Signing up with Okta Workforce Identity Cloud

Prerequisites

An Okta Workforce Identity Cloud account.

Create a new Okta OIDC - OpenID Connect - Application Integration

Create the app integration

• Log into your Okta Admin Console
• Navigate to Applications, Applications and click Create App Integration
• For Sign-in method, select OIDC - OpenID Connect
• For Application type, select Web Application
• Click Next

Configure General Settings

• In the General Settings section, enter the name XplicitTrust Network Access - OIDC
• Under Grant type, select Refresh Token

Configure Redirect URLS

• In the Sign-in redirect URLs section, enter https://api.xplicittrust.com:443/v1.0/auth/callback/okta

Configure Assignments

• In the Assignments section, select Skip group assignment for now.
• Click Save

Configure the Okta OIDC - OpenID Connect - Application Integration

Save the Client Credentials

• Go to the newly created XplicitTrust Network Access - OIDC app
• Copy the Client ID and the Client Secret and save it for later use.

Configure User Consent behavior

• Scroll to the General Settings section on the same tab and click Edit
• Scroll to the USER CONSENT subsection and deselect Require Consent
• Scroll down the General Settings section and click Save

Configure the XplicitTrust roles attribute

• Navigate to the Sign On tab

• Click Configure profile mapping and close the mappings view right away (with the x in top right)
• Fill out the Add Attribute form as shown in the picture above and click Save

• Fill out the Add Attribute form
• Click Save

Configure the OpenID Connect ID Token Groups claim

• Navigate to the Sign On tab
• Scroll down to the OpenID Connect ID Token section and click Edit
• Configure the following settings:

Configure the Administrator Group Assignment

• Navigate to the Assignments tab
• Click Assign and Assign to Group

• Select a group that you would like to give Admin Access to the XplicitTrust Management Console and click Assign
  
  

• Select Administrator

• Click Save and Go Back and then Done

Install XplicitTrust Network Access API Service Integration

• Log into your Okta Admin Console
• Navigate to Applications, API Service Integrations, Add Integration and choose XplicitTrust Network Access
• Click Install & Authorize

• Once authorization is complete Okta will provide you with the information below which you will need to copy and save for the configuration of XplicitTrust Network Access
• Copy the Client Secret and click Done

• Copy your Okta Domain & Client ID

Sign Up for XplicitTrust Network Access

• Navigate to https://console.xplicittrust.com/#/signup/okta
• Fill in your Okta domain as Issuer URL (for example: https://{your-domain}.okta.com, remove the -admin part in the URL, as it is just the login for the administrator console)
• Fill in the Client ID and Client Secret from the Okta OIDC Application Integration
• Fill in the Okta API Service Client ID from the Okta API Service Application Integration

• Fill in the Okta API Service Client Secret from the Okta API Service Application Integration

• Click the Sign Up button.

• Follow the Okta login process.

• You are now signed in to the XplicitTrust admin portal:
  https://console.xplicittrust.com/

• You can review and change the Okta Integration settings under Account, Settings

Why is an Okta API Service Integration required?

To allow XplicitTrust to fetch existing user groups for the group import, an Okta API Service Integration has to be created that has the following scopes from the Okta Admin Management API :

Scope	Description	Reason
okta.groups.read	Read group information.	Required by the User Groups Import feature, that allows to import groups from the Okta Directory to be used in XplicitTrust Policies.
okta.users.read	Read user' group membership information.	Required to synchronize the users Group Memberships.