Okta Authenticator (Preview/OIE)

This page describes how to set up Incode as an OIDC-based Authenticator within an Okta Identity Engine (OIE) environment. The result is an Incode biometric factor that can be required in Okta Enrollment and Authentication Policies, functioning as MFA for any applications you choose to protect.

If your organization uses Okta Classic, use the separate steps for Okta Authenticator (Classic) instead.

Prerequisites

Ensure you have the following before you begin:

• Access to the Integrations page in Dashboard. Contact your Incode Representative if you do not see it.
• Okta IDP Integration prerequisites complete.
• An Okta Identity Engine (OIE) instance.
• An Okta administrator account with permissions to manage Identity Providers, Authenticators, and Authentication Policies.
• Access to the Incode Omni Dashboard with the Integrations Ecosystem feature enabled.

Set Up Okta IDP Integration for Preview/OIE

Create an OIDC Identity Provider in Okta

1. Log in to your Okta Admin Console.
2. Go to Security > Identity Providers > Add Identity Provider.
3. Select OpenID Connect IDP.
4. Add a name for the IDP and set the mode to Factor Only.
5. Ensure the following scopes are included: email, openid, and profile.

Create the Integration in Dashboard

1. Log in to Dashboard.
2. In the left menu, click Integrations.
3. Click New Integration.
4. From the IAM tab, click Okta IDP, then click Continue.
5. Enter a Name for this integration. This name appears in analytics and identifies verifications completed through this integration.
6. Select a Workflow for this Integration from the drop-down.
7. Copy the following values to the corresponding fields in your Okta OIDC IDP configuration:
   • Client ID
   • Client Secret
   • Issuer URL
   • Authorize URL
   • Token URL
   • JWKS URL
   • Userinfo URL
8. In another tab or window, open Okta. Set the Authentication type to Client secret.
9. Click Save in Okta.
10. Copy the Redirect URI generated by Okta after saving.
11. Back in Dashboard, paste the Redirect URI from Okta into the Redirect URLS field in the integration configuration.
12. Review your settings and click Save.

Create an Okta Authenticator

1. In the Okta Admin Console, go to Security > Authenticators > Add Authenticator.
2. Select IDP Authenticator from the list of available authenticator types.
3. Select the Incode IDP you created in the first set of steps.
4. Set the authenticator name to Incode and upload the Incode logo.
5. Click Save. The authenticator is now available for use in enrollment and authentication policies.

📘

Note

Okta automatically adds new IDP authenticators as optional to the default policy. If this is not desired for your organization, disable this in the default policy after saving.

Create an Enrollment Policy

Enrollment policies control which users are required to enroll with the Incode authenticator. Okta checks enrollment policy compliance at account creation and every login.

1. In the Authenticators menu, go to the Enrollment tab and select Add a Policy.
2. Enter a name and description.
3. Assign the Okta user group you want to require Incode verification for.
4. Set both Password and Incode as Required, along with any other MFA methods your organization uses.
5. Click Save.

Create an Authentication Policy

Authentication policies determine when the Incode authenticator is required during login.

1. Go to Security > Authentication Policies > Add a Policy.
2. Enter a name and description.
3. Add a rule and configure it:
   • Assign the user group you created for Incode verification.
   • Set the authentication requirement to Password / IDP + Another Factor.
   • Select Allow specific authentication methods and add Incode and Password.
4. Click Save.
5. Go to Applications and assign the applications this policy should apply to.

Test the Integration

Incode recommends testing the login process for the selected applications to confirm the authentication policy works as expected before rolling it out to all users.