Okta

This tutorial demonstrates how to integrate Criipto Verify with Okta. The following steps are required to complete your first login:

1. Register your Okta tenant in Criipto Verify
2. Configure your OAuth2 flow
3. Create Criipto Verify identity provider in Okta
4. Integrate your application with Okta

In the following you will be configuring first Criipto Verify, then Okta. Once configured you may test that everything works from Okta.

The setup requires a bit of switching back-and-forth between Criipto and Okta’s respective management dashboards, so we recommend that you have them open simultaneously to make the process really smooth.

Before you get started, you will need the following information:

• The callback URL for your Okta tenant - this will depend on the DNS name you use in Okta for running your logins. The value will probably look something like https://your-company-name.okta.com/oauth2/v1/authorize/callback, but check your Okta settings to make sure. We have used criipto-samples as a replacement for your-company-name in this tutorial.
• [Optional] The post_logout_redirect_url for your Okta tenant.

Register your Okta tenant in Criipto Verify

First, you must register your Okta tenant as an application in Criipto Verify.

Once you register your Okta tenant, you will also need some of the information for configuring Okta to communicate with Criipto Verify. You get these details from the settings of the application in the dashboard.

Specifically you need the following information to integrate with Okta:

• Client ID to identify your Okta tenant to Criipto Verify. In the case below we chose urn:criipto:verify
• Domain on which you will be communicating with Criipto Verify. Could be for example samples.criipto.id
• Client secret which Okta needs to fetch actual user information from Criipto Verify during login. The secret is generated and copied as described further down.

If you plan on using single-signon, you must also register your Okta post_logout_redirect_url here so you can run single-logouts.

Configure the OAuth2 code flow

If you are registering a new application, you must first save the configuration.

Once you have a saved application registration you may configure the OAuth2 code flow.

Open the application registration and configure it for the right OAuth2 flow:

1. Enable OAuth2 code flow
2. Copy the generated client secret.
3. Set the user info response strategy to plainJson to enable retrieval of plain JSON user information from the /oauth2/userinfo endpoint.

Note that this is the only time you will be shown the actual value of the client secret. Criipto only stores this as a hashed value, which means you cannot retieve the value once it has been generated and stored.

You may configure Criipto Verify to retrieve the user information from either the userinfo endpoint - the default option - or you may explicitely choose the fromTokenEndpoint in the user info response strategy instead:

Create Okta identity provider

Make sure you are in Classic UI mode, and click on the Security -> Identity Providers item.

and click on the Add Identity Provider button, select OIDC for protocol.

Select Add OpenID Connect IdP

Fill in the form with values for you Criipto Verify application, similar to the following example

Given the values above, and assuming that your Criipto Verify domain is acme-corp.criipto.id you must add

1. Client ID: urn:criipto:verify (if you have set a different value in your Criipto Verify Client ID/Realm, use that value instead here - they must match)
2. Client Secret: The secret generated for you by Criipto Verify during the OAuth code flow setup
3. Scopes: openid will suffice
4. Issuer: https://acme-corp.criipto.id
5. Authorization endpoint: https://acme-corp.criipto.id/oauth2/authorize?acr_values=urn:grn:authn:itsme:basic
6. Token endpoint: https://acme-corp.criipto.id/oauth2/token
7. JWKS endpoint: https://acme-corp.criipto.id/.well-known/jwks

The Name is entirely up to you, and you don’t have to specify the optional Userinfo endpoint if you at the same time ensure that you configure your Criipto Verify application to use fromTokenEndpoint in the User info response strategy dropdown.

Supported acr_values

Criipto Verify supports a range of country and bank specific e-ID services. They are all accessed through the same endpoints, e.g. https://<YOUR COMPANY>.criipto.id/oauth2/authorize

To pick the login method you must set the acr_values parameter on the authentication request in order to choose the type of authentication you want. How you set this query string parameter varies with programming platform and your OpenID Connect library of choice.

The current list of possible values is:

Test users

Almost all e-ID types have a notion of test users and real users.

Real users are real people logging in to a web site, thus voluntering their real name and typically also a social security number, SSN.

Test users are either created by you for the occasion, or we provide you with access to already created test users.

You may ready more in the section on test users

Integrate your own application with Okta

How to integrate your application with Okta depends on the technology you are working with. Refer to the Okta developer documentation for more details.