Skip to content

Commit df479a9

Browse files
ranbelranbel
committed
pcx edits
1 parent 7858cc6 commit df479a9

File tree

2 files changed

+59
-74
lines changed

2 files changed

+59
-74
lines changed

‎src/content/docs/cloudflare-one/identity/idp-integration/okta.mdx‎

Lines changed: 31 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -12,66 +12,44 @@ Additionally, you can configure Okta to use risk information from Zero Trust [us
1212

1313
## Prerequisites
1414

15-
1. You must have Zero Trust write or administrator access.
15+
- A Cloudflare [Zero Trust organization](/cloudflare-one/setup/) with any subscription tier (including Free)
16+
- A [Zero Trust administrator role](/cloudflare-one/roles-permissions/) with `Access Edit` permissions
1617

17-
2. A Cloudflare Zero Trust organization with any subscription tier (including Free) must be created. To set up a Cloudflare Zero Trust organization, refer to Create a Cloudflare Zero Trust organization.
18+
## Supported features
1819

19-
## Supported Features
20+
- **SP-initiated SSO**: When a user goes to an Access application, Access redirects them to sign in with Okta.
21+
- **SCIM provisioning**: Synchronize Okta groups and automatically deprovision users. SCIM currently requires a separate [custom OIDC application](#synchronize-users-and-groups).
2022

21-
* SP-initiated SSO (Single Sign-On)
23+
## Set up Okta as an OIDC provider (Okta App Catalog)
2224

23-
## Set up Okta as an OIDC provider (Okta Application Catalog)
25+
To set up the Okta integration using the Okta Integration Network (OIN) App Catalog:
2426

2527
1. Log in to your Okta admin dashboard.
26-
27-
2. Navigate to Applications > Applications.
28-
29-
3. Click Browse App Catalog.
30-
31-
4. Search for "Cloudflare One" and select the official Cloudflare application (OIDC).
32-
33-
5. Click Add.
34-
35-
6. Add an application label and Team domain:
28+
2. Go to **Applications** > **Applications**.
29+
3. Select **Browse App Catalog**.
30+
4. Search for `Cloudflare` and select the **Cloudflare One** app.
31+
5. Select **Add integration**.
32+
6. In **Application label**, enter a name for the application (for example, `Cloudflare Access`).
33+
7. In **Team domain**, enter your Zero Trust team domain:
3634

3735
```txt
3836
<your-team-name>.cloudflareaccess.com
3937
```
40-
You can find your team name in Zero Trust under **Settings** > **Custom Pages**.
4138

39+
You can find your team domain in Zero Trust under **Settings** > **Custom Pages**.
4240

43-
7. In the **Sign On** tab, copy the **Client ID** and **Client secret**.
44-
45-
8. Scroll down to the **OpenID ConnectID Token** and select **Edit**.
41+
8. In the **Sign On** tab, copy the **Client ID** and **Client secret**.
42+
9. Scroll down to **OpenID ConnectID Token** and select **Edit**.
4643

4744
![Configuring the Groups claim filter in Okta](~/assets/images/cloudflare-one/identity/okta/okta-2.png)
4845

49-
9. Set the **Groups claim filter** to _Matches regex_ and its value to `.*`.
50-
51-
10. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Authentication**.
52-
53-
11. Under **Login methods**, select **Add new**. Select **Okta** as your identity provider.
54-
55-
12. Fill in the following information:
56-
- **Name**: Name your identity provider.
57-
- **App ID**: Enter your Okta client ID.
58-
- **Client secret**: Enter your Okta client secret.
59-
- **Okta account URL**: Enter your [Okta domain](https://developer.okta.com/docs/guides/find-your-domain/main/), for example `https://my-company.okta.com`.
46+
10. Set the **Groups claim filter** to _Matches regex_ and its value to `.*`.
6047

61-
13. (Optional) Create an Okta API token and enter it in Zero Trust (the token can be read-only). This will prevent your Okta groups from failing if you have more than 100 groups.
48+
<Render file="access/okta-zt-steps" product="cloudflare-one" />
6249

63-
14. (Optional) To configure [custom OIDC claims](/cloudflare-one/identity/idp-integration/generic-oidc/#custom-oidc-claims):
64-
1. In Okta, create a [custom authorization server](https://developer.okta.com/docs/guides/customize-authz-server/main/) and ensure that the `groups` scope is enabled.
65-
2. In Zero Trust, enter the **Authorization Server ID** obtained from Okta.
66-
3. Under **Optional configurations**, enter the claims that you wish to add to your users' identity.
50+
## Set up Okta as an OIDC provider (Custom App Integration)
6751

68-
15. (Optional) Enable [Proof of Key Exchange (PKCE)](https://www.oauth.com/oauth2-servers/pkce/). PKCE will be performed on all login attempts.
69-
70-
16. Select **Save**.
71-
72-
## Set up Okta as an OIDC provider (Custom OIDC Application)
73-
74-
1. On your Okta admin dashboard, go to **Applications** > **Applications**.
52+
1. Log in to your Okta admin dashboard and go to **Applications** > **Applications**.
7553

7654
2. Select **Create App Integration**.
7755

@@ -93,7 +71,7 @@ Additionally, you can configure Okta to use risk information from Zero Trust [us
9371

9472
7. From the application view, go to the **Sign On** tab.
9573

96-
8. Scroll down to the **OpenID ConnectID Token** and select **Edit**.
74+
8. Scroll down to **OpenID ConnectID Token** and select **Edit**.
9775

9876
![Configuring the Groups claim filter in Okta](~/assets/images/cloudflare-one/identity/okta/okta-2.png)
9977

@@ -107,37 +85,7 @@ Additionally, you can configure Okta to use risk information from Zero Trust [us
10785

10886
![Finding your Client credentials in Okta](~/assets/images/cloudflare-one/identity/okta/okta-3.png)
10987

110-
11. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Authentication**.
111-
112-
12. Under **Login methods**, select **Add new**. Select **Okta** as your identity provider.
113-
114-
13. Fill in the following information:
115-
- **Name**: Name your identity provider.
116-
- **App ID**: Enter your Okta client ID.
117-
- **Client secret**: Enter your Okta client secret.
118-
- **Okta account URL**: Enter your [Okta domain](https://developer.okta.com/docs/guides/find-your-domain/main/), for example `https://my-company.okta.com`.
119-
120-
14. (Optional) Create an Okta API token and enter it in Zero Trust (the token can be read-only). This will prevent your Okta groups from failing if you have more than 100 groups.
121-
122-
15. (Optional) To configure [custom OIDC claims](/cloudflare-one/identity/idp-integration/generic-oidc/#custom-oidc-claims):
123-
1. In Okta, create a [custom authorization server](https://developer.okta.com/docs/guides/customize-authz-server/main/) and ensure that the `groups` scope is enabled.
124-
2. In Zero Trust, enter the **Authorization Server ID** obtained from Okta.
125-
3. Under **Optional configurations**, enter the claims that you wish to add to your users' identity.
126-
127-
16. (Optional) Enable [Proof of Key Exchange (PKCE)](https://www.oauth.com/oauth2-servers/pkce/). PKCE will be performed on all login attempts.
128-
129-
17. Select **Save**.
130-
131-
To [test](/cloudflare-one/identity/idp-integration/#test-idps-in-zero-trust) that your connection is working, select **Test**.
132-
133-
:::note
134-
135-
If you see the error `Failed to fetch user/group information from the identity`, double-check your Okta configuration:
136-
137-
- If you have more than 100 Okta groups, ensure you include the API token.
138-
- The request may be blocked by the [ThreatInsights feature](https://help.okta.com/en/prod/Content/Topics/Security/threat-insight/ti-index.htm) within Okta.
139-
140-
:::
88+
<Render file="access/okta-zt-steps" product="cloudflare-one" />
14189

14290
## Synchronize users and groups
14391

@@ -218,3 +166,12 @@ To verify the integration, select **View Logs** in the Okta SCIM application.
218166
"name": "my example idp"
219167
}
220168
```
169+
170+
## Troubleshooting
171+
172+
### Failed to fetch user/group information from the identity
173+
174+
If you see the error `Failed to fetch user/group information from the identity`, double-check your Okta configuration:
175+
176+
- If you have more than 100 Okta groups, ensure you include the API token.
177+
- The request may be blocked by the [ThreatInsights feature](https://help.okta.com/en/prod/Content/Topics/Security/threat-insight/ti-index.htm) within Okta.

‎src/content/partials/cloudflare-one/access/okta-zt-steps.mdx‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
{}
3+
---
4+
5+
import {} from "~/components"
6+
7+
11. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Authentication**.
8+
9+
12. Under **Login methods**, select **Add new**. Select **Okta** as your identity provider.
10+
11+
13. Fill in the following information:
12+
- **Name**: Name your identity provider.
13+
- **App ID**: Enter your Okta client ID.
14+
- **Client secret**: Enter your Okta client secret.
15+
- **Okta account URL**: Enter your [Okta domain](https://developer.okta.com/docs/guides/find-your-domain/main/), for example `https://my-company.okta.com`.
16+
17+
14. (Optional) Create an Okta API token and enter it in Zero Trust (the token can be read-only). This will prevent your Okta groups from failing if you have more than 100 groups.
18+
19+
15. (Optional) To configure [custom OIDC claims](/cloudflare-one/identity/idp-integration/generic-oidc/#custom-oidc-claims):
20+
1. In Okta, create a [custom authorization server](https://developer.okta.com/docs/guides/customize-authz-server/main/) and ensure that the `groups` scope is enabled.
21+
2. In Zero Trust, enter the **Authorization Server ID** obtained from Okta.
22+
3. Under **Optional configurations**, enter the claims that you wish to add to your users' identity.
23+
24+
16. (Optional) Enable [Proof of Key Exchange (PKCE)](https://www.oauth.com/oauth2-servers/pkce/). PKCE will be performed on all login attempts.
25+
26+
17. Select **Save**.
27+
28+
To [test](/cloudflare-one/identity/idp-integration/#test-idps-in-zero-trust) that your connection is working, select **Test**.

0 commit comments

Comments
 (0)