Configure OIDC SSO

What is OpenID Connect (OIDC)?

An identity layer built on top of OAuth 2.0 that provides user authentication and federated Single Sign-On (SSO).

What role does OAuth 2.0 play in authentication?

OAuth 2.0 provides authorization, allowing an authenticated user to grant a client application access to protected resources using an Access Token.

What does an ID Token issued by OIDC contain?

It contains user identity, authentication timestamps, the issuer (Okta), and other claims like email and name.

What is the purpose of an Access Token in OAuth 2.0?

An Access Token is used to access protected APIs/resources and proves that the application has authorization, along with the granted scopes and user context.

What are some OAuth Grant Types for confidential clients?

Confidential clients can use Authorization Code Flow with Client Secret and Client Credentials Flow.

What must you configure before integrating an OIDC app in Okta?

You must configure an Authorization Server, including scopes, claims, and access policies.

What does the Redirect URI do in OIDC Integration?

It is where Okta sends the authentication response and ID Token.

What information is required to integrate an OIDC app in Okta?

Redirect URI, Initiate Login URI, Client ID, and Client Secret.

What is the role of the Client Secret?

The Client Secret is used for confidential client authentication and is stored securely.

What must be configured in WordPress when integrating via miniOrange?

Client ID, Client Secret, Okta Authorization Server URL, and endpoints (issuer, token, authorize).

What does a successful Redirect URI signify?

It receives successful authentication responses from the Okta Authorization Server.

What is the difference between ID Token and Access Token?

ID Token proves the user's identity while the Access Token proves the app's permissions.

What does Okta act as in the OIDC and OAuth 2.0 process?

Okta acts as the Authorization Server and Identity Provider (IdP).

anki_oidc_sso = """

What does OIDC provide?

User authentication and federated single sign on.

What protocol does OIDC extend?

OAuth 2.0.

Who is the Identity Provider IdP when using OIDC with Okta?

Okta.

What does OAuth 2.0 provide?

Authorization to access protected resources.

What token is used for user authentication in OIDC?

The ID Token.

What token is used for authorization in OAuth 2.0?

The Access Token.

What format is the ID Token in?

A JSON Web Token JWT.

Who issues the ID Token and Access Token?

The Okta authorization server.

What does the ID Token prove?

That the user has been authenticated.

What does the Access Token prove?

That the application has been authorized to access resources with specific scopes.

What does the resource server use to validate authorization?

The Access Token.

What are OAuth grant types used for?

Obtaining an Access Token.

What is a confidential client?

An application that can securely store a client secret.

What must be configured before integrating an OIDC app?

An authorization server with scopes claims and access policies.

Can you use the default authorization server for OIDC?

Yes the default server can be used.

What is the redirect URI?

The URI where Okta sends the authentication response and ID Token.

What is the initiate login URI?

The URI where the OIDC login process begins.

What does the application need from Okta to complete OIDC setup?

The client ID and client secret.

Why is the client secret only for confidential clients?

Because it must be stored securely on a back end server.

Where are the client ID and secret configured?

Inside the external OIDC application such as WordPress.

In OIDC who authenticates the user?

Okta as the Identity Provider.

In OAuth who authorizes access to resources?

The resource server using the Access Token.

"""