Search code examples
azure-active-directoryoktaokta-api

Okta as IDP Azure AD

has anyone successfully configured OKTA as Identity provider (IDP) in Azure Active Directory so that token recieved from OKTA can be leveraged by apps in Azure. I have gone thru several stackoverflow queries but none has any step by step guidance on how to add it in Azure AD as an external IDP.

any help?

thank you

Solution

  • • Yes, you can configure Okta as an IDP in Azure as a federated identity provider but please ensure that it supports SAML 2.0 or WS-Fed protocol for direct federation to work. Therefore, to proceed further, ensure that organization using Okta as an IDP has its DNS records correctly configured and updated for the domain to be matched with the target domain or a host within the target domain in case of a passive authentication URL.

    Once, the DNS records are setup correctly for an IDP’s domain name, then configure the partner IDP with the required claims and relying party trusts such that their SAML metadata file or URL is retrieved and uploaded for adding the Okta using IDP as an external identity as shown below in the snapshot: -

    Okta as an external IDP

    • Once, you have configured the SAML/WS-Fed supporting Okta IDP as a partner/external identity provider in the Azure AD tenant, ensure to configure specific attributes and claims to be configured at the third-party IDP such that these attributes are received in the SAML 2.0 response from the IDP itself when any user tries to login to the Azure AD using Okta identity.

    Ensure that the below attributes and claims are received as information in the SAML token from the configured Okta IDP: -

    AssertionConsumerService, Audience, Issuer, NameID and http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

    SAML/WS-Fed IDP Addition

    From the above snapshot, ensure to fill the following details for configuring the Okta IDP as an external identity provider: -

    a) Issuer URI - The issuer URI of the partner's IdP.

    b) Passive authentication endpoint - The partner IdP's passive requestor endpoint.

    c) Certificate - The signing certificate ID.

    d) Metadata URL - The location of the IdP's metadata for automatic renewal of the signing certificate.

    Thus, in this way, you can add an Okta based IDP in Azure through federated external identity. For more details regarding this, I would suggest you to please refer to the below links for more details: -

    https://learn.microsoft.com/en-us/azure/active-directory/external-identities/direct-federation#step-1-determine-if-the-partner-needs-to-update-their-dns-text-records

    Okta as IDP in Azure AD