# Okta identity provider integration

You can integrate your Okta identity provider (IdP) with Axiad Mesh to make
sure that your users sign in to the portal securely.

The integration requires updates on both Okta and Axiad Mesh.

> **info**
This guide covers using Okta to sign in to the Axiad Mesh portal. To collect
identity data from Okta for correlation and risk analysis, see the
[Okta connector reference](../../connectors/idp/okta.mdx) instead.

## Okta IdP configuration steps

> **warning**
These steps are Axiad's current understanding of the configuration. Because
Okta is a third-party product, there may be slight variations between your
experience and what this guide describes. We work hard to keep things as up to
date as possible, but depending on the versions in use, the latest updates, and
so on, there may be some mismatches.

If you find any blatant differences or anything that doesn't make sense,
contact Axiad support with feedback on this article.

1. Sign in to your Okta administrative portal and go to **Applications** under
   the **Applications** menu.
2. Select the **Create App Integration** button.
3. On the **Create a new app integration** page, select
   **OIDC - OpenID Connect** as the **Sign-in method**.
4. Select **Web Application** as the **Application Type**.

   ![Okta's Create a new app integration page with OIDC - OpenID Connect selected as the sign-in method and Web Application as the application type](/img/imported/okta-identity-provider-integration/okta-create-app-integration.png)

5. Under **General Settings** on the **New Web App Integration** page, set the
   **App integration name** to a friendly name, for example **Axiad Mesh**.
6. Enable **Client Credentials** for the **Grant type** option.
7. Add the **Sign-in redirect URI**:
   - The format for this is `https://mesh.axiad.io/oauth2/callback?domain=<domain>`.
   - Replace `<domain>` with the name that matches the UPN domain component —
     for example, **acme.com** for users such as **johnsmith@acme.com**.
     - Copy this domain value — you enter it in the **Domain** field during the
       Axiad Mesh configuration steps.

   :::tip Multiple domain support
   You can configure multiple IdP connections in Axiad Mesh to handle multiple
   domains.
   :::

8. Under **Assignments**, select **Limit access to selected groups**, and then
   specify the groups that are allowed to access Axiad Mesh.
   - This step is optional but encouraged, to make sure that only the users you
     want to access Axiad Mesh have the ability to do so.
9. Select **Save**.
10. Copy the following information from the Okta setup to complete the
    configuration in Axiad Mesh:
    - Okta Tenant ID
    - Client ID
    - Client Secret

    :::note
    The **Okta Tenant ID** is the value without the `okta-` prefix, and it
    shouldn't include the `-admin` suffix.
    :::

## Axiad Mesh configuration steps

> **note**
You can integrate your Okta IdP with Axiad in the initial onboarding process as
the primary IdP, or as a secondary IdP after you configured another IdP as the
primary IdP.

For more information about the initial onboarding process, see
[Complete your Marketplace onboarding](../../getting-started/complete-onboarding.md).

### Initial onboarding configuration

If you're adding Okta as your primary IdP during your initial onboarding,
complete the following steps.

1. After you select the access link in the Axiad Mesh welcome email, you're
   prompted to set up your primary IdP.
2. Set the **Domain** to the domain value included in the Okta redirect URI
   (step 7 of the Okta configuration).
3. Select **Okta Single-sign-on** from the **Provider** list.
4. Fill in the fields with the values you copied from the Okta configuration
   (step 10).

   ![Initial configurations wizard on the Set up primary IdP step, with Okta Single-sign-on selected as the provider and fields for the Okta tenant ID, Okta client ID, and client secret value](/img/imported/okta-identity-provider-integration/onboarding-idp-okta-fields.png)

5. On the next screen, set the **Admin groups** based on which users you want
   to be Axiad Mesh admins when they sign in with Okta.

   :::warning Okta group limitations
   Only users that are in the groups you selected in step 8 of the Okta
   configuration can access Axiad Mesh. For any groups you add here, be sure
   that their members are included in any group limitations made in Okta.
   :::

   ![Initial configurations wizard on the Assign admins step, with the required Admin groups field](/img/imported/okta-identity-provider-integration/onboarding-admin-groups.png)

6. Select **Continue**, and you're signed in to the Axiad Mesh portal for the
   first time.

### Secondary IdP configuration

If you already have your initial IdP connected and need to add a new one, or
you need to replace the existing one, you can connect your Okta IdP from the
Axiad Mesh administrative portal.

1. From the home page, select the gear icon to open the **Settings** page.

   ![Axiad Mesh home page with the gear icon highlighted in the upper-right corner](/img/imported/okta-identity-provider-integration/settings-gear-icon.png)

2. Select **Identity providers** from the left menu, and then select
   **+ Add identity provider**.

   ![Identity providers page with the Add identity provider button highlighted](/img/imported/okta-identity-provider-integration/identity-providers-add.png)

3. On the **Add identity provider** page, set the **Domain** to the domain
   value included in the Okta redirect URI (step 7 of the Okta configuration).
4. Select **Okta Single-sign-on** from the **Provider** list.
5. Fill in the fields with the values you copied from the Okta configuration
   (step 10).
6. Set the **Admin groups** based on which users you want to be Axiad Mesh
   admins when they sign in with Okta.

   :::warning Okta group limitations
   Only users that are in the groups you selected in step 8 of the Okta
   configuration can access Axiad Mesh. For any groups you add here, be sure
   that their members are included in any group limitations made in Okta.
   :::

   ![Add identity provider dialog with Okta Single-sign-on selected and fields for the domain, Okta tenant ID, Okta client ID, client secret value, and admin groups](/img/imported/okta-identity-provider-integration/add-identity-provider-okta.png)

7. After the fields are filled out, select **Test Connection**.
8. After a successful test, select **Add & Connect**.
9. When the setup is complete, the new IdP appears on the
   **Identity providers** page.

   ![Identity providers page showing the newly added IdP in the list](/img/imported/okta-identity-provider-integration/identity-providers-list.png)