Configure Cross App Access with an external identity provider

Allow an AI agent from an OpenID Connect identity provider (IdP) or Okta Integration IdP to request access tokens from your custom authorization server.

About this task

The agent gets an Identity Assertion JWT Authorization Grant (ID-JAG) token from its IdP and presents it to your authorization server. Okta checks that the IdP is one you trust, matches the token to an existing Okta user, and issues an access token if your access policy allows the requested scopes.

Before you begin

  • Your org has an active OpenID Connect IdP or Okta Integration IdP.
  • If the IdP is an OpenID Connect IdP, you've confirmed that your org is subscribed to Okta for AI Agents. If the IdP is an Okta Integration IdP, the issuing org (the Okta org where the agent is registered) is subscribed to either Okta for AI Agents or Agent SSO.
  • If the IdP is an Okta Integration IdP, you've configured federation between the issuing org and your org using OpenID Connect. See Integrate Okta Org2Org with Okta.
  • If the IdP is an Okta Integration IdP, the Org2Org app in the issuing org has the ID of your custom authorization server in the Custom Authorization Server ID field on the General tab. If this field is empty, you can't configure Cross App Access on the Machine Assignments tab.
  • Your org has a custom authorization server with an access policy that applies to the agent's client. See Create access policies.
  • The agent is registered with an app in your org. See Configure the AI agent (requesting app).
  • The users who use the agent exist in your org.

Procedure

  • Set the IdP usage

    1. In the Admin Console, go to Security > Identity Providers.
    2. Select the OpenID Connect IdP or Okta Integration IdP that you want to use.
    3. In General settings, from the IdP Usage list, select one of the following options:
      • SSO and Cross App Access: Users can sign in to Okta with this IdP, and Okta accepts ID-JAG tokens from it.
      • Cross App Access only: Okta accepts ID-JAG tokens from this IdP. Users can't sign in to Okta with it. Okta hides the settings that apply only to sign-in. For an OpenID Connect IdP, you configure only the Client ID, Issuer, and JWKS endpoint.
    4. Select Update identity provider.
    5. In the confirmation dialog, select Update identity provider.

  • Allow the app to use the JWT Bearer grant type

    1. Go to Applications > Applications.
    2. Select the app integration that represents the AI agent.
    3. In Grant type, select JWT Bearer.
    4. Select Save.

  • Add the access policy rule

    1. Go to Security > API > Authorization Servers.
    2. Select your custom authorization server.
    3. On the Access Policies tab, select the policy that applies to the agent's client.
    4. Select Add Rule.
    5. Under IF Grant type is, select JWT Bearer.
    6. Under AND User's identity provider is, select Any IdP or Specific IdP(s).
      • Any IdP (default): Okta accepts an ID-JAG token from any IdP set to SSO and Cross App Access or Cross App Access only.
      • Specific IdP(s): Okta accepts an ID-JAG token only from the IdPs that you select in the IdP(s) field. You can select only active IdPs that accept ID-JAG tokens. If you leave IdP(s) empty, Okta displays the error "No identity provider selected."
    7. Specify the scopes and other options for the rule. The rule must allow every scope that the agent requests, and each scope must exist on the custom authorization server.
    8. Select Create Rule.

  • Configure the issuing Okta org for Org2Org (Okta Integration IdP only)

    1. In the issuing org, on the Org2Org app's Machine Assignments tab, select the Callers tile, and then select Edit next to Cross App Access (XAA).
    2. Select Enable, and in the Issuer URL field, enter the issuer URL of your custom authorization server.
    3. Select Save.
    4. Add a resource connection for the agent. See Configure the Cross App Access connection.