I’m currently working on setting up an authentication flow where Okta serves as the authorization server managing token issuance, while an external facial identity provider handles user authentication as describe in this documentation
Here’s the high-level plan:
- User Flow:
- A user initiates access to a protected resource through my application’s client.
- The client redirects the user to Okta’s
/authorize
- Redirection to External Provider:
- Okta, configured with the external provider as an Identity Provider (IdP), redirects the user to the external provider for authentication.
- Authentication Process:
- The external provider authenticates the user and returns an authorization code back to Okta.
- Token Exchange and User Identification:
- Okta validates the authorization code from the external provider.
- It issues tokens (access and ID tokens) to the application’s client, including claims necessary for user identification.
Key Concerns:
- Most importantly, does this user flow make sense, or am I missing something important in this integration?
- How can I ensure that the authorization code provided by the external provider is securely generated, transmitted, and validated by Okta?
- What configurations are recommended in Okta to handle the token exchange efficiently once it receives the authorization code from the external provider?
Any advice or examples of similar implementations would be highly appreciated!