# SSO Okta App Integration

{% embed url="https://youtu.be/WRz2Xt0xIdo" %}

### Prerequisites&#x20;

* Users are required to access to Cloud Defense Account

### Step 1: SignUp with OKTA account

Before creating an APP in OKTA, first login to Cloud Defense. Inside the Integrations tab, go to SSO, click on OKTA and copy the redirect URL.

<figure><img src="https://lh5.googleusercontent.com/OhZ1HI6jI5xl_HPtnf0jeJGwz7EKNkmzXT-c0cRsGBp_3pX6F06ekcWX9hWXg1W_0WBuIyrmF5TuOeuH1R168m906t_s5joFrvO1OsKbNjyBeipif0JYHgSf2pUR9OaTyvkKbK2kdjwLRICcE2eUtAQ-48ziVjm4IKFlzyUc9x0Irm21Hyj_tOpt2A" alt=""><figcaption></figcaption></figure>

### Step 2: Create App Integration with OKTA Account

Go to the applications page in OKTA, and click on Create App Integration.

<figure><img src="https://lh6.googleusercontent.com/WxuC36QCQRxFtx8_sU_fkTJhpPTz-IN8V0C63dkWwdN7YE8qZ_caEWHCKUnRMUHZrY-e1Ro-7hx3jY_q6x16e8GjIi6MWJOtiZjiLuT_FwOdXCryuYdo-X9eLSBPpFbitSA4_xtUVlHNc36srO9owjWgvU5HPoV9yVwp8SHqT6PR4YIsZRDR9y5kDw" alt=""><figcaption></figcaption></figure>

**Select Open-id connect as sign in method, and web application as Application**

<figure><img src="https://lh4.googleusercontent.com/UvtIWel5t6-UsekPHJI68FgqTd5ZjeI6fICfV0-fOLzlTggI9X4mF2d7T3fTw27lRspoiUdzdO828x93XnB9fcPCc5uQ854dPFAUYpIdc8GoMNQY3ZJTBHWzdANQBaDChDLHrJFkb9VX9YQenbLJoz8oglrzn6O2V1bkX-YVR8afXfjrC3YbefdYyg" alt=""><figcaption></figcaption></figure>



In General Settings, enter App name, select Grant type as Client credentials and Authorization code as Client acting on half of a user, enter the redirect url copied from Cloud defense application, and paste it in redirect URLs.

<figure><img src="https://lh4.googleusercontent.com/30e-Az3JHlKmH9wRZ5IfbV7_kS-oLlQfc4SYmzHpmvg9Ea7pXmRNnF0CXFDwgMSxaeR3N27wKbk1dI7cmxCwGdSlNJJhNQD12jhJ6axMh86tgoYjiSLh-hQMZSQfai_RclnYK49GsbwjdCHr84l_0Qs5EoAAD80_QTIis3FngcHR1XJiwHTMa2C80w" alt=""><figcaption></figcaption></figure>

#### &#x20;   Select Controlled access value from Dropdown option.

<figure><img src="https://lh3.googleusercontent.com/__9PsT0x7TRADJtqDOsfsmFDh9ts_JFRrmijs9bSjt7yoKf5IgHb5YM9gJ3dN3nGRWNj1xV1nB_7Knl9kTYYCOoLdU1yL6nPFq8ecl0TPYu8Nr5zELovvsfBYRwHO5xqnGOd_KKlQ8MWajZv9_0_j6_nZno6I8LsZkF8OpkvwLe031DWrY4yT0M8LQ" alt=""><figcaption></figcaption></figure>

#### Cope the client ID and secret of the APP

<figure><img src="https://lh3.googleusercontent.com/eGKJwAPYOLox-47GFiS-Dg6OdyDXmL71zo1-B3luyy1A538WSJjqOoeXIbNTJUjJsJfcenl6FNpo1-itHV5yco4Wye14K91onKQiO0UlqS3YOi-IpLbKcQZFbnruReH69jUEktVmTMflphoc0pYymnHcSZI70k8AwaQeWkWXwA-nUDd8RB7t9u-U3A" alt=""><figcaption></figcaption></figure>

