OKTA authentication for APEX in 5 minutes

• Go to https://www.okta.com/free-trial/ and create your free account.

• Log into your account
• Navigate to Applications, Applications
• Click on Create a new app integration
• In the form which is opened, select the following options:
  • OIDC - OpenID Connect
  • Web application
• In the next part, add some more information:
  • App integration name – chose appropriate name for your OKTA Integration Applciation
  • Logo (Optional) – select a logo, which will be used on the OKTA site
  • Sign-in redirect URIs – https://apex.oracle.com/pls/apex/apex_authentication.callback. The first part – https://apex.oracle.com/pls/apex, is your applications base URI. You don’t need to enter the full application URL here (for example https://apex.oracle.com/pls/apex/demo_workspace/r/demo_app/). The second part – apex_authentication.callback is used for the AJAX callbacks from OKTA, once the user is authenticated.
  • Sign-out redirect URIs(Optional) – enter an address where you want your users to be redirected (for example https://google.com/ or https://apex.oracle.com/pls/apex/demo_workspace/r/demo_app/logout), once the are logged out of your APEX application. Note that the same Logout URL should be entered in APEX (Post-Logout URL in your Authentication Scheme settings), otherwise the Logout redirect would not work.
  • All the other settings are left as they are.
• Once the previous step is done, you will have your new Application Integration created. The most important things here are the Client ID and Client secret, which will be later used in APEX to link your APEX application to the OKTA one.

• Go to Shared Components, Security, Web Credentials
• Click on Create button
• Enter the following details:
  • Name(Value Required): OKTA SSO
  • Static Identifier: OKTA_SSO
  • Authentication Type: OAuth2 Client Credentials Flow
  • OAuth Scope: profile,email
  • Client ID or Username: Client ID from Client Credentials in OKTA
  • Client Secret or Password: Client Secret from Client Credentials in OKTA
  • Verify Client Secret or Password: Client Secret from Client Credentials in OKTA
  • Valid for URLs:
  • Prompt On Install:
  • Comments:

• Now Go to Shared Components, Security, Authentication Schemes
• Click on Create button
• In the wizard form, enter the following details:

  • Create Scheme: Based on a pre-configured scheme from the gallery

  • Name: OKTA SSO Authentication

  • Scheme Type: Social Sign-In

  • Credential Store: OKTA SSO, as created in the previous steps

  • Authentication Provider: OpenID Connect Provider

  • Discovery URL: https://${yourOktaOrg}/.well-known/openid-configuration, where ${yourOktaOrg} is replaced with your OKTA URL, like https://dev-999999-admin.okta.com/.well-known/openid-configuration (see https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server-discovery-endpoints for more details)

  • Scope: profile,email

  • Authentication URI Parameters:

  • Username: #email#

  • Convert Username To Upper Case:

  • Additional User Attributes: given_name,family_name

  • Map Additional User Attributes To: G_OKTA_FIRST_NAME,G_OKTA_LAST_NAME

  • Verify Attributes: Yes

Additionally you might want to configure a pre or post-authentication procedures, executed together with your OKTA login. In my demo application I have selected to use the email, first name and last name of my user from OKTA. First name and Last name are given_name and family_name user attributes in OKTA.

• Additional User Attributes: given_name,family_name
• Map Additional User Attributes To: G_OKTA_FIRST_NAME,G_OKTA_LAST_NAME

I have created three Application items to store the values – G_OKTA_FIRST_NAME, G_OKTA_LAST_NAME and G_USER_FULL_NAME. The values I get from OKTA are First Name and Last Name and my Post_Authentication procedure is calculating a Full Name out of them.

In Source, enter the following PL/SQL code:

Then in Login Processing, Post-Authentication Procedure Name enter post_authentication, which is the name of the procedure we just created.

Short answer: Lots of things. But not necessarily.

If things don’t go as planned, you might look at the following settings in your setup:

Proxy – In case your organisation is using one in its internal network (where your APEX and Oracle database are), make sure you have it in your Instance settings too:

• Log in to Oracle Application Express Administration Services.
• Click Manage Instance.
• Under Instance Settings, click Security.
• Locate the Security section.
• In Instance Proxy, enter the address of the proxy to be used for the entire instance.

Wallet – If you are accessing OKTA over HTTPS, you might need to configure your database wallet. An error you might see in your logs, regarding wallet usage is:

To test for such wallet issue, run the following script in your APEX SQL Commands window:

If you don’t get an error, but a JSON response as a result, then you are fine.

In case you have the error, you can download the root certificate from OKTA’s website, add it to your Oracle database Wallet and add the path to your wallet in APEX Administration Services.

Full article on Wallet and integration in APEX could be found in the following places:

• https://apex.oracle.com/pls/apex/germancommunities/apexcommunity/tipp/6121/index-en.html
• https://fuzziebrain.com/content/id/1711/
• https://fuzziebrain.com/content/id/1725/

ACL – Especially when you are in a private network with hardened security, a possible reason for connectivity problems might be the Access Contol Lists (or ACLs). One thing you could try is add OKTA website to the ACL. Check DBMS_NETWORK_ACL_ADMIN.CREATE_ACL and DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE procedures for more details as well as the following article:

• https://pretius.com/configuration-of-oracle-database-and-apex-application-use-of-google-service-account-the-google-workspace-friendly-application-series/ – although it is an article, related to Google integration, the principle in ACL configuration is the same.

Firewall – Similar situation to the other connectivity issues, but on network level. The only way to check it is to work woth your network team and see if inbound and outbound traffic to OKTA is allowed.

You had trouble integrating OKTA? And found the solution?

Share it with me and I will update this blog post so it is in help to the other members of our great APEX community.

• https://www.jmjcloud.com/blog/its-time-for-a-new-name-for-apex-social-sign-in
• http://www.grassroots-oracle.com/2019/01/social-sign-in-authentication-scheme.html
• https://www.insum.ca/saml2-single-sign-on-with-oracle-application-express/
• http://c2anton.blogspot.com/2019/09/what-info-is-available-from-my-apex.html
• http://c2anton.blogspot.com/2019/06/oracle-apex-social-sign-on-with.html
• https://www.slideshare.net/msewtz/oracle-apex-social-login