Okta SSO Setup

Okta Resources

Additional Okta Resources

To set up an application to use OpenID Connect (OIDC) with Okta for Single Sign-On (SSO), you'll need to configure both your Okta tenant and the application you're integrating. Below is a step-by-step guide on how to set this up. After setting up SSO there are also steps for setting up and configuring SCIM provisioning.

Step 1: Register the SSO Application in Okta

1. Sign in to the Okta Admin Dashboard
   Go to https://{okta_domain}-admin.okta.com/admin/dashboard and log in with your Okta administrator account.
2. Create a new application for SSO

   1. From the Okta dashboard, select Applications under the Applications dropdown.

      
      
      
      

   2. Click Create App Integration

   3. When the dialog appears:

      1. Select the Sign-method: OIDC - OpenID Connect

      2. Select the Application type: Web application

      3. Click Next

         

   4. Enter the information on the New Web App Integration Page

      1. Enter the Name of your application

   5. Sign-in redirect URIs: https://verified.clearme.com/UserBackend/callback/oauth

      

   6. Under Assignments, select the type of Controlled access you would like to grant your users.

      

   7. Click Save

Step 2: Gather Necessary Information

1. Client ID
   From the General section of your Application, copy the Client ID
2. Okta Domain
   The Okta domain is used to log into the Okta dashboard
3. Client Secret
   Click the "eye" and copy the Client Secret

Step 3: Configure the Application to user OIDC

Note: This is done in the CLEAR Console.

Now that you have the necessary information (client ID, Okta domain, client secret), you need to configure your application (CLEAR) to use OIDC for authentication.

1. Login to your CLEAR Organization Dashboard with your Admin account (Solutions Engineering should have set up an initial Admin account)

   1. URL to CLEAR Dashboard: https://verified.clearme.com/dashboard

   2. Click on User Management

   3. Click on Single Sign-on (SSO)

   4. Click on the Okta Tile

      

   5. Fill out the configuration information using the Client ID, Client Secret, and Okta Domain from Step 2 above.

   6. Enter the OIDC Discovery Endpoint: https://{okta_domain}.okta.com/.well-known/openid-configuration

      1. Make sure to add your Okta Domain to the {okta_domain} above and remove the curly brackets

   7. Click the Get URI endpoints to fill in the authorization_endpoint, token_endpoint, and userinfo_endpoint

      1. If the host does end in okta.com, please let CLEAR Support know so they can allowlist the host.

         

   8. Click Publish in the top right to save your changes.

      

   9. The endpoints below should be automatically filled in if the discovery endpoint was used.

      1. Set the Authorization Endpoint: https://{okta_domain}.okta.com/oauth2/v1/authorize
      2. Set the Token Endpoint: https://{okta_domain}.okta.com/oauth2/v1/token
      3. Set the Userinfo Endpoint: https://{okta_domain}.okta.com/oauth2/v1/userinfo

   10. The Callback/Redirect URI above is used when doing app registration in Step 1.

2. Make sure the user is defined in CLEAR User Management with the correct role
   1. Note: this can be done by adding the user under the User management/Authorized users section of CLEAR dashboard or by using SCIM to send your users and roles to CLEAR (setup in Step 10)
   2. It is important that the emails of the users must match those that are in your Okta

Step 4: Define a Group or SSO and SCIM (if needed)

1. Define a group for SSO login and SCIM (if needed).

   1. Go to the Groups page under Directory and create a new group for your SSO and SCIM (if need) app

      

   2. Click the add group button and fill in the dialog to create your group

      

   3. Save your group information and then the group should appear in the list

      
2. Create a person to assign to the group. Skip this step if you already have a person defined.

   1. Click Add Person

      

   2. Fill in the fields on the dialog and Click Save

      
3. Assign the user to the group

   1. Click on the group name (My App SSO/SCIM group). It is highlighted as a link (see below)

      

   2. Assign people to the group

      

   3. If we look at the user we can now see the group is assigned to that user

      
4. Assign the group to the SSO Application

   1. Click on Applications under the Applications drop down

      

   2. Click on the Application you wish to Assign Groups or People to (My App)

   3. Click on Assignments

   4. Click Groups to add a group or People to add individual users

      

   5. Click on Assign drop down button and select if you are assigning Groups or People

      

   6. Select the group and save

      

Step 5: Testing the Integration

1. Launch your Application
   Navigate to your application and initiate the login process. It should redirect you to Okta's login page for authentication. Go to this URL to CLEAR Dashboard and follow the Okta login path below: https://verified.clearme.com/dashboard

As long as the authentication token has not expired, once the user has logged in they will not be prompted for their login credentials again.

Troubleshooting

• Ensure that the Redirect URI in the Okta portal exactly matches the one used in your application.
• Verify the correct permissions have been granted.
• Make sure your app handles the token exchange flow properly, including validating tokens on the backend.
• Verify that hosts are not being blocked

Final Thoughts

Setting up OIDC SSO with Okta allows you to leverage secure authentication for your applications. Make sure to test thoroughly and follow security best practices for handling tokens.