Okta
This tutorial demonstrates how to integrate Criipto Verify with Okta. The following steps are required to complete your first login:
- Register your Okta tenant in Criipto Verify
- Configure your OAuth2 flow
- Create Criipto Verify identity provider in Okta
- Integrate your application with Okta
In the following you will be configuring first Criipto Verify, then Okta. Once configured you may test that everything works from Okta.
The setup requires a bit of switching back-and-forth between Criipto and Okta’s respective management dashboards, so we recommend that you have them open simultaneously to make the process really smooth.
Before you get started, you will need the following information:
- The callback URL for your Okta tenant - this will depend on the DNS name you use in Okta for running your logins. The value will probably look something like
https://your-company-name.okta.com/oauth2/v1/authorize/callback
, but check your Okta settings to make sure. We have usedcriipto-samples
as a replacement foryour-company-name
in this tutorial. - [Optional] The
post_logout_redirect_url
for your Okta tenant.
Register your Okta tenant in Criipto Verify
First, you must register your Okta tenant as an application in Criipto Verify.
Once you register your Okta tenant, you will also need some of the information for configuring Okta to communicate with Criipto Verify. You get these details from the settings of the application in the dashboard.
Specifically you need the following information to integrate with Okta:
- Client ID to identify your Okta tenant to Criipto Verify. In the case below we chose
urn:criipto:verify
- Domain on which you will be communicating with Criipto Verify. Could be for example
samples.criipto.id
- Client secret which Okta needs to fetch actual user information from Criipto Verify during login. The secret is generated and copied as described further down.
If you plan on using single-signon, you must also register your Okta post_logout_redirect_url
here so you can run single-logouts.
Configure the OAuth2 code flow
If you are registering a new application, you must first save the configuration.
Once you have a saved application registration you may configure the OAuth2 code flow.
Open the application registration and configure it for the right OAuth2 flow:
- Enable OAuth2 code flow
- Copy the generated client secret.
- Set the user info response strategy to
plainJson
to enable retrieval of plain JSON user information from the/oauth2/userinfo
endpoint.
Note that this is the only time you will be shown the actual value of the client secret. Criipto only stores this as a hashed value, which means you cannot retieve the value once it has been generated and stored.
You may configure Criipto Verify to retrieve the user information from either the userinfo
endpoint - the default option - or you may explicitely choose the fromTokenEndpoint
in the user info response strategy instead:
Create Okta identity provider
Make sure you are in Classic UI
mode, and click on the Security -> Identity Providers
item.
and click on the Add Identity Provider
button, select OIDC
for protocol.
Select Add OpenID Connect IdP
Fill in the form with values for you Criipto Verify application, similar to the following example
Given the values above, and assuming that your Criipto Verify domain is acme-corp.criipto.id
you must add
- Client ID:
urn:criipto:verify
(if you have set a different value in your Criipto VerifyClient ID/Realm
, use that value instead here - they must match) - Client Secret: The secret generated for you by Criipto Verify during the
OAuth code flow
setup - Scopes:
openid
will suffice - Issuer:
https://acme-corp.criipto.id
- Authorization endpoint:
https://acme-corp.criipto.id/oauth2/authorize?acr_values=urn:grn:authn:itsme:basic
- Token endpoint:
https://acme-corp.criipto.id/oauth2/token
- JWKS endpoint:
https://acme-corp.criipto.id/.well-known/jwks
The Name is entirely up to you, and you don’t have to specify the optional Userinfo endpoint if you at the same time ensure that you configure your Criipto Verify application to use fromTokenEndpoint
in the User info response strategy
dropdown.
Supported acr_values
Criipto Verify supports a range of country and bank specific e-ID services. They are all accessed through the same endpoints, e.g. https://<YOUR COMPANY>.criipto.id/oauth2/authorize
To pick the login method you must set the acr_values
parameter on the authentication request in order to choose the type of authentication you want. How you set this query string parameter varies with programming platform and your OpenID Connect library of choice.
The current list of possible values is:
Login method | acr_values |
---|---|
Norwegian BankID | |
Mobile or Web (user choice): | urn:grn:authn:no:bankid |
Norwegian Vipps Login | |
Login with Vipps app: | urn:grn:authn:no:vipps |
Swedish BankID | |
Same device: | urn:grn:authn:se:bankid:same-device |
Another device (aka mobile): | urn:grn:authn:se:bankid:another-device |
Danish NemID | |
Personal with code card: | urn:grn:authn:dk:nemid:poces |
Employee with code card: | urn:grn:authn:dk:nemid:moces |
Employee with code file: | urn:grn:authn:dk:nemid:moces:codefile |
Finish e-ID | |
BankID: | urn:grn:authn:fi:bank-id |
Mobile certificate (Mobiilivarmenne): | urn:grn:authn:fi:mobile-id |
Any of the two: | urn:grn:authn:fi:all |
Itsme | |
Basic: | urn:grn:authn:itsme:basic |
Advanced: | urn:grn:authn:itsme:advanced |
Belgium | |
Verified e-ID | urn:grn:authn:be:eid:verified |
Germany | |
Sofort (with Schufa check) | urn:grn:authn:de:sofort |
Test users
Almost all e-ID types have a notion of test users and real users.
Real users are real people logging in to a web site, thus voluntering their real name and typically also a social security number, SSN.
Test users are either created by you for the occasion, or we provide you with access to already created test users.
You may ready more in the section on test users
Integrate your own application with Okta
How to integrate your application with Okta depends on the technology you are working with. Refer to the Okta developer documentation for more details.