1

I work for a large company (50K+). Some orgs within the company use OKTA for auth on their servers. I have a valid user login (via OKTA) for the servers, and can log in through a browser without any issues, but want to access this site programatically.

How can I log into these websites using my OKTA credentials? I've found this doc: https://developer.okta.com/docs/reference/api/oidc/#authorize that details how to use an OKTA endpoint, but it requires some info that I do not have. Namely, nonce, state, and client_id. I have no clue how to get this info.

I've found another endpoint that allows a similar login method, but only requires username and password (I forget the doc that referenced this): https://<company>.okta.com/api/v1/authn

I am able to successfully authenticate with OKTA using this endpoint, and receive a session_token. Can I take this session_token and apply it to my arbitrary webpage somehow? I can not find any documentation that says so.

At first glance it appears that many of the API endpoints for OKTA require intimate knowledge of the hosted application (and/or are not meant to be accessed programmatically).

Is it possible to log into an arbitrary webpage that uses OKTA for authentication, with only knowledge that an end user would have (username/password/optional MFA)?

Andenthal
  • 849
  • 5
  • 13

1 Answers1

0

Hi not sure you found the answer yet. from your descriptions i think yours is web app, which is supposed to use authentication code flow. else, you can ask your web developers what authentication flow they use and follow the auth process accordingly.

you need to retrieve id token & access token for authentication.

user1734905
  • 333
  • 3
  • 14