Skip to main content

Okta setup

Before a sensor can take part in a verification, the person using it signs in with their corporate identity. This guide shows you how to create a SlashID app integration in Okta so your users can authenticate with Okta, and how to provide the resulting credentials to SlashID.

First, you will create an OIDC app integration, set the SlashID sign-in redirect URI, and assign the people who need it. Second, you will enter the Client ID and client secret in the SlashID Console.

Step 1: Create an Okta app integration​

  1. Log in to your Okta admin console as an administrator.

  2. From the menu on the left, select 'Applications' > 'Applications'.

  3. Choose 'Create App Integration'.

  4. Under 'Sign-in method', select 'OIDC - OpenID Connect'. Under 'Application type', select 'Web Application'. Press 'Next'.

create a new app integration

  1. Enter a name for this integration, for example SlashID Mutual TOTP.

  2. Under 'Grant type', leave 'Authorization Code' selected. This is the default, and it is the only grant SlashID needs.

  3. Under 'Sign-in redirect URIs', enter:

    https://api.slashid.com/ip/sensors/auth/callback

app integration settings

Step 2: Assign the application​

Okta only lets people sign in to an application they are assigned to. Anyone who will use a sensor needs an assignment, or they will be turned away at the Okta sign-in page.

  1. Still in the creation wizard, find the 'Assignments' section.

  2. Choose either:

    • 'Allow everyone in your organization to access' - the simplest option if sensors are for all staff, or
    • 'Limit access to selected groups' - then pick the groups that should have sensors.

  3. Press 'Save'. Going forward, we'll call this your SlashID app integration.

assignments

note

You can change assignments later from the 'Assignments' tab of the app integration. If you are setting this up for a trial or a demo, assigning just yourself and the people taking part is enough.

Step 3: Obtain the client ID and secret​

  1. Open your SlashID app integration and select the 'General' tab.

  2. Under 'Client Credentials', copy the Client ID.

  3. Copy the Client secret. You will need to enter both in the SlashID Console later.

client credentials

note

Unlike Entra, Okta lets you return to this page and read the client secret again, so you do not have to capture it on first sight. Treat it as a credential all the same.

Step 4: SlashID Console configuration​

  1. Go to the SlashID Console > 'Identity Protection' > 'Configuration' > 'Data sources'.

  2. Open the SlashID Browser Extension data source.

  3. Fill in the connection details:

    SlashID Console fieldDescription
    OAuth Client IDThe client ID obtained in step 3
    OAuth Client SecretThe client secret obtained in step 3
    Identity Provider Login URLYour Okta domain, for example https://yourorg.okta.com

  4. Switch Require IDP authentication on. This is the master switch for verification: with it off, the credentials you just entered go unused and no sensor shows a verification screen.

  5. Save the configuration.

slashid console configuration

danger

Require IDP authentication is easy to miss - it sits on the same tab as the credentials rather than with the other verification settings. If sign-in works but nobody ever sees a verification screen, check this switch first. See Turning verification on.

Your users can now sign in with their Okta identity from a SlashID app and take part in identity verification.

Next, see Troubleshooting for what each of the remaining settings on this page decides.