Configuring Okta for Verax

Updated
  • 3 minute(s) read
Prev Next

This guide explains how to connect Okta to Verax.

Once completed, the integration enables:

  • Console Authentication (SSO) for Verax Protect users.

  • User and Group Synchronization.

  • Identity Enforcement for supported AI tools.

Before You Begin

Ensure you have:

  • Okta Administrator permissions.

  • Permission to create App Integrations.

  • Permission to grant Okta API scopes.

  • Permission to assign Administrator roles.

Architecture Overview

Okta integration requires two App Integrations:

Component

Purpose

OIDC Web Application

Authentication, Identity Enforcement, and Login Redirect.

API Service Application

User and Group Synchronization.

Both applications are required for a complete Okta integration.

Part 1. Configure the OIDC Web Application

Step 1. Create the Application

Navigate to:

Applications → Create App Integration

Select:

  • OIDC – OpenID Connect

  • Web Application

Configure:

  • Application Name: Verax

Step 2. Configure Redirect URIs

Under Sign-in Redirect URIs, add the following:

https://console.verax.ai:3002/auth/sso/OKTA/callback
https://internal.verax.ai/oidc/callback

The Sign-out Redirect URI can be left blank.

Save the application.

Step 3. Assign Users

Navigate to:

Assignments

Assign all users that should be allowed to sign in to Verax.

Important

Okta blocks authentication for users who are not assigned to the application.

Step 4. Verify the Authentication Policy

Navigate to:

Sign On

Review the assigned Authentication Policy.

If the policy requires additional authentication factors that users have not enrolled, authentication will fail before reaching Verax.

Either:

  • Enroll the required authentication factors.

  • Modify the Authentication Policy to match your organization's requirements.

Step 5. Configure the Authorization Server

Navigate to:

Security → API → Authorization Servers

Select your Authorization Server (typically default).

Create an Access Policy that includes the Verax application.

Create a rule allowing the following grant types:

  • Authorization Code

  • Client Credentials

Without an Access Policy, authentication requests will fail with no_matching_policy.

Step 6. Collect the OIDC Configuration

From the application's General tab, copy:

  • Client ID

  • Client Secret

Also note the Issuer URI.

Example:

https://company.okta.com/oauth2/default

Important

Use your organization's standard Okta domain.

Do not use the -admin.okta.com domain.

Part 2. Configure the API Service Application

Step 1. Create the Application

Navigate to:

Applications → Create App Integration

Select:

API Services

Save the application.

Step 2. Configure Client Authentication

Open the application's General tab.

Under Client Authentication, select:

Public key / Private key

Click:

Add Key → Generate new key

Copy the generated private key.

You'll enter this value into Verax later.

Important

Generate the key in Okta. Do not import an externally generated key.

Step 3. Disable DPoP

Navigate to:

General Settings → Proof of Possession

Ensure Require Demonstrating Proof of Possession (DPoP) is disabled.

Leaving DPoP enabled prevents Verax from authenticating successfully.

Step 4. Grant Okta API Scopes

Navigate to:

Okta API Scopes

Grant:

okta.users.read
okta.groups.read

Important

Grant okta.groups.read.

Do not use okta.directories.groups.read, which is intended for a different API.

Step 5. Assign an Administrator Role

Navigate to:

Admin Roles

Assign a role with permission to read users and groups.

For example:

  • Read-only Administrator

OAuth scopes alone are not sufficient. The application must also have an Administrator role assigned.

Step 6. Collect the API Service Configuration

Copy:

  • API Service Client ID

  • Generated Private Key

Part 3. Configure Verax

Navigate to:

Settings → Identity Provider

Select:

Okta

Provide the following values:

Verax Setting

Okta Value

Issuer URI

Authorization Server Issuer URI

OIDC Client ID

OIDC Web Application Client ID

OIDC Client Secret

OIDC Web Application Client Secret

API Service Client ID

API Service Application Client ID

API Service Private Key

Generated Private Key

Save the connector.

Part 4. Enable Identity Provider Features

Once the connector has been successfully configured, you can independently enable:

  • Console Authentication (SSO)

  • User and Group Synchronization

  • Identity Enforcement

Verify the Integration

Confirm that:

  • Verax users can sign in using Okta.

  • Users and groups synchronize successfully.

  • Identity Enforcement is operating for supported AI tools.

Troubleshooting

Symptom

Cause

Resolution

Your Okta domain should not contain -admin

The administrator URL was used as the Issuer URI.

Use https://<domain>.okta.com/oauth2/default.

The client does not have a JWKSet configured

The key was not generated by Okta.

Generate a new key from the API Service application.

invalid_dpop_proof

DPoP is enabled.

Disable Require Demonstrating Proof of Possession (DPoP).

Client authentication failed

The Client ID and private key do not belong to the same application.

Verify the API Service Client ID and regenerate the key if necessary.

HTTP 403

Required API scopes were not granted.

Grant okta.users.read and okta.groups.read.

HTTP 403 E0000006

No Administrator role assigned.

Assign a role such as Read-only Administrator.

Policy evaluation failed / access_denied

The Authentication Policy requires additional authentication factors.

Update the Authentication Policy or enroll the required factors.

no_matching_policy

No Authorization Server Access Policy applies to the Verax application.

Create an Access Policy and allow the Authorization Code grant type.

Security Note

Treat all client secrets and private keys as sensitive credentials. Never share them in email, chat, support tickets, or documentation. If a secret or key is exposed, regenerate it immediately in Okta.