Automatically create Dev Portal applications in Okta with Dynamic Client Registration

Using your Okta credentials, log in to the Okta portal and click Security > API in the sidebar. The default Issuer URI should be displayed in the Authorization Servers tab. If you are using an authorization server that you configured, copy the issuer URL for that authorization server.

1. Click Security > API in the sidebar.

2. From the Tokens tab, click the Create token button.

3. Enter a name for your token, and then copy the token value.

   Important: Store the token in a secure location you can reference later, as it will only be visible as a hashed value after this step.

1. Click Security > API in the sidebar.

2. Select the authorization server that you want to configure.

3. Click the Scopes tab, and click Add Scope.

4. Configure the scope as needed.

To map an application from the Dev Portal to Okta, you have to create a claim.

1. Click Security > API in the sidebar.

2. Select the authorization server that you want to configure.

3. Click the Claims tab, and then click Add Claim.

4. Enter a name for this claim, and enter app.clientId for Value. You can leave the Value type as “Expression”, and include it in any scope.

After configuring Okta, you can integrate it with the Dev Portal for Dynamic Client Registration (DCR). This process involves two main steps: first, creating the DCR provider, and second, establishing the authentication strategy. DCR providers are designed to be reusable configurations. This means once you’ve configured the Okta DCR provider, it can be used across multiple authentication strategies without needing to be set up again.

This tutorial uses the Konnect UI to configure DCR, but you can also use the Application Registration API.

1. Log in to Konnect and select Dev Portal from the menu.

2. Navigate to Application Auth to see the authentication strategies for your APIs.

3. Click the DCR Provider tab to see all existing DCR providers.

4. Click New DCR Provider to create a new Okta configuration:
   1. Enter a name for internal reference within Konnect. This name and the provider type won’t be visible to developers on the Dev Portal.
   2. Enter the Issuer URL of your authorization server and the DCR Token that you created in Okta. The Issuer URL and DCR token will be stored in isolated, encrypted storage and will not be readable through any Konnect API.
   3. Select Okta as the Provider Type.
   4. Save your DCR provider. You should now see it in the list of DCR providers.

5. Navigate to the Auth Strategy tab, then click New Auth Strategy to create an auth strategy that uses the DCR provider:

   1. Provide a name for internal use within Konnect and a display name for visibility on your Portal.
   2. In the Auth Type dropdown menu select DCR.
   3. In the DCR Provider dropdown, select the name of the DCR provider config you just created. Your Issuer URL will be prepopulated with the Issuer URL you added to the DCR provider.

   4. Enter the names of the Scopes and Claims as comma-separated values in their corresponding fields. The values should match the scopes or claims that were created in Okta.

      Note: Avoid using the openid scope with client credentials as it restricts the use. If no scopes are specified, openid will be the default.

   5. Select the relevant Auth Methods you need (client_credentials, bearer, session), and click Save.

Now that the application auth strategy is configured, you can apply it to an API.

1. Navigate to your Dev Portal in Konnect and click the Published APIs tab.

2. Click Publish API, select the API you want to publish, and select your Okta auth strategy for the Authentication strategy.

3. Click Publish API.

Now that DCR is configured, you can create an application with Dynamic Client Registration by using a developer account.

1. Navigate to your Dev Portal URL and log in with your developer account.

2. Select an API and click Use this API.

3. Complete the Create New Application modal with your application name, authentication strategy, and description.

4. After the application is created, the Client ID and Client Secret will be displayed.
   Make sure to store these values, as they will only be shown once.

5. After the application is created, it will appear in your IdP. From your IdP organization, select Applications from the sidebar. You will see the application created in the Dev Portal, along with its corresponding Client ID.

For developers to authorize requests, they must attach the client ID and secret pair obtained previously in the header. They can do this by using any API client, such as Insomnia, or directly using the command line:

curl "$KONNECT_PROXY_URL/$ROUTE_PATH" \
     --no-progress-meter --fail-with-body \
     -H "Authorization: Basic $CLIENT_ID:$CLIENT_SECRET" \
     -H "Content-Type: application/json"