Okta Setup #10820

2 Answer(s)

• 

  0

  AI-Bot created 2 months ago

  Support Team ABP Agent

  • Okta setup in ABP

    1. In ABP, Okta is typically integrated as an external OpenID Connect (OIDC) login provider.
    2. Configure it in your AuthServer/Web host with AddOpenIdConnect(...) (Okta is just an OIDC provider, so the same setup approach used for Azure AD applies).
    3. If you are using Account Pro, the recommended way is to register Okta as a new External Login provider and manage/override its settings (authority/client id/secret, etc.) from the UI:
       • Go to Administration → Identity → External Providers (or the equivalent menu in your UI) and install a new external login for Okta (OIDC).
       • Then users will see an Okta button on the login page (managed by Account Pro’s external login system).

  • What to do with “Enable two factor authentication” on the Users page after enabling Okta?

    • That switch controls ABP/ASP.NET Core Identity local 2FA (for users authenticating with the local identity system).
    • If your users authenticate via Okta and you want MFA handled by Okta, you generally do not need to enable ABP’s built-in 2FA for those users; Okta MFA will be enforced by Okta policies during the external login.
    • You would typically use one MFA system to avoid confusing/double MFA flows (either Okta MFA, or local Identity 2FA), and in an Okta-first setup, that usually means leaving ABP’s user 2FA option unused.

  • What should be configured under the “Application” page (OpenIddict applications) shown in your screenshot?

    • That screen is for clients of your ABP OpenIddict server (your own applications like MVC, Blazor Server, Angular, Swagger, etc.).
    • Enabling Okta as an external login provider does not replace these clients. You still need those OpenIddict applications configured correctly for your UI(s).
    • For your Blazor Server (based on your screenshot), make sure the OpenIddict application has:
      • Correct Redirect URI(s) like https://<your-host>/signin-oidc
      • Correct Post logout redirect URI(s) like https://<your-host>/signout-callback-oidc
      • Appropriate flows (commonly Authorization Code; other flows only if you really use them)
    • Okta configuration is separate: it’s an external provider configuration, not something you configure inside the OpenIddict “Applications” list.

  Sources:

  • https://abp.io/docs/latest/modules/account-pro#install-a-new-external-login
  • https://abp.io/docs/latest/modules/account-pro#manage-external-logins
  • https://abp.io/community/articles/4603b9cf
  • https://abp.io/community/articles/lyk87w5l

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 2 months ago

  Support Team Fullstack Developer

  Hi,

  Okta is a standard OpenID Connect provider, so you can add it as an external login provider. Add the Microsoft.AspNetCore.Authentication.OpenIdConnect NuGet package (pick the version matching your .NET version) to your Blazor Server project and configure it in the ConfigureServices method of your web module:

  using System.Security.Claims;
  using Microsoft.AspNetCore.Authentication;
  using Microsoft.IdentityModel.Protocols.OpenIdConnect;
  
  context.Services.AddAuthentication()
      .AddOpenIdConnect("Okta", "Okta", options =>
      {
          options.Authority = "<your-okta-issuer>"; // e.g. https://<your-domain>.okta.com/oauth2/default
          options.ClientId = "<okta-client-id>";
          options.ClientSecret = "<okta-client-secret>";
          options.ResponseType = OpenIdConnectResponseType.Code;
          options.GetClaimsFromUserInfoEndpoint = true;
          options.Scope.Add("email");
          options.CallbackPath = "/signin-okta";
          options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "sub");
      });
  

  On the Okta side, create a Web Application integration, set its sign-in redirect URI to https://<your-app-host>/signin-okta (it must match the CallbackPath above), and assign the users/groups that will use it. For the Authority, use the issuer of the Okta authorization server you use (you can see it in the Okta admin panel, e.g. https://<your-domain>.okta.com/oauth2/default for the default authorization server, or https://<your-domain>.okta.com for the org authorization server). Keep the client secret in appsettings.json/user-secrets instead of the source code. After this, an Okta button will show up on the login page automatically.

  If you also want to manage the client id/secret on the Settings page of the UI (per tenant), see the dynamic external provider setup: https://abp.io/docs/latest/modules/account-pro#install-a-new-external-login

  For the Enable two factor authentication option on the Users page: you can leave it as is. Users signing in via Okta won't get ABP's local two-factor prompt — MFA for them should be enforced by your Okta sign-on policies (adding Okta as a login provider doesn't enable MFA by itself). The local two-factor option still applies to users who sign in with a local username/password, so if you keep local login enabled, configure it as you do today for those users.

  For the Applications page: no changes are needed there for Okta. Those records are the clients of your own OpenIddict server (your Blazor Server app with its signin-oidc redirect uri), while Okta is an external provider in front of the login page — the two are independent. The checked flows in your screenshot (authorization code + implicit + hybrid) are the normal setup for the Blazor Server client, since it uses the hybrid flow — keep them as they are so they continue to match your client configuration.

  If you run into any errors during the setup, just share the details here and we'll help.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel