You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/ROOT/pages/tutorial/tutorial-sso-configuration.adoc
+44-30Lines changed: 44 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -48,13 +48,10 @@ Thus, changing the username claim from `sub` is not recommended.
48
48
== Okta
49
49
50
50
The following examples show how to configure Okta for authentication and authorization using access tokens and ID tokens.
51
-
For more information, see the https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/[Okta official documentation].
51
+
It assumes that you are using Okta Developer Edition Service.
52
+
For the complete guide on how to customize tokens returned from Okta with a groups claim, see the https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/[Okta official documentation].
52
53
53
-
=== Access token
54
-
55
-
This example shows how to configure Okta for authentication and authorization using access tokens.
56
-
57
-
==== Configure the client
54
+
=== Configure the client
58
55
59
56
. From the right-hand side of the Okta dashboard, navigate to *Applications* and click *Create App Integration*.
60
57
. Select *OIDC - OpenID Connect* for Sign-in method and *Single-Page Application* for Application type.
@@ -67,9 +64,9 @@ This URI will accept returned token responses after successful authentication.
67
64
. In the *Assignments* section, select *Skip group assignment* for now.
68
65
. Click *Save*.
69
66
. Take note of the Client ID.
70
-
You will need it later when configuring the Okta parameters and the Well-known OpenID Connect endpoint in the _neo4j.conf_ file:
67
+
You will need it later when configuring the Okta parameters and the Well-known OpenID Connect endpoint in the _neo4j.conf_ file.
71
68
72
-
==== Assign Okta groups to the application
69
+
=== Assign Okta groups to the application
73
70
74
71
. From the right-hand side of the Okta dashboard, navigate to *Dashboard -> Directory -> Groups*, and click *Add Group*.
75
72
. Add a name for the group, for example, `engineers`, and click *Save*.
@@ -80,12 +77,19 @@ Users can be added to a group either on user creation or by editing the group.
80
77
.. Click *Applications* and then *Assign Applications*.
81
78
.. Select the application you created earlier and click *Assign*.
82
79
83
-
==== Configure the default authorization server
80
+
=== Configure Neo4j authentication and authorization using Okta access token
81
+
82
+
This example shows how to configure Okta for authentication and authorization using access tokens and how to configure Neo4j to use them.
83
+
84
+
==== Add a groups claim to access tokens
84
85
85
86
. From the right-hand side of the Okta dashboard, navigate to *Security -> API*.
86
87
. Click the default authorization server (the one that shows `api://default` as audience) to return the `groups` claim in access tokens:
87
88
.. On the *Claims* tab, click *Add Claim*.
88
-
.. Add a claim with the name `groups` and the value `Groups`, and click *Create*.
89
+
.. Add a claim with the name `groups`.
90
+
.. From the *Value type* dropdown, select *Groups*.
91
+
.. From the Filter dropdown, select *Matches regex* and the value `.*`.
. Add a claim with the name `userid` and the value type `User ID`.
133
139
+
134
140
[NOTE]
135
141
====
136
-
In the case of access tokens, a default sub is already provided automatically.
137
-
However, for ID tokens, the name you give to your claim needs to be also indicated in the configuration `dbms.security.oidc.okta.claims.username=userid`.
142
+
The `userid` claim is not included in the ID token by default like the default `sub` claim for access tokens, thus you need to add it manually.
143
+
The name you give to your claim needs to be also indicated in the configuration `dbms.security.oidc.okta.claims.username=userid`.
138
144
====
139
-
+
140
-
. Configure the default authorization server (the one that shows _api://default as audience_) as indicated:
145
+
.. Click *Add Claim*.
146
+
.. Add a claim with the name `userid`.
147
+
.. From the *Include in token type* dropdown, select *ID Token*.
148
+
.. From the *Value type* dropdown, select *Expression*.
149
+
.. In the *Value* field, type `(appuser !=null) ? appuser.userName : app.clientId`.
150
+
.. Click *Create*.
151
+
152
+
==== Configure Neo4j
153
+
154
+
. Configure Neo4j to use Okta authentication by configuring the following settings in the _neo4j.conf_ file:
You can find the audience parameter under *OpenID Connect ID Token* of your application on the *Sign On* tab.
174
+
====
161
175
. (Optional) If you want control the authentication and authorization on a user level, configure xref:configuration/configuration-settings.adoc#config_dbms.security.require_local_user[`dbms.security.require_local_user`] to `true` in the _neo4j.conf_ file.
162
176
This setting mandates that users with the relevant auth provider attached to them must exist in the database before they can authenticate and authorize with that auth provider.
163
177
For information on how to create users in this mode, see xref:authentication-authorization/manage-users.adoc#access-control-create-users[Creating users].
0 commit comments