#### Paste Id and Secret in our application integration page inside OKTA

<figure><img src="https://lh6.googleusercontent.com/Y2PRSEwH9vu5Gb8SDjt6EqPwYe65MLNL-KCyu_n0uAAXMYixLCuzpNcEcqkqgUtzsmuyNBk6B6FRR6G5_5v8irAT9JBPF6M0OktLnqQIhmtxxmGv5sIrBvOcazI9IsAvK3qHoq5K2aVgEOnmjA1hKSY4cKDRafwabixSOr9Hv-gHETT9m4K8tJs5ag" alt=""><figcaption></figcaption></figure>

#### Sign in with your email ID with which you registered on OKTA

<figure><img src="https://lh5.googleusercontent.com/YhYtCGnugAwCLhv6asSUP1GmC6XzChtzWtX0biFRTe0F_Lh8L94Il7wplUSELYx5eZaFZ6qlboHo_TpL5iiqv6vvyYodhuE9u_ucqIYDUXyOvx_cJXRmjcmdDAtjR1B146CTyRSynha7TvZfq14NTx3Ak-0NwslGBjuysCD-yHWXOyh1S4y3ZonWsQ" alt=""><figcaption></figcaption></figure>

### TROUBLESHOOTING STEPS:

#### 1- Unexpected error while authenticating with identity provider and API is giving 502 bad gateway.&#x20;

#### **JIRA LINK - https://clouddefense.atlassian.net/browse/CD-187**

Fix- Check the client id and client secret. Most probably the issue will be with credentials, if other IDPs are working. In case all IDPs are not working and showing the same issue, then we can probably look at ingress logs. https://stackoverflow.com/questions/42613491/azure-ad-webapp-behind-reverse-proxy-receives-502-bad-gateway

#### 2- Invalid Username or Password



This error comes when we add the first login flow in identity provider settings as Linking Broker Flow. This error comes when we try to login with a new identity provider and email already exists with some other identity provider. In this case the below API fails and in the events we receive&#x20;

**IDENTITY\_PROVIDER\_FIRST\_LOGIN\_ERROR** `https://staging.clouddefenseai.com/auth/realms/cdefense/login-actions/first-broker-login?client_id=cdconsole&tab_id=o`

The first step to debug this issue is to check the linking broker flow settings inside the authentication tab. Make sure if _Create User If Unique_ and _Automatically Set Existing User_ both are set to Alternative. Also check if both are added in the same order mentioned above.

#### 3- Issues related to application redirecting to incorrect URLs

<figure><img src="https://lh6.googleusercontent.com/rBusJ4hDAYVZ2XRcjMbmRmeMSJU0w-oBDTZ8Pib5wMJMwW53ntWvNJgQF0q8jPLyUmiM1kXQ8Ni7ATpdUDTjn5v-goqtbC51DtCOxdTHCleXlDftHmsPMcb7_NjDzEJ-apBpuA0U05Kgg_kL7nG4R4mDxk1IYUSO1oh9QZt75lye5iS-WFrDWtFbaA" alt=""><figcaption></figcaption></figure>

<figure><img src="https://lh6.googleusercontent.com/pbPjZjsRkZD5fEqITAlISAxcNC2EOocsxfVLTUWqTba54xQh_UzgtpFZaLFCreK-lhsuusXw2cMXVP9kZJaPrCsGioxz6w_QTW4_aCkyuafUTFiOINAD_-9pfgf675Edrrhk5A4ItakG9HAaorbkbT9wZZ1s56sOgWt3j2Nk7EVbYKXoZl_Lj5pEyw" alt=""><figcaption></figcaption></figure>

Make sure the correct frontend url is added in the realm settings as shown in screenshot 1. This is the frontend Url of our realm.

\
Also, in the clients section, select cdconsole and make sure Root URL, Valid Redirect URIs and Base URL are added correctly as mentioned in screenshot 2.

#### 4- Sometimes on fresh setup, we get the below error in keycloak.  ERROR: value too long for type character varying(255)

In order to fix this error, please update the type of _value_ column in _user\_attribute_ table as text. This will solve this error.\


<figure><img src="https://lh5.googleusercontent.com/OSnXBHDDlp2UrXI-oCmNdaEKIYshAIJBZbwWVXGRSmHtVtABMsjwBGN6pNTHnCMttTxZu54ksCo700JGXXxN8MJe3O3qjZmYXLQEIfXGkXgx3lnwRhAaZZYmXiM1-I-OCfe4aur2HPwxP5XPf6JX6Ll_LQdLUCgpmHbz0PtAGDX81VVGg_SF0_V5Sw" alt=""><figcaption></figcaption></figure>
