Configure the IdP authenticator
The IdP authenticator allows admins to enable authentication with an OIDC or SAML Identity Provider (IdP) as extra verification. When configured, the end user sees the option to use the Identity Provider for extra verification and is redirected to that Identity Provider for verification. This verification replaces authentication with another non-password authenticator, such as Okta Verify.
Once an IdP authenticator has been enabled and added to an authentication enrollment policy, users may use it to verify their identity when they sign in to Okta. End users are directed to the Identity Provider to authenticate and are then redirected to Okta once verification is successful.
This authenticator allows you to:
- Add an IdP authenticator for existing SAML or OIDC-based IdP authentication.
- Link an existing SAML 2.0 IdP or OIDC IdP to use as the IdP authenticator provider.
Before you begin
- Admin access to Okta is required to enroll and configure the IdP authenticator.
- An existing Identity Provider must be available to use as the additional step-up authentication provider.
SAML and OIDC claims mapping
Okta expects the following claims for SAML and OIDC:
- For the SAML response, the subjectNameId claim is mapped to the Okta username.
- For the OIDC response, the preferred_username claim is mapped to the Okta username.
Configure an IdP authenticator
There are two stages to configure an IdP authenticator:
- Add an Identity Provider to Okta.
- Enable the IdP authenticator.
Step 1: Add Identity Providers to Okta
-
In the Admin Console, go to .
- Click Add identity provider and select the Identity Provider you want to add.
- Click Next. The Identity Provider's setup page appears.
- Each Identity Provider page includes a link to its setup instructions. Okta recommends thatIdentity Provideryou read these instructions to learn about how to configure your Identity Provider.
- In the General Settings section on each Identity Provider's page, select the Factor only option from the IdP Usage dropdown. You can't use the SSO only option with the IdP authenticator.
- JIT settings aren't supported with the IdP authenticator.
Step 2: Enable the IdP authenticator
You must add an Identity Provider as described in Step 1 before you can enable the IdP authenticator.
- In the Admin Console, go to .
- Click Add authenticator.
- Click Add on the IdP Authenticator tile.
- Select an Identity Provider from the menu. These are the Identity Providers that you added in Step 1 of this procedure.
- Click Save.
- Configure the settings for the IdP authenticator in the authenticator enrollment policy. See Create an authentication enrollment policy for instructions.
End user experience
- End users are prompted to enroll in the IdP authenticator authentication the next time they sign in.
- After the end user has enrolled in the IdP authenticator, it appears on their Settings page in the Security Methods section.
- When an end user triggers the use of the IdP authenticator, it times out after five minutes of inactivity. After this time, they must trigger the use of the IdP authenticator again.
Limitations
The IdP authenticator isn't supported for use with the following:
- This authenticator can't be used with the Okta Integrated Windows Authentication agent (IWA) for Desktop Single Sign-on.
- Device Trust integrations that use the “Untrusted Allow with MFA” configuration will fail.
- MFA for Remote Desktop Protocol, MFA for ADFS, RADIUS logins, or other non-browser based sign-in flows don't support the IdP authenticator.
- The IdP authenticator doesn't support the use of Microsoft Azure Active Directory (AAD) as an Identity Provider. To use AAD as an Identity Provider, see Make Azure Active Directory an Identity Provider.