Keycloak and Okta Integration: Complete Developer Guide

• https://dev.to/italoqueiroz/keycloak-and-okta-integration-complete-developer-guide-eb1

Steps

Okta steps: Gemini Terraform code: Okta Keycloak integration

0) Create group in Okta for assign it to okta_app_oauth
1) OIDC Web App: okta_app_oauth: web, groups_claim (to restrict access)
2) Discovery Endpoint Location (Security > API) 
https://<your-okta-domain>.okta.com/oauth2/default/.well-known/openid-configuration

Keycloak steps

3) Add provider and select OpenID Connect v1.0

Misc

• Okta Authorization servers:
  • Org Authorization Server: /oath2/default
  • Custom Authorization Server: https://client-name.okta.com/oauth2/default

• Discovery Endpoint: /oauth2/default/.well-known/openid-configuration

• https://client-name.okta.com

• API Access Management license

• Federated authentication
• Configure automatic mapping of Okta groups to Keycloak roles through custom mappers
• Attribute Mapping
• Keycloak as an OIDC Client
• Mapping claims and assertions
• Keycloak Broker
• Interface IdentityProviderMapper

Related Terraform resources

• keycloak_realm
• keycloak_oidc_identity_provider: "okta"
• keycloak_openid_client
• keycloak_openid_client_default_scopes
• keycloak_attribute_importer_identity_provider_mapper
• keycloak_authentication_flow
• keycloak_authentication_execution
• okta_app_oauth
• okta_auth_server_claim
• okta_app_group_assignment

Related

• Gemini Terraform code: Okta Keycloak integration
• Relying Party (RP)
• identityProviders

See also

• identityProviders: syncMode
• Okta pricing, Org Authorization Server, Okta Integrator Free Plan
• Okta app, Okta create app integration, okta_app_oauth, Grant type
• Okta Authorization, Okta Authorization servers: Org, Custom, Okta default custom authorization server
• Keycloak, kc_admin, kc.sh [ export | import ], Keycloak logs, realm, roles, Mapping claims and assertions, Terraform Keycloak provider, helm install keycloak, JVM metrics, Keycloak Import, Interface IdentityProviderMapper, KC_HOSTNAME_STRICT_HTTPS, Variables, KC troubleshooting, versions, client_id, Keycloak TLS