Loading…
Okta
Identity and access management company providing authentication, authorization, single sign-on, and identity security solutions.
- 69 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
Propel Your SaaS Apps Into the Future at Oktane
Okta invites SaaS application builders to Oktane 2024, held at Caesars Forum in Las Vegas from October 15–17, to discuss how identity and user lifecycle platforms can support secure B2B SaaS applications. The announcement frames identity as increasingly complex, with a growing protection surface expected to influence SaaS roadmaps and developer priorities. Attendees can join three breakout sessions, visit the Dev Hub, attend hands-on labs, and connect at a B2B SaaS builders happy hour or the Okta Workflows community meetup. Lab topics include moving Okta app configurations from PowerShell into Terraform, signing users out across apps with one API, and identifying inactive users with Okta Workflows. Some activities require Oktane attendance, while labs have limited, first-come-first-served capacity and the happy hour is invitation-based.
Secure OAuth 2.0 Access Tokens with Proofs of Possession
Bearer access tokens grant whoever possesses them access, making theft especially risky for public clients such as SPAs and mobile apps. DPoP, an OAuth 2.0 extension, binds a token to a client’s public key and uses signed proofs so authorization and resource servers can verify requests. The tutorial migrates an Angular single-page application from bearer tokens to DPoP while building on the Authorization Code flow, inspecting token exchanges, request headers, replay protection, and calls to Okta’s APIs; React and Vue variants are also noted. It recommends IndexedDB with non-exportable WebCrypto keys, cleanup during sign-in, and browser capability checks, while noting that the preserved setup instructions no longer work exactly as written after Okta’s May 2025 account changes.
Elevate Access Token Security by Demonstrating Proof
Bearer access tokens let anyone holding a valid token call a resource server, creating risk when tokens are stolen. Existing protections include secure coding, short expiration, and origin restrictions, but the post presents OAuth 2.0 Demonstrating Proof of Possession (DPoP) as a way to bind tokens to client-generated cryptographic proof. The client creates a JWT containing request details, issue time, unique identifier, and public key; the authorization server uses it to bind a key hash and request information to the returned token. For sensitive requests, authorization or resource servers can require a nonce, prompting a new proof and limiting lifetime and replay risk. Resource servers must validate both proof and access token properties, with a vetted OAuth library recommended.
Approaches to keep sending OTP over SMS... for now
SMS and voice OTPs remain broadly applicable for identity verification, but the post argues they should eventually be replaced because SIM swapping, phishing, uncontrolled secret-delivery channels, device-linking gaps, and slower logins weaken them. Until then, Okta will require organizations to bring their own telephony provider, using a telephony inline hook to send codes and report outcomes. The implementation can be built in-house, outsourced, or delegated to a managed service, with regional regulations, traffic peaks, reliability, branding, security, and available resources shaping the choice. A hook has three seconds to return success or failure before Okta’s heavily rate-limited failover sends the message; teams must also secure endpoints and API keys, monitor logs, and handle vendor or delivery failures.
How to Use Okta's PowerShell Module to Manage Your Okta Org
The tutorial shows how to use Okta’s official PowerShell module to administer an Okta org, covering authentication, user operations, group management, and broader API automation. It requires a PowerShell terminal, the module installed from the PowerShell Gallery, Chocolatey, or GitHub, plus an Okta Developer Edition account for the setup described. Authentication uses an OIDC Native application with the Device Authorization grant, a client ID, the org base URL, and the okta.users.manage and okta.groups.manage scopes; Invoke-OktaEstablishAccessToken completes authorization. Examples search and retrieve users, create and update profiles, create groups, add users, and inspect memberships with PowerShell pipelines and formatting cmdlets. The demonstrated workflow connects successfully and manages users and groups, while the same techniques are presented as applicable to other Okta API endpoints.
Okta at RSA Conference 2024
Okta’s RSA Conference 2024 presence includes a May 7th session on identity as a defense against breaches and a booth featuring the Shared Signals Framework (SSF) and Universal Logout. Attackers can exploit weak passwords, phishing credentials, and privileged access, while applications may lack the cross-service context needed to identify suspicious account behavior. SSF, developed by the OpenID Foundation, enables software to send and receive signals about user behavior so services can respond according to their threat models. Universal Logout lets administrators and automation end a user’s existing sessions with an identity provider, complementing SSF and intrusion detection tools; Okta’s feature was not yet released. The post points to a build-your-own endpoint, SSF resources, and a pilot program for integrators.
