Okta.md

Openid Connect with Okta

Okta is an external identity provider service. It can be used to authenticate and authorize users and more. In the OidcWebExample Okta is used as an Openid Connect Provider to signin/signout the user and retrieve an access token with which the smart-me API can be accessed.

How to setup Openid Connect in Okta

1. Create a developer account here and login to the developer console.

2. Add some users under Users/People. These users also have to exist in the smart-me cloud. Specifically the username (e-mail address) has to match.

3. Add an application under Applications.

   1. Select Web for the OidcWebExample

   2. Use the following settings:

      • Name: My Web App
      • Base URIs: http://localhost:5000/
      • Login redirect URIs: http://localhost:5000/authorization-code/callback
      • Group assignments: Everyone
      • Grant type allowed: Check Authorzation Code and Implicit (Hybrid)

      

   3. The general settings of your application should look like the screenshot below now. Copy Client ID and Client secret and put them into the Oidc section in appsettings.json.

      

   4. Add your users in the Assignments tab.

4. The smart-me API expects the claim preferred_username which must be the e-mail address of the user. Okta does not provide this claim by default. Go to API/Authorization Servers and edit the default authorization server.

   1. From the Settings tab copy the Issuer and put it as Authority into the Oidc section in appsettings.json.

      

   2. In the Claims tab add a new claim. Use the following settings:

      • Name: preferred_username
      • Include in token type: Access Token
      • Value type: Expression
      • Value: (appuser != null) ? appuser.userName : app.clientId

      The claim should look like this now: