Okta Authenticator (Classic)

This guide covers setting up Incode as an OIDC-based authenticator in an
Okta Classic environment. If your organization uses Okta Identity Engine
(OIE), follow the
Okta Authenticator (Preview/OIE)
guide instead.

Prerequisites

• Access to the Integrations page in the Incode Dashboard. Contact your
  Incode representative if you do not see the Integrations page.
• Completed the
  Okta IDP integration
  prerequisites
• An Okta Classic instance
• An Okta administrator account with permissions to manage Identity
  Providers and Policies

---

Set up guide

Step 1: Create an OIDC Identity Provider in Okta

1. Log in to your Okta Admin Console.
2. Navigate to Security → Identity Providers → Add Identity
   Provider.
3. Select OpenID Connect.
4. Configure the IDP with a name and set the mode to Factor Only.
5. Ensure the following scopes are included: email, openid, profile.

Do not save yet — you will need values from the Incode Dashboard in Step 2
to complete this configuration.

Step 2: Create the Okta IDP integration in Incode

📘

Note

This step requires copying values between the Incode Dashboard and your
Okta Admin Console. Keep both tabs open simultaneously before proceeding.

1. Log in to Dashboard.
2. In the left navigation, click Integrations.
3. Click New integration.
4. From the IAM tab, select Okta IDP, then click Continue.
5. Enter a Name for this integration. This name appears in analytics
   and identifies verifications completed through this integration.
6. Use the dropdown to Select a Workflow for this integration.
7. Copy the following seven values from the Incode Dashboard into the
   corresponding fields in your Okta OIDC IDP configuration:

8. In Okta, set the Authentication type to Client secret.
9. Save the IDP configuration in Okta.
10. Copy the Redirect URI generated by Okta after saving.
11. Back in the Incode Dashboard, paste the Redirect URI into the
    Redirect URLs field in the integration configuration.
12. Click Save.

Step 3: Configure policies in Okta Classic

Okta Classic uses a different policy structure than OIE. Rather than
separate enrollment and authentication policies, Classic uses per-application
sign-on policies to enforce MFA requirements.

1. In the Okta Admin Console, navigate to Applications and open the
   application you want to protect with Incode verification.
2. Open the Sign On tab.
3. Under Sign On Policy, click Add Rule.
4. Configure the rule:
   • Set the conditions to match the user group you want to require Incode
     verification for
   • Under Access, set Multifactor Authentication to Required
   • Ensure the Incode IDP factor is listed as an allowed factor
5. Save the rule.
6. Repeat for any additional applications you want to protect.

📘

Note

In Okta Classic, sign-on policies are configured per application, not
globally. You must add an Incode rule to each application you want to
protect. If you manage many applications, consider using Okta Identity
Engine (OIE) for centralized policy management.

Step 4: Test

Sign in to one of the configured applications using a test user account in
the enrolled group. The login flow should prompt for password followed by
the Incode biometric verification step.

Confirm the following before rolling out to all users:

• The Incode authenticator appears as an MFA option after password entry
• The user is redirected to an Incode verification session and can complete
  it on their mobile device
• After successful verification, the user is granted access to the
  application
• Failed verification blocks access and does not allow the user to proceed

📘

If the Incode factor does not appear

Verify that the sign-on policy rule is applied to the correct user group
and that the Incode IDP is listed as an allowed factor in the rule.
Changes to Okta Classic policies take effect immediately but may require
a fresh browser session to reflect for active users.

---

Next steps

• Okta Authenticator (Preview/OIE)
• Configure Incode as an SSO provider
• Okta Directory Sync