Search code examples
oauth-2.0okta

How is the OAuth/Okta Sign-in redirect URI used


So according to Okta documentation, the "Sign-in redirect URI" configured during Application creation is where "Okta sends the authentication response and ID token for the user's sign-in request to these URIs."

Does this mean Okta sends a POST or GET request to the URI configured in "Sign-in redirect URI? What are the specific names of the attributes it sends to the configured URI.


Solution

  • You could think of Sign-in redirect URI as the landing page after successful authentication. Okta redirects the user back to your application.

    Roughly it's a response that instructs the browser to now GET the landing page of your application. The parameters that are propagated depends on the Auth flow you choose(eg: Implicit Flow, Authorization Code Flow... see https://developer.okta.com/docs/concepts/oauth-openid/#choose-an-oauth-20-flow). For example:

    Authorization Code Flow:

    code: An authorization code used by your application to exchange for an access token and ID token.

    state: A value your application provided previously (to prevent Cross-Site Request Forgery).

    Attributes aside, typically, people would also set up the AuthServer config to "mint" the acessToken with a number of attributes so that they can customize the behavior on the landing page. One popular way to do that is via Inline Hook: https://developer.okta.com/docs/reference/token-hook/