Okta Authenticator (Classic)

This page covers setting up Incode as an OIDC-based authenticator in an Okta Classic environment. If your organization uses Okta Identity Engine (OIE), follow the Okta Authenticator (Preview/OIE) steps instead.

---

Prerequisites

Ensure you have the following before you begin:

• Access to the Integrations page in Dashboard. Contact your Incode representative if you do not see it.
• Okta IDP integration prerequisites complete.
• An Okta Classic instance.
• An Okta administrator account with permissions to manage Identity Providers and Policies.

---

Set Up Okta IDP Integration for Classic

Create an OIDC Identity Provider in Okta

1. Log in to your Okta Admin Console.
2. Go to Security > Identity Providers > Add Identity Provider.
3. Select OpenID Connect.
4. Enter a name for the IDP and set the mode to Factor Only.
5. Ensure the following scopes are included: email, openid, and profile.

Do not save yet. You will need values from Dashboard in the next set of steps to complete this configuration.

Create the Integration in Dashboard

📘

Tip

This requires copying values between Dashboard and your Okta Admin Console. Keep both tabs open.

1. Log in to Dashboard.
2. In the left menu, click Integrations.
3. Click New Integration.
4. From the IAM tab, select Okta IDP, then click Continue.
5. Enter a Name for this integration. This name appears in analytics and identifies verifications completed through this integration.
6. Select a Workflow for this integration from the drop-down.
7. Copy the following values from Dashboard into the corresponding fields in your Okta OIDC IDP configuration:

8. In Okta, set the Authentication type to Client secret.
9. Click Save in Okta.
10. Copy the Redirect URI generated by Okta after saving.
11. In Dashboard, paste the Redirect URI into the Redirect URLs field in the integration configuration.
12. Click Save.

Configure Policies in Okta Classic

Okta Classic uses a different policy structure than OIE. Rather than separate enrollment and authentication policies, Classic uses per-application sign-on policies to enforce MFA requirements.

1. In the Okta Admin Console, go to Applications and open the application you want to protect with Incode verification.
2. Open the Sign On tab.
3. Under Sign On Policy, click Add Rule.
4. Configure the rule:
   • Set the conditions to match the user group you want to require Incode verification for.
   • Under Access, set Multifactor Authentication to Required.
   • Ensure the Incode IDP factor is listed as an allowed factor.
5. Click Save.
6. Repeat for any additional applications you want to protect.

📘

Note

In Okta Classic, sign-on policies are configured per application, not globally. You must add an Incode rule to each application you want to protect. If you manage many applications, consider using Okta Identity Engine (OIE) for centralized policy management.

---

Test the Integration

Sign in to one of the configured applications using a test user account in the enrolled group. The login flow should prompt for password followed by the Incode biometric verification step.

Confirm the following before rolling out to all users:

• The Incode authenticator appears as an MFA option after password entry.
• The user is redirected to an Incode verification session and can complete
  it on their mobile device.
• After successful verification, the user is granted access to the
  application.
• Failed verification blocks access and does not allow the user to proceed.

⚠️

Warning

If the Incode factor does not appear, verify that the sign-on policy rule is applied to the correct user group
and that the Incode IDP is listed as an allowed factor in the rule. Changes to Okta Classic policies take effect immediately but may require a fresh browser session to reflect for active users.

---

What's Next

• Okta Authenticator (Preview/OIE)
• Configure Incode as an SSO provider
• Okta Directory Sync