Okta

Okta provides cloud software that helps companies manage and secure user authentication to modern applications, and helps developers build identity controls into applications, website web services, and devices. You can integrate Okta with Cloudflare Zero Trust and build rules based on user identity and group membership. Cloudflare Zero Trust supports Okta integrations using either the OIDC (default) or SAML protocol.

​​ Set up Okta as an OIDC provider

1. On your Okta admin dashboard, go to Applications > Applications.
2. Select Create App Integration.
3. For the Sign-in method, select OIDC - OpenID Connect.

4. For the Application type, select Web Application. Select Next.

5. Enter any name for the application. In the Sign-in redirect URIs field, input your team domain followed by this callback at the end of the path: /cdn-cgi/access/callback. For example:

   
   https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback

6. Choose the desired Assignment option and select Save.

7. From the application view, go to the Sign On tab.

8. Scroll down to the OpenID ConnectID Token and select Edit.

   

9. Set the Groups claim filter to Matches regex and its value to .*.

10. In the General tab, copy the Client ID, Client secret, and Okta domain.

    

11. In Zero Trust Open external link , go to Settings > Authentication.

12. Under Login methods, select Add new. Select Okta as your identity provider.

13. Fill in the following information:

    • Name: Name your identity provider.
    • App ID: Enter your Okta client ID.
    • Client secret: Enter your Okta client secret.
    • Okta account URL: Enter your Okta domain, for example https://<your-domain>.okta.com.

14. (Optional) Create an Okta API token and enter it in Zero Trust (the token can be read-only). This will prevent your Okta groups from failing if you have more than 100 groups.

15. (Optional) To configure custom OIDC claims:

    1. In Okta, create a custom authorization server Open external link and ensure that the groups scope is enabled.
    2. In Zero Trust, enter the Authorization Server ID obtained from Okta.
    3. Under Optional configurations, enter the claims that you wish to add to your Access application token.

16. (Optional) Enable Proof of Key Exchange (PKCE) Open external link . PKCE will be performed on all login attempts.

17. Select Save.

To test that your connection is working, select Test.

​​ Synchronize users and groups

The Okta OIDC integration supports the System for Cross-domain Identity Management (SCIM) Open external link protocol. With SCIM, Cloudflare Access can automatically deprovision users after they are deactivated in the identity provider and display synchronized group names in the Access policy builder.

To synchronize users and groups between Access and Okta, you need two separate app integrations in Okta:

• The Okta OIDC connector you created when adding Okta as an identity provider.
• A second Okta application of type SCIM 2.0 Test App (Header Auth). This is technically a SAML app but is responsible for sending user and group info via SCIM provisioning.

​​ 1. Enable SCIM in Zero Trust

1. In Zero Trust Open external link , go to Settings > Authentication.

2. Locate the IdP you want to synchronize and select Edit.

3. Select Enable SCIM.

4. (Optional) Enable the following settings:

• Enable user deprovisioning: Revoke a user’s active session when they are removed from the SCIM application in the IdP.
• Remove user seat on deprovision: Remove a user’s seat from your Zero Trust account when they are removed from the SCIM application in the IdP.
• Enable group membership change reauthentication: Revoke a user’s active session when their group membership changes in the IdP. This will revoke all active Access sessions and prompt for reauthentication for any Gateway WARP session policies. Access will read the user’s updated group membership when they reauthenticate.

5. Select Save.

6. Copy the SCIM Endpoint and SCIM Secret. You will need to enter these values into the IdP.

​​ 2. Configure SCIM in Okta

1. On your Okta admin dashboard, go to Applications > Applications.

2. Select Browse App Catalog.

3. Search for SCIM Header Auth and select SCIM 2.0 Test App (Header Auth).

4. Select Add Integration.

5. On the General Settings tab, name your application and select Next.

6. On the Sign-on Options tab, ensure that SAML 2.0 is selected. Select Done to create the integration.

7. On the Provisioning tab, select Configure API Integration.

8. Select Enable API integration.

9. In the Base URL field, enter the SCIM Endpoint obtained from Zero Trust.

10. In the API Token field, enter the SCIM Secret obtained from Zero Trust.

    

11. Select Test API Credentials to ensure that the credentials were entered correctly. Select Save.

12. On the Provisioning tab, select Edit and enable:

    • Create Users
    • Update User Attributes
    • Deactivate Users

    

13. Select Save to complete the configuration.

14. In the Assignments tab, add the users you want to synchronize with Cloudflare Access. You can add users in batches by assigning a group.

15. In the Push Groups tab, add the Okta groups you want to synchronize with Cloudflare Access. These groups will display in the Access policy builder.

Provisioning will begin immediately. To verify the integration, select View Logs in the Okta SCIM application.

​​ Example API Configuration

{
  "config": {
    "client_id": "<your client id>",
    "client_secret": "<your client secret>",
    "okta_account": "https://dev-abc123.oktapreview.com"
  },
  "type": "okta",
  "name": "my example idp"
}