Build and Integrate Universal Logout with Okta
The tutorial builds Universal Logout for an OIDC-enabled SaaS Todo application so enterprise administrators can end suspicious user sessions after account compromise or other detected risk. It explains how to create a /global-token-revocation endpoint, connect it to the Express app, identify a user from the revocation request, and invalidate that user's application session. Initial protection uses an API key, while the updated flow upgrades authorization to OAuth 2.0 Private Key JWT with the Okta JWT Verifier library. The tutorial then exposes the endpoint publicly, configures Okta Admin Console integration, and describes optional OIN submission with Private Key JWT and an email identifier for sub_id. In the test, an admin clears the user's sessions and tokens; the Todo app redirects the user to login when they attempt to add a task, demonstrating Universal Logout works.
Introducing Okta's Official PowerShell Module
Okta’s official PowerShell Module provides PowerShell-based access to Okta group, group-rule, and user operations. The post shows installation from PSGallery, configuration with an organization base URL, client ID, and OAuth 2.0 scopes, followed by browser-based token establishment. Examples create a “Sales Team” group, define a rule that assigns users with the title “Sales Representative,” activate it, and create a matching user during onboarding. A second script imports employee records from a CSV, copies each property into a user profile, uses the email as the login, and calls New-OktaUser for each row. The source presents these workflows as examples for automating employee data synchronization when a custom tool lacks OIDC or SCIM compatibility.
How to Prepare Your Self
Okta warns that applications using its embedded Sign-In Widget may encounter Chrome login problems after January 1, 2025, when Google’s temporary exemption allowing third-party cookies ends. The guidance recommends testing with Chrome feature flags and watching for console errors, unexpected reauthentication, or logout during session extension. It presents four migration paths: issue first-party cookies through a custom domain, use the authorization code flow with refresh tokens, configure AuthJS with the offline_access scope, or replace deprecated sessions/me calls with supported OAuth and revocation mechanisms. A custom domain can require CSP updates for externally hosted sign-in resources, while offline_access must be enabled both on the authorization server and in application code. An Okta-provided script offers a temporary exemption through the end of 2024, but it is not a lasting fix.
Add Step
The tutorial shows how to add OAuth 2.0 Step Up Authentication Challenge support to an Angular frontend and NestJS backend, so sensitive routes and API resources can require stronger authentication than ordinary access. It starts from a Lerna monorepo, configures an OAuth 2.0/OpenID Connect single-page application, and uses Okta libraries plus an Okta JWT Verifier to establish the basic authenticated app. The implementation checks authentication assurance through token ACR claims, returns the standard insufficient_user_authentication error when an API request lacks the required assurance, and uses Angular interceptor and application-code handling to redirect with acr_values before retrying. It also describes authentication recency through max_age and auth_time, while noting that the original Okta CLI instructions no longer work exactly as written after the May 2025 account-plan change.
How to Manage User Lifecycle with .NET and SCIM
Managing users across multiple systems can be slow, error-prone, difficult to synchronize, and a security risk, so the tutorial uses SCIM to standardize lifecycle operations. It builds a .NET 8 SCIM server with RESTful CRUD endpoints for the User resource, backed by Entity Framework Core and SQLite, and seeds sample users and emails for testing. Swagger UI is used to inspect and exercise the API, while Okta acts as the SCIM client and identity provider after OAuth-protected endpoints and provisioning are configured. The walkthrough tests importing users, syncing assignments, deprovisioning by setting active to false, reprovisioning by setting it to true, and propagating profile changes; however, the original Okta CLI instructions no longer work exactly as written after the May 2025 plan and tooling changes.
The End of Third
The post explains how browser phaseouts of third-party cookies can affect Okta authentication patterns and session features. Third-party cookies are issued by other domains and can support cross-site session introspection, federated login-related behavior, and convenience features, but browsers increasingly restrict them because of security and privacy concerns. Most Okta core authentication flows do not require them; however, applications using an Okta session across different top-level domains, customer-hosted sign-in experiences, ADSSO, and certain “remember me” functions may lose session introspection or extension while basic authentication and token return remain possible. The post recommends testing with Chrome’s third-party cookies disabled, using feature flags, and migrating away from these cookies before Google’s stated exemption ends in 2024.
Flexible Authentication Configurations in Angular Applications Using Okta
This tutorial shows how to configure Okta authentication in an Angular standalone application, comparing values embedded in the app, build-time environment files, and runtime-loaded configuration. It scaffolds an Angular 17 project, creates an Okta OAuth 2.0/OpenID Connect single-page client, installs @okta/okta-angular 6.3 and @okta/okta-auth-js 7.5, and wires routes, guards, claims, and an authorization-header interceptor. Runtime configuration is served from src/api/config.json and loaded during startup through APP_INITIALIZER, using HttpBackend so the authentication interceptor does not intercept the configuration request; the resulting properties populate OktaAuthConfigService. The sample verifies sign-in, profile access, protected routes, and sign-out, while noting that the original Okta CLI instructions are deprecated and no longer work exactly as written after May 2025.
