# Okta Authenticator (Classic)

This page covers setting up Incode as an OIDC-based authenticator in an Okta Classic environment. If your organization uses Okta Identity Engine (OIE), follow the [Okta Authenticator (Preview/OIE)](https://developer.incode.com/docs/okta-authenticator-previewoie) steps instead.

***

## Prerequisites

Ensure you have the following before you begin:

- Access to the Integrations page in Dashboard. Contact your Incode representative if you do not see it.
- [Okta IDP integration](https://developer.incode.com/docs/integrations/okta-idp) prerequisites complete.
- An Okta Classic instance.
- An Okta administrator account with permissions to manage Identity Providers and Policies.

***

## Set Up Okta IDP Integration for Classic

### Create an OIDC Identity Provider in Okta

1. Log in to your Okta Admin Console.
2. Go to **Security** > **Identity Providers** > **Add Identity Provider**.
3. Select **OpenID Connect**.
4. Enter a name for the IDP and set the mode to **Factor Only**.
5. Ensure the following scopes are included: `email`, `openid`, and `profile`.

**Do not save yet.** You will need values from Dashboard in the next set of steps to complete this configuration.

### Create the Integration in Dashboard

> 📘 **Tip**
>
> This requires copying values between Dashboard and your Okta Admin Console. Keep both tabs open.

1. Log in to Dashboard.
2. In the left menu, click **Integrations**.
3. Click **New Integration**.
4. From the **IAM** tab, select **Okta IDP**, then click **Continue**.
5. Enter a **Name** for this integration. This name appears in analytics and identifies verifications completed through this integration.
6. **Select a Workflow** for this integration from the drop-down.
7. Copy the following values from Dashboard into the corresponding fields in your Okta OIDC IDP configuration:

| Dashboard field | Okta field             |
| --------------- | ---------------------- |
| Client ID       | Client ID              |
| Client Secret   | Client Secret          |
| Issuer URL      | Issuer                 |
| Authorize URL   | Authorization endpoint |
| Token URL       | Token endpoint         |
| JWKS URL        | JWKS endpoint          |
| Userinfo URL    | Userinfo endpoint      |

8. In Okta, set the **Authentication type** to **Client secret**.
9. Click **Save **in Okta.
10. Copy the **Redirect URI** generated by Okta after saving.
11. In Dashboard, paste the **Redirect URI** into the **Redirect URLs** field in the integration configuration.
12. Click **Save**.

### Configure Policies in Okta Classic

Okta Classic uses a different policy structure than OIE. Rather than separate enrollment and authentication policies, Classic uses per-application sign-on policies to enforce MFA requirements.

1. In the Okta Admin Console, go to **Applications** and open the application you want to protect with Incode verification.
2. Open the **Sign On** tab.
3. Under **Sign On Policy**, click **Add Rule**.
4. Configure the rule:
   - Set the conditions to match the user group you want to require Incode verification for.
   - Under **Access**, set **Multifactor Authentication** to **Required**.
   - Ensure the Incode IDP factor is listed as an allowed factor.
5. Click **Save**.
6. Repeat for any additional applications you want to protect.

> 📘 **Note**
>
> In Okta Classic, sign-on policies are configured per application, not globally. You must add an Incode rule to each application you want to protect. If you manage many applications, consider using Okta Identity Engine (OIE) for centralized policy management.

***

## Test the Integration

Sign in to one of the configured applications using a test user account in the enrolled group. The login flow should prompt for password followed by the Incode biometric verification step.

Confirm the following before rolling out to all users:

- The Incode authenticator appears as an MFA option after password entry.
- The user is redirected to an Incode verification session and can complete<br />it on their mobile device.
- After successful verification, the user is granted access to the<br />application.
- Failed verification blocks access and does not allow the user to proceed.

> ⚠️ **Warning**
>
> If the Incode factor does not appear, verify that the sign-on policy rule is applied to the correct user group<br />and that the Incode IDP is listed as an allowed factor in the rule. Changes to Okta Classic policies take effect immediately but may require a fresh browser session to reflect for active users.

***

## What's Next

- [Okta Authenticator (Preview/OIE)](https://developer.incode.com/docs/okta-authenticator-previewoie)
- [Configure Incode as an SSO provider](https://developer.incode.com/docs/integrations/okta-sso)
- [Okta Directory Sync](https://developer.incode.com/docs/okta-directory)

<br />