Okta

Okta Configuration

Create an application for ToF with the following:

• Application Type: Single Page Application
• Redirect URIs
  • /login (ex: https://trifolia-fhir-dev.lantanagroup.com/login)
  • /silent-refresh.html (ex: https://trifolia-fhir-dev.lantanagroup.com/silent-refresh.html)
• Post Logout URI
  • /login (ex: https://trifolia-fhir-dev.lantanagroup.com/login)
• Assign User(s) to the newly created ToF application (See Section “Add User” for steps to create user(s))

ToF Configuration

• auth.clientId = Okta application's "Client ID"
• auth.domain = <the publicly available url of the tof app>
• auth.scope = openid profile name email roles
• auth.secret = [Not Required. Okta uses Proof Key for Code Exchange (PKCE) instead of a Client Secret]
• auth.issuer = <Okta url>/oauth2/default
• auth.jwksUri = <Okta url>/oauth2/default/v1/keys

Create User

1. From the Okta admin console, click "Directory”
2. Click “Add Person”
3. Enter the user details
4. Click Save

Assign User(s) to Application

1. From the Okta admin console, click "ApplicationsApplications”
2. Choose the Application to add user(s)
3. Click “Assignments”
4. Client “Assign” button and choose “Assign to People” option
5. Search for user(s) and click “Assign” button next to the username.
6. Click Done when completed.

Administrator role

An admin role can be assigned to users so that they are recognized as an administrative user. Add the role to the user:

1. From the Okta admin console, click "SecurityAdministrator”
2. Click “Add Administrator" button
3. In the pop-up window, type the user’s name or id in the “Grant administrator role to” field
4. Choose the required administrator roles from the “Administrator Roles” field

Scope

Have Okta return the roles in the id token:

1. From the Okta admin console, click "Security API"
2. Click the default (or choose the intended) Authorization Server
3. Click "Scopes" tab
4. Add a new scope called "roles"
5. Make sure the "Include in public Metadata" is selected