How I Built an Okta Documentation Chatbot in Python
Okta developer documentation contains information developers need for integrations, but the author observed that it was underused. They built Oktanaut, a Python chatbot in Jupyter Notebook, comparing a LlamaIndex-based prototype trained on Okta documentation with a GPT-3.5-powered version using the OpenAI API. The first favored precision for focused questions, while the second handled a broader range; the final demo used OpenAI API for its larger models and user-friendly experience. For both versions, the author curated questions, answers, and support engineer information, stored training data in Google Drive for Colab, and retained historical interactions so replies could use session context. Panel provided the frontend, and the author chose Jupyter Notebook for simple setup despite noting bugs and glitches.
Winners of the AI and Identity Okta Hackathon 2023
The AI and Identity - Okta Hackathon 2023 challenged developers to build applications combining identity standards with AI, drawing 576 registrants, 22 submissions, and nine eligible entries. Judges selected Facets Wellness App for first place and $10,000 plus a future Okta Dev Advocacy Podcast appearance; IHealthHist took second with $5,000, and AITrainsYou.com took third with $3,000. Facets provides snippet-based wellness modules for emotional regulation and intelligence, journaling, values, and goals, while the other winning projects address medical-history storage and AI-powered team learning. converse.ai received the $500 honorable mention for document conversations, with judging comments citing implementations of OIDC, SCIM, and AI across the winners. Separate “most supportive hacker” prizes went to Hong Tran, Monish Basaniwal, and Deependra Gaur for forum support and guidance.
Step
Step-up authentication lets an application permit access to non-critical resources with basic authentication while requiring additional authentication for sensitive resources. The post describes how Okta Workforce Identity Cloud supports this pattern across modern OIDC applications and legacy integrations. For OIDC, applications use the /authorize endpoint’s acr_values and max_age parameters to request a mapped higher assurance level for a limited period, or prompt=login to force re-authentication each time. For non-OIDC applications, privileged Factor API operations can issue and verify challenges through a protected middleware layer using an Okta API token, while Okta Access Gateway can enforce step-up through advanced policies. Transactional MFA is presented as an alternative using OIDC CIBA, but the source defers its detailed treatment.
Why You Should Migrate to OAuth 2.0 From Static API Tokens
Static API tokens provide a simple way to authorize calls to protected third-party APIs, but their long lifetimes, broad permissions, and lack of user context create security and auditing risks. OAuth 2.0 addresses these limitations through a centralized authorization server that issues short-lived access tokens, which clients send in the Authorization header with the Bearer scheme. The post describes Client Credentials for service-to-service interactions and explains that scopes can distinguish permissions such as okta.users.read and okta.users.write; other configurations support task-based automation and user access through web applications. Migration guidance recommends implementing new calls with OAuth 2.0, applying least privilege, testing expiration and error handling, and securing private keys and JWKS generation before production deployment.
Enterprise Maturity Workshop: Automate with no
This tutorial shows how to extend a SaaS Todo application with a weekly organizational report using Okta Workflows, a no-code automation platform. It adds an API service to the application, exposes the local app through a tunnel, and configures a scheduled flow to retrieve all todo items. A helper flow processes the returned list with a Reduce card, carrying accumulated text in a memo field before producing one summary for the Gmail Send Email card. The report is sent automatically by email after the items are combined. The workshop concludes by enabling both flows and testing the automation, while noting that the local setup is for demonstration and that a real-world application would be deployed in the cloud.
We're Living in a Passwordless World
Passwords and SMS one-time passwords are presented as vulnerable authentication methods, while the post explains how FIDO and W3C standards support passwordless, phishing-resistant sign-in. It contrasts passwords, SMS OTP, TOTP, and U2F security keys, then introduces FIDO2, which combines WebAuthn with CTAP2 and asymmetric cryptography. The registration and authentication walkthrough describes the Relying Party, client, server, browser, and authenticator interactions, including device-based PINs and biometrics. Passkeys build on WebAuthn and can work across compatible browsers and devices, with migration within some vendor ecosystems described as an additional convenience. Developers can call navigator.credentials.create and navigator.credentials.get directly or use libraries, while Identity Providers such as Okta can provide FIDO2 support through configuration.
Enterprise
This workshop shows SaaS developers how to add SCIM provisioning to an application so enterprise customers can manage users across systems, including people who have not yet logged in. It builds SCIM server functionality into a React and Express Todo application, connects it to an Okta client, and tests lifecycle operations such as importing, updating, deprovisioning, and reprovisioning users. The implementation follows SCIM 2.0 with JSON-based REST endpoints for creating, retrieving, filtering, updating, and deleting users, plus bearer-token authentication, SCIM content-type headers, logging, and soft deletion. It also explains production considerations, including unique identifiers and mapping each request’s API token to the correct organization for multitenancy. The completed application supports OIDC authentication alongside SCIM provisioning.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.