Okta identity provider integration

You can integrate your Okta identity provider (IdP) with Axiad Mesh to make sure that your users sign in to the portal securely.

The integration requires updates on both Okta and Axiad Mesh.

info

This guide covers using Okta to sign in to the Axiad Mesh portal. To collect identity data from Okta for correlation and risk analysis, see the Okta connector reference instead.

Okta IdP configuration steps

Important

These steps are Axiad's current understanding of the configuration. Because Okta is a third-party product, there may be slight variations between your experience and what this guide describes. We work hard to keep things as up to date as possible, but depending on the versions in use, the latest updates, and so on, there may be some mismatches.

If you find any blatant differences or anything that doesn't make sense, contact Axiad support with feedback on this article.

1. Sign in to your Okta administrative portal and go to Applications under the Applications menu.

2. Select the Create App Integration button.

3. On the Create a new app integration page, select OIDC - OpenID Connect as the Sign-in method.

4. Select Web Application as the Application Type.

   

5. Under General Settings on the New Web App Integration page, set the App integration name to a friendly name, for example Axiad Mesh.

6. Enable Client Credentials for the Grant type option.

7. Add the Sign-in redirect URI:

   • The format for this is https://mesh.axiad.io/oauth2/callback?domain=<domain>.
   • Replace <domain> with the name that matches the UPN domain component — for example, acme.com for users such as johnsmith@acme.com.
     • Copy this domain value — you enter it in the Domain field during the Axiad Mesh configuration steps.
   Multiple domain support

   You can configure multiple IdP connections in Axiad Mesh to handle multiple domains.

8. Under Assignments, select Limit access to selected groups, and then specify the groups that are allowed to access Axiad Mesh.

   • This step is optional but encouraged, to make sure that only the users you want to access Axiad Mesh have the ability to do so.

9. Select Save.

10. Copy the following information from the Okta setup to complete the configuration in Axiad Mesh:

    • Okta Tenant ID
    • Client ID
    • Client Secret
    note

    The Okta Tenant ID is the value without the okta- prefix, and it shouldn't include the -admin suffix.

Axiad Mesh configuration steps

note

You can integrate your Okta IdP with Axiad in the initial onboarding process as the primary IdP, or as a secondary IdP after you configured another IdP as the primary IdP.

For more information about the initial onboarding process, see Complete your Marketplace onboarding.

Initial onboarding configuration

If you're adding Okta as your primary IdP during your initial onboarding, complete the following steps.

1. After you select the access link in the Axiad Mesh welcome email, you're prompted to set up your primary IdP.

2. Set the Domain to the domain value included in the Okta redirect URI (step 7 of the Okta configuration).

3. Select Okta Single-sign-on from the Provider list.

4. Fill in the fields with the values you copied from the Okta configuration (step 10).

   

5. On the next screen, set the Admin groups based on which users you want to be Axiad Mesh admins when they sign in with Okta.

   Okta group limitations

   Only users that are in the groups you selected in step 8 of the Okta configuration can access Axiad Mesh. For any groups you add here, be sure that their members are included in any group limitations made in Okta.

   

6. Select Continue, and you're signed in to the Axiad Mesh portal for the first time.

Secondary IdP configuration

If you already have your initial IdP connected and need to add a new one, or you need to replace the existing one, you can connect your Okta IdP from the Axiad Mesh administrative portal.

1. From the home page, select the gear icon to open the Settings page.

   

2. Select Identity providers from the left menu, and then select + Add identity provider.

   

3. On the Add identity provider page, set the Domain to the domain value included in the Okta redirect URI (step 7 of the Okta configuration).

4. Select Okta Single-sign-on from the Provider list.

5. Fill in the fields with the values you copied from the Okta configuration (step 10).

6. Set the Admin groups based on which users you want to be Axiad Mesh admins when they sign in with Okta.

   Okta group limitations

   Only users that are in the groups you selected in step 8 of the Okta configuration can access Axiad Mesh. For any groups you add here, be sure that their members are included in any group limitations made in Okta.

   

7. After the fields are filled out, select Test Connection.

8. After a successful test, select Add & Connect.

9. When the setup is complete, the new IdP appears on the Identity providers page.