--- updatedAt: 2026-05-14T16:47:48.000Z --- # Okta This guide illustrates how to configure IBM Application Gateway (IAG) as an OIDC relying party for Okta. This guide was written in October 2023.The following steps can change if a third-party provider modifies their administrative interfaces. ### Pre-requisites 1. Review the [Third-Party Providers](https://docs.verify.ibm.com/verify/docs/flow-designer-iag-with-thirdparty-identity-providers) documentation for high-level information about using IAG with third-party identity providers. 2. An active Okta subscription. A free trial subscription can be used. #### Reference Resources The following Okta documentation was used to prepare these configuration instructions: * [Creating OIDC app integrations](https://help.okta.com/oie/en-us/content/topics/apps/apps_app_integration_wizard_oidc.htm) * [OpenID Connect and OAuth 2.0 API reference](https://developer.okta.com/docs/reference/api/oidc/) ### Configuration #### Okta Configuration Steps From your Okta administration console, browse to **Applications > Applications**, and click **Create App Integration**. [block:image] { "images": [ { "image": [ "https://files.readme.io/6d0187635634a5cc2910cd408986717a41e0a04e6a1d7f41e50f92f5a334fc3b-okta-applications.png", "6d0187635634a5cc2910cd408986717a41e0a04e6a1d7f41e50f92f5a334fc3b-okta-applications.png", 602, 309, "#e8e9ef", null, "69df9efba0f6df02f17221c1" ] } ] } [/block] Select the **OIDC - OpenID Connect** for the **Sign-in method**, and **Web Application** for the **Application Type**. Click **Next** to continue. [block:image] { "images": [ { "image": [ "https://files.readme.io/e3f771f1f506d5950a22ed261954c1786a0f96e240723df7165069d4716233dc-okta-integrations.png", "e3f771f1f506d5950a22ed261954c1786a0f96e240723df7165069d4716233dc-okta-integrations.png", 602, 591, "#cfcccc", null, "69df9efc2e567807bfff9fab" ] } ] } [/block] Complete the **App integration name**, **Sign-in redirect URIs** and **Sign-out redirect URIs**. The **Sign-in redirect URIs** is of the format `https:///pkmsoidc`. The **Sign-out redirect URIs** is of the format `https:///pkmslogout`. [block:image] { "images": [ { "image": [ "https://files.readme.io/9ba210884c94db2522353aabfddc3e32e2439a2f6062ee1f8d6efa483815c46a-okta-integrations-2.png", "9ba210884c94db2522353aabfddc3e32e2439a2f6062ee1f8d6efa483815c46a-okta-integrations-2.png", 484, 429, "#dad9df", null, "69df9efc28d6421a38fde337" ] } ] } [/block] In this example scenario, the application is made immediately available to everyone. This can be customized for selective access based on the application and access policy requirements. To make the application available immediately, select **Allow everyone in your organization to access** for **Controlled access**, and check **Enable immediate access with Federation Broker Mode**. Click **Save** to continue. [block:image] { "images": [ { "image": [ "https://files.readme.io/121d6788843f84b8291e12c7618e2c5b678275a3ed3d3a8a3d7db7910f220fb2-okta-integrations-3.png", "121d6788843f84b8291e12c7618e2c5b678275a3ed3d3a8a3d7db7910f220fb2-okta-integrations-3.png", 481, 428, "#ddd9de", null, "69df9efd3c068111295b6ec1" ] } ] } [/block] On the **General** tab, note the **Client ID** and **Client Secret** values. In IAG, the **Client ID** is used in the `client_id` field, and the **Client Secret** is used in the `client_secret` field. The generated **Client ID** and **Client Secret** values in this example are: * client\_id `0oa8ldmj86g1UNN7R6970` * client\_secret `8ygoS3O5dkR9iw7ZQ4fgGITNQWo5AiFtWGFEaP06FAns4ku1G-qdoMzUDvzZseRb` [block:image] { "images": [ { "image": [ "https://files.readme.io/9af45784deb205d5bbdc4db6ed3f34690960f515b70f55e5576162e7ab2b16dc-okta-clientid.png", "9af45784deb205d5bbdc4db6ed3f34690960f515b70f55e5576162e7ab2b16dc-okta-clientid.png", 382, 426, "#e4e3e5", null, "69df9efd2e567807bfff9fbc" ] } ] } [/block] By default, Okta prompts users for consent to share single sign-on information between the IDP and the application the first time they sign in. In scenarios where the owner of the IAG instance and application is also the owner of the IDP, the consent step can be superfluous. To disable the consent step, browsing to the **General Settings** header and click **Edit**. Clear the **Require consent** checkbox and click **Save**. [block:image] { "images": [ { "image": [ "https://files.readme.io/e517d5c6473dcd379da2348dc0d71b11bcd40695402c4d861069f877952bfc09-okta-consent.png", "e517d5c6473dcd379da2348dc0d71b11bcd40695402c4d861069f877952bfc09-okta-consent.png", 388, 431, "#ddd9da", null, "69df9efe2e567807bfff9fc0" ] } ] } [/block] The Okta OIDC metadata URL is documented in [OpenID Connect and OAuth 2.0 API reference](https://developer.okta.com/docs/reference/api/oidc/). The format of the OIDC metadata URL is `https:///.well-known/openid-configuration`. In this example scenario, the complete OIDC metadata URL is `https://trial-3008338-admin.okta.com/.well-known/openid-configuration`. #### IAG Configuration Steps Use the values retrieved in the previous steps to complete the IAG configuration. The sample configuration contains enough information to allow IAG to perform single sign-on with Okta. ```yaml identity: oidc: discovery_endpoint: "https://trial-3008338-admin.okta.com/.well-known/openid-configuration" client_id: "0oa8ldmj86g1UNN7R697" client_secret: "8ygoS3O5dkR9iw7ZQ4fgGITNQWo5AiFtWGFEaP06FAns4ku1G-qdoMzUDvzZseRb" scopes: - "profile" - "email" ``` ### Testing the Okta Integration To test the configuration: 1. Browse to the IAG credential viewer application. For more information, see [Common IAG Configuration](https://www.ibm.com/docs/en/security-verify?topic=integrations-application-gateway) for information about this URL. In this example, the URL is `https://www.mysp.ibm.com:8443/ivcreds`. [block:image] { "images": [ { "image": [ "https://files.readme.io/bf6005432e80a37a4c33584dcf8cb902183731fb6f97c38821a618a411988bd2-okta-results-1.png", "bf6005432e80a37a4c33584dcf8cb902183731fb6f97c38821a618a411988bd2-okta-results-1.png", 972, 276, "#e0e0e1", null, "69df9efe9c3c8e4abfe44478" ] } ] } [/block] 2. The browser is redirected to Okta for authentication. The browser will be returned to the credential viewer application after authentication is completed. [block:image] { "images": [ { "image": [ "https://files.readme.io/0729a971020947c8233063e021447a86e2fae429a3fe95d6bfbfb91b8152b9c3-okta-results-2.png", "0729a971020947c8233063e021447a86e2fae429a3fe95d6bfbfb91b8152b9c3-okta-results-2.png", 270, 370, "#f1f3f4", null, "69df9eff99c2dad8cfe48bb4" ] } ] } [/block] 3. The credential viewer application is displayed. Observe that the users email address and general profile attributes are displayed. [block:image] { "images": [ { "image": [ "https://files.readme.io/69495df9c64eb8112f08b0c88470a82bda50e685f397c77687528ff2d1fc9a2e-okta-results-3.png", "69495df9c64eb8112f08b0c88470a82bda50e685f397c77687528ff2d1fc9a2e-okta-results-3.png", 701, 755, "#dbdbdb", null, "69df9f00802a67837df1fdbe" ] } ] } [/block]