Okta

BizDoc supports Okta for both authentication and authorization, in one of two configurations: server flow or client flow.

Server flow redirects unauthorized users to Okta sign-in page on Okta domain, and handles the redirect. Client flow prompts unauthorized users for credentials in an hosted widget, and negotiate with Okta on the background.

1. For both modes, install BizDoc Nuget package:

dotnet add package BizDoc.Core.Okta

2. Add Okta application. If using server mode, choose Web Application. If using client mode, choose ODIC - OpenID Connect, and select SPA.

Okta sign-in redirect url should match "/authorization-code/callback" on server mode, and no path for client mode.

Create an API Token to allow BizDoc to retrieve users information.

3. In startup.cs, add Okta service.

For server flow, use AddOktaRedirect:

AddBizDoc(o=> {
    o.ApplicationUri = "https://app-domain";
  })
  .AddOkta(o=> {
    o.ApiToken = "api-token";
    o.Domain = "domain-name";
    o.ClientId = "client-id";
    o.ClientSecret = "client-secret";
  });
  ...
UseBizDoc().
  .UseOkta();

For client mode, use AddOkta:

AddBizDoc(...)
  .AddOkta(o=> {
    o.ApiToken = "api-token";
    o.Domain = "domain-name";
  }, configure => configure.UseIdentityProvider());

The UseIdentityProvider() method registers an identity provider which retrieve user information from Okta. To use a different provider, while still authenticating via Okta, see Implementing Identity Provider.

4. Client mode only, install Angular package:

npm i @bizdoc/okta

Add Okta configuration in Angular app.module:

OktaModule.forRoot({
  domain: 'domain-name',
  clientId: 'client-id'  
})

In order to map user groups to BizDoc roles for authorization purposes, add a new claim to Okta Authorization Server with the following specifications.

Add an attribute to either application profile or all profiles and set its type to boolean. Add a claim in API server that map to the profile attribute you created.