OKTA Identity Cloud Authentication & Authorization with APEX

OKTA Identity Cloud Authentication & Authorization with APEX

This blog sets up OKTA Authentication with APEX and then delivers the Users' OKTA Groups to APEX and maps them to custom roles.

This extends another blog of mine to enable OKTA Authentication.

Instructions

  1. Sign up for an OKTA Account at https://www.okta.com/uk/free-trial/

  2. Save the Login & Org URL shown on the "Welcome" page to Notepad

  3. Wait for the confirmation email and Activate the account by setting a new password & elect to set up the MFA later

  4. Click Directory > People and view the users. You can optionally add new people

  5. Click Directory > Groups > Add Group > Name = APEX > Save

  6. Click Directory > Groups > Add Group > Name = Supervisors > Save

  7. Click Directory > Groups > Add Group > Name = Empty > Save

  8. Click on group APEX > Assign People > + (the plus symbol next to your username) > Done

  9. Follow the Database & APEX Configuration steps in my Achieving a SaaS Model for multi-tenant APEX Applications using Oracle IAM Domains blog

  10. Click Applications > Applications > Create App Integration

  11. Select OIDC - OpenID Connect & Web Application and Click Next

  12. Use the following setting in OKTA
    App Integration Name = APEX Application

  13. Run the following in your SQL Workshop

    select APEX_AUTHENTICATION.GET_CALLBACK_URL () from dual;
    

    From the results, just copy everything up to the callback phrase, e.g

    https://apex.oracle.com/pls/apex/apex_authentication.callback
    

    Past this in to Sign In Redirect URLs in OKTA

  14. In the Post-logout redirect URL type the following (we are going to use DOMAIN3 in this example here)

    [BASE URL]f?p=[APPLICATION ALIAS]:1::APEX_AUTHENTICATION=DOMAIN3
    

    e.g

    https://apex.oracle.com/pls/apex/f?p=T-PRODUCTS:1::APEX_AUTHENTICATION=DOMAIN3
    
  15. For Controlled access select Limit access to selected groups and choose Group APEX

  16. Leave all settings as there are. When it resembles the following, click Save

  17. Copy the Client ID & Secret and copy to Notepad

  18. Optional - For Demonstration purposes, we'll switch to Password only, deactivating MFA

    • In OKTA click Security > Authentication Policies > Password Only ~ View > Add App > APEX Application > Add >; Close

    • Click Switch Policy > Switch Policy > Save

  19. Next, we need to set up an API key.
    Click Security > API > Token >; Create Token > mytoken > Create Token > Copy Value to Notepad > Ok Got It

  20. Next, set some Privileges.
    Click Applications > Applications > APEX Application > OKTA API Sscopes > okta.groups.read > ✔️Grant

  21. In APEX > Application Builder > Shared Components > Create > Name = G_SUB > Create Application Item

  22. In APEX click App Builder > Workspace Utilities > Web Credentials > Create

    Use the following table

    Name

    Value

    Name

    OKTA.APEX.DOMAIN_3

    Client ID or Username

    Paste in from Notepad

    Client Secret or Password

    Paste in from Notepad

    Verify Client Secret or Password

    Paste in from Notepad

  23. Click Create

  24. Click APEX Application > Authentication Schemes > Create

  25. Click Next on Based on a pre-configured scheme from the gallery

  26. Use the following table

    Name

    Value

    Name

    DOMAIN3

    Scheme Type

    Social Sign-In

    Credential Store

    IAM.APEX.DOMAIN_3

    Discovery URL

    https://${yourOktaOrg}/.well-known/openid-configuration, where ${yourOktaOrg} is replaced with your OKTA URL, like https://dev-999999-admin.okta.com/.well-known/openid-configuration see https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server-discovery-endpoints for more details)

    Scope

    profile

    Username

    name

    Additional User Attributes

    sub,profile

    Map Additional User Attributes To

    G_SUB

  27. Click Create Authentication Scheme

  28. Click on Authentication Scheme DOMAIN3

  29. Use the following table

    Name

    Value

    Source

    Paste in Code Below

    Post-Authentication Procedure Name

    p_post_processing

    Switch in Session

    Enabled

    Post-Logout URL

    URL

    URL

    Your Post-logout redirect URL e.g apex.oracle.com/pls/apex/f?p=T-PRODUCTS:1::..

    PROCEDURE p_post_processing 
    IS
        l_clob          CLOB;
        j            APEX_JSON.t_values;
        l_group_names apex_t_varchar2;
        l_api_key_c  CONSTANT VARCHAR2(256) DEFAULT '<YOUR API KEY>';
        l_org_url_c  CONSTANT VARCHAR2(256) DEFAULT 'https://<YOUR ORG URL>.okta.com';
    BEGIN
    
       apx_tenant.p_set_tenant_id( 'DOMAIN_3');
    
        apex_web_service.set_request_headers(
            p_name_01        => 'Content-Type',
            p_value_01       => 'application/json',
            p_name_02        => 'Accept',
            p_value_02       => 'application/json',
            p_name_03        => 'Authorization',
            p_value_03       => 'SSWS ' || l_api_key_c
             );
    
        l_clob := apex_web_service.make_rest_request(
            p_url => l_org_url_c || '/api/v1/users/' || :G_SUB || '/groups',
            p_http_method => 'GET');
    
         APEX_JSON.PARSE(p_values => j, p_source => l_clob);
    
       FOR i IN 1 .. APEX_JSON.GET_COUNT(p_path=> '.', p_values=> j) 
       LOOP
            -- add all group names to l_group_names
             apex_string.push (
                      p_table => l_group_names,
                      p_value => apex_json.get_varchar2(p_path=>'[%d].profile.name',p0=> i,p_values=>j));     
    
       END LOOP;
    
        -- save group names in session
        apex_authorization.enable_dynamic_groups (
            p_group_names => l_group_names );
    END p_post_processing;
    
  30. Click Apply Changes

  31. Paste the Post Logout URL into a browser Tab (i.e the one that ends with APEX_AUTHENTICATION=DOMAIN3 )

  32. OKTA login page will be displayed

  33. Enter your password and click Verify

  34. Notice that the Supervisor Role has been assigned and the Interactive Report is showing the correct roles

  35. Click on T Product Report and notice that the VPD is accurately showing the 2 records associated with DOMAIN3

  36. The username is successfully retrieved

  37. Enjoy!

Sources

Name

Source

Plamen Mushkov

https://apexapplab.dev/2021/05/31/okta-authentication-for-apex-in-5-minutes/

Jon Dixon

https://www.jmjcloud.com/blog/its-time-for-a-new-name-for-apex-social-sign-in

Anton Nielsen

http://c2anton.blogspot.com/2019/09/what-info-is-available-from-my-apex.html