Skip to main content

Configure Okta

This guide connects DIAL to Okta so users authenticate with Okta and DIAL authorizes them by Okta group. For the shared workflow, see the SSO / IdP setup overview.

Prerequisites​

  • A running DIAL deployment and the URL of your DIAL Chat instance, referred to below as <chat_url>.
  • An Okta org with permission to create applications and authorization server policies.

Step 1: Configure Okta​

  1. Create an application (app integration wizard):
    • Sign-in method: OIDC - OpenID Connect
    • Application type: Web Application
    • Sign-in redirect URI: <chat_url>/api/auth/callback/okta
    • Sign-out redirect URI: <chat_url>
    • Grant types: Authorization Code and Refresh Token
  2. Enable API scopes okta.users.read and okta.users.read.self on the Okta API Scopes tab.
  3. Set up an access policy on your authorization server that allows the application and grants scopes openid, profile, and email.
  4. Create users under Directory → People.
  5. Gather facts: the Okta domain (<okta_domain>), the issuer and jwks_uri from the authorization server metadata, and the application Client ID and Client secret.
  6. (Optional, RBAC) Create groups, assign users and the application, and add a groups claim to the ID token (guide) using a groups filter that matches .*.

Step 2: Configure DIAL Chat​

Set these environment variables on DIAL Chat. See DIAL Chat configuration — Okta for the full list.

AUTH_OKTA_ISSUER: "<okta_issuer>"
AUTH_OKTA_CLIENT_ID: "<okta_client_id>"
AUTH_OKTA_CLIENT_SECRET: "<okta_client_secret>"

Step 3: Configure DIAL Core​

Add the provider to the identityProviders section of DIAL Core static settings (settings.json). <okta_domain_regex> is <okta_domain> with dots escaped (for example, dev-123456\.okta\.com). Generate a random loggingSalt, for example with pwgen -s 32 1.

{
  "identityProviders": {
    "okta": {
      "jwksUrl": "<okta_jwks_uri>",
      "issuerPattern": "^https:\\/\\/<okta_domain_regex>.*$",
      "loggingKey": "sub",
      "loggingSalt": "<random_salt>",
      "rolePath": "Groups"
    }
  }
}

rolePath is Groups, matching the groups claim you configured. For every setting, see the Identity providers reference.

note

DIAL Core reads static settings at startup. Restart Core after editing settings.json. Each setting can also be supplied as an aidial.identityProviders.okta.* environment variable.

Step 4: Assign roles to resources​

In config.json (dynamic settings), add an Okta group name to a deployment's userRoles array.

{
  "models": {
    "chat-gpt-35-turbo": {
      "userRoles": ["okta-group-name"]
    }
  }
}

Result​

Users log in through Okta, and DIAL Core authorizes their requests based on Okta group membership.

Further reading​