Sign in to Okta

You can add EntryIdP to Okta as an identity provider, so that your people sign in to Okta, and every app Okta already looks after, with an EntryIdP face scan. No code is involved: Okta's OpenID Connect identity provider works with any OpenID Connect provider, and EntryIdP is one.

You'll need about 20 minutes, an EntryIdP tenant administrator, and an Okta administrator.

How it works

1. Someone starts to sign in to Okta and chooses EntryIdP.
2. Okta sends them to EntryIdP. They do a face scan, and EntryIdP finds their account.
3. Okta reads their email address from EntryIdP and signs them in as the Okta user with that address.

Your people stay in Okta. EntryIdP only changes how they prove who they are.

Okta matches on email address

Okta links each sign-in to the existing Okta user whose username or email matches the one EntryIdP returns. EntryIdP only returns an email once the person has verified it, so an unverified address can't sign in to anyone's Okta account.

Before you start

• [ ] You have someone who can add identity providers in the Okta Admin Console.
• [ ] Each person who will use it has an EntryIdP account, made at {issuer}/me with Create Entry Account, using exactly their Okta email address.
• [ ] Each of them has verified that email in EntryIdP. They can see it on {issuer}/me.

Okta never asks EntryIdP to create an account, so a person with no EntryIdP account can't get through.

Step 1: Register Okta as an app in EntryIdP

In your tenant's admin portal ({issuer}/tenant), add a new app:

Setting	Value
Name	Okta
Type	Confidential (it has a client secret)
Scopes	openid profile
Redirect URI	https://{your Okta domain}/oauth2/v1/authorize/callback, for example https://acme.okta.com/oauth2/v1/authorize/callback

Leave Allow sign-in without PKCE off. Okta sends PKCE.

Copy the client ID and client secret. The secret is shown only once.

Limit who can use it

Turn on Require access approval for this app. Only people you approve can then sign in to Okta through EntryIdP.

Step 2: Add EntryIdP to Okta

In the Okta Admin Console:

1. Go to Security → Identity Providers, select Add identity provider, then OpenID Connect IdP.

2. Fill in:

   Field	Value
   Name	EntryIdP
   Scopes	openid profile. Remove email: EntryIdP refuses any scope it doesn't know.
   Client ID	From step 1
   Client secret	From step 1
   Authentication type	Client secret
   PKCE	On
   Issuer	{issuer}, with no trailing /
   Authorization endpoint	{issuer}/authorize
   Token endpoint	{issuer}/token
   JWKS endpoint	{issuer}/.well-known/jwks.json
   Userinfo endpoint	{issuer}/userinfo

3. Under Authentication settings:

   Field	Value
   IdP Username	idpuser.email
   Match against	Okta Username or Email
   Account Link Policy	Automatic
   If no match is found	Redirect to Okta sign-in page

4. Select Finish. Check that the Redirect URI Okta shows for the new provider is exactly the one you entered in step 1. If it isn't, for example because you use a custom Okta domain, copy Okta's into the EntryIdP app.

Your issuer is https://idp.entryidp.com on Production. See How it works for the other environments.

Why not let Okta create users?

Okta can create a new Okta user on someone's first sign-in. In our tests that failed with Okta's jit_failure error and no reason given, while linking to existing users worked. Since your people are already in Okta, linking is what you want anyway.

Step 3: Send people to EntryIdP

Add a routing rule under Security → Identity Providers → Routing Rules that sends the people you choose to the EntryIdP provider. Start with one test person or one group, not everyone.

Once the rule applies to someone, opening your Okta sign-in page takes them straight to EntryIdP.

Step 4: Test

Use a private browser window for each test.

Test	Expected result
A person with a verified EntryIdP email that matches their Okta user	Face scan, then their Okta dashboard
A person whose EntryIdP email isn't verified	Face scan, then the Okta sign-in page
A person whose EntryIdP email matches no Okta user	Face scan, then the Okta sign-in page
A person with no EntryIdP account	Face scan, then an Okta error: EntryIdP doesn't know their face

In our test, the whole sign-in took about 40 seconds, including the face scan.

Troubleshooting

What the person sees	Likely cause	What to do
A 403 with jit_failure, "Unable to create the user"	The provider is set to create Okta users	Set If no match is found to Redirect to Okta sign-in page and link instead (step 2)
The Okta sign-in page after the face scan	Their EntryIdP email isn't verified, or doesn't match their Okta username or email	They verify their email at {issuer}/me, or correct it to match Okta
An EntryIdP error that code_challenge is required	PKCE is off in the Okta provider	Turn PKCE on (step 2)
An EntryIdP error that the scope is invalid	Okta is asking for email or another scope EntryIdP doesn't know	Set the scopes to openid profile
An EntryIdP error about the redirect URI	The app's redirect URI doesn't match Okta's	Copy it again from the Okta provider, exactly

Turn it off

Remove or deactivate the routing rule in Okta. People go back to signing in the way they did before. Nothing needs to change in EntryIdP.

Good to know

• The face scan happens when someone signs in to Okta, not each time they open an app behind it. Okta's own session settings decide how often that is.
• Okta reads the email from EntryIdP's userinfo endpoint, not from the ID token, which carries no email or name.

See Okta's own guide: Add an OpenID Connect identity provider.