配置外部身份提供者

Create an application in Okta

In your Okta Admin dashboard, use the left navigation pane to go to Applications → Applications.

1. On the Applications screen, click Create App Integration.

2. In the Sign-in method section, select OIDC - OpenID Connect.

3. In the Application type section, select Native Application.

4. 单击 Next（连接）。

To learn more, see Create OIDC app Integrations.

Configure your New Native App Integration

After you create an app integration, you are automatically redirected to the New Native App Integration screen.

1. In the App integration name field, enter a name for your application.

2. In the Grant type field, select grant types.

   Enable the following grant types:

   • Authorization Code 或 Device Authorization

   • (Optional) Refresh Token

     Enabling refresh tokens provides a better user experience. When refresh tokens are not enabled, users must re-authenticate with the identity provider once their access token expires.

3. In the Sign-in redirect URIs section, enter a URL.

   Enter the following URL: http://localhost:27097/redirect.

4. In the Assignments section, configure the Controlled access and Enable immediate access fields.

   1. For the Controlled access field, select Allow everyone in your organization to access.

   2. For Enable immediate access field, ensure Enable immediate access with Federation Broker Mode is checked.

5. 单击 Save（连接）。

To learn more, see Create OIDC app integrations.

Configure PKCE and obtain client ID

On your application dashboard, go to the General tab and configure the following:

1. In the Client ID field, click the icon to copy the client ID for later use.

2. In the Proof Key for Code Exchange (PKCE) field, ensure Require PKCE as additional verification is enabled (checked by default).

Add an authorization server

In the left navigation pane, go to Security → API. Click Add Authorization Server.

1. In the Name field, enter a name for your server.

2. In the Audience field, paste the client ID from the previous step.

3. (Optional) In the Description field, enter a description of your server.

4. 单击 Save（连接）。

To learn more, see Create an Authorization Server.

Find and save the issuer URI

After you create your authorization server, you are automatically redirected to your authorization server's screen.

Under the Settings tab, save the issuer URI by copying the first part of the Metadata URI up to the .well-known section. The URI structure should be similar to: https://trial4238026.okta.com/oauth2/ausabgmhveoOQSMsE697.

Add Groups claim

On your authorization server screen, go to the Claims tab and click Add Claim.

1. 配置 Groups claim with the following configuration information:

   字段	值
   Name	Enter a name for your claim.
   Include in token type	Click the drop-down and select Access Token.
   Value type	Click the drop-down and select Groups.
   Filter	Click the drop-down and select Matches regex. Next to the drop-down, enter .*.
   Disable claim	Do not check.
   Include in	选择 Any scope 。

2. 单击 Create（连接）。

To learn more, see Create Claims.

Create an access policy

On your authorization server screen, go to the Access Policies tab and click Add Policy.

1. In the Name field, enter a policy name.

2. In the Description field, enter a description for the policy.

3. In the Assign to field, select All clients.

4. 单击 Create Policy（连接）。

To learn more, see Create an Access Policy.

Create a rule for the access policy

Under the Access Policies tab, click Add Rule.

1. In the Rule Name field, enter a name for the access policy.

2. For IF Grant Type is, select a grant type.

   When configuring grant types, select the appropriate option based on the client behavior:

   • If the client is acting on behalf of itself, select Client Credentials.

   • If the client is acting on behalf of a user, select the following:

     • Authorization Code

     • Device Authorization

3. Add rule configurations based on your organization's security policy.

   Example Okta rule configuration:

   字段	值
   AND user is	选择 Any user assigned to the app 。
   AND Scopes requested	选择 Any scopes 。
   THEN Use this inline hook	None (disabled)
   AND Access token lifetime is	1 Hours
   AND Refresh token lifetime is	Click the second drop-down and select Unlimited.
   but will expire if not used every	Enter 7 days.

4. 单击 Create Rule（连接）。

To learn more, see Create Rules for each Access Policy.

Create a group

In the left navigation pane, go to Directory → Groups and click Add Group.

1. In the Name field, name your directory OIDC.

2. (Optional) In the Description field, enter a description for your rule.

3. 单击 Save（连接）。

To learn more, see Create a Group.

Add a user to your organization

In the left navigation pane, go to Directory → People and click Add Person.

1. Provide user details by entering the following values in the corresponding fields:

   字段	值
   User type	选择 User 。
   First name	Provide name as needed.
   Last name	Provide name as needed.
   Username	Enter an email as a username.
   Primary email	Enter an email. The email must be same as the one used for the Username field.
   Secondary email	可选。
   Groups	Enter OIDC.
   Activation	选择 Activate Now and check I will set password.
   Password	Enter a password.
   User must change password on first login	选择 Optional

2. 单击 Save（连接）。

To learn more, see Add Users Manually.

Register a new application for MongoDB

选择 public client/native application as the client type.

Set the Redirect URL value to http://localhost:27097/redirect

(Conditional) Add or enable a groups claim if you authenticate with groups

For groups, this step ensures that your access tokens contain the group membership information of the user authenticating. MongoDB uses the values sent in a groups claim for authorization.

(Optional) Allow refresh tokens if you want MongoDB clients to refresh the tokens for a better user experience

(Optional) Configure the access token lifetime (exp claim) to align with your database connection session time