is the URL of your FusionAuth instance. For example, https://local.fusionauth.io.

name and redirect URI.

name and redirect URI.

Under the Assignments section, select Skip group assignment for now. Hit Save .

skip group assignment.

skip group assignment.

Copy the Client Id and Secret into a text file for later use.

client id and secret.

client id and secret.

Under Sign On , navigate to the section OpenID Connect ID Token and change the Issuer to use the Okta URL. Hit Save and copy this URL into a text file.

issuer URL.

issuer URL.

Navigate to Directory -> People and click on the username of the user that you'd like to authenticate. Then click Assign Applications and hit the Assign button next to the one you created. Then click Save and Go Back and Done .

Configure a new FusionAuth OpenID Connect Identity Provider#

Although FusionAuth doesn't include an Okta identity provider, the OpenID Connect identity provider works as Okta supports the standard OpenID Connect protocols.

Navigate to your FusionAuth instance. Select Settings from the sidebar and then navigate to the section Identity Providers .

Select Add OpenID Connect from the Add dropdown at the top right of the page.

Create a new OpenID integration

Create a new OpenID integration

  • Provide a Name, like Okta.
  • Set Client Id to the Client ID recorded when creating the app integration on Okta.
  • Select HTTP Basic Authentication for the Client Authentication field.
  • Set the Client secret to the client secret recorded when creating the app integration on Okta.
  • Enable Discover endpoints.
  • Use the Okta URL that you recorded as the Issuer URL.
  • For the Scope, type in openid email.
  • Optionally, change the Button Text field to Login with Okta.

identity provider settings.

identity provider settings.

  • Navigate to the Applications section and ensure that the application you are adding Okta authentication to has the Enable identity provider and Create Registration switches toggled. Hit Save .

Testing the Login#

To test, navigate to the applications page in FusionAuth. Click on the View icon (magnifying glass) next to the application you enabled Okta login on and copy the OAuth IdP login URL address. Navigate to this address. You should see a Login with Okta button on your app's sign-in page:

result.

result.

Click the Login with Okta button. Test logging in with the username and password, as well as the 2FA method selected when configuring your account on Okta.

If it is all set up correctly, you should be redirected back to your app, successfully logged in. The user will be added to FusionAuth, and you can examine the Linked accounts section of the user details screen to see that the Okta OIDC link was created.