Okta Single Sign On Configuration for BCS

How do you configure Okta as an identity provider (IdP) for BCS?

To configure Okta as an Identity Provider for BCS, create an OIDC app integration in Okta, share three values (Client ID, Client Secret, and OpenID Connect metadata document URL) with BCS, then use the callback URL BCS returns to enable IdP-initiated login. Complete all three phases in order.

To fully configure Okta as an Identity Provider (IdP), complete the steps below and then provide BCS with three values — Client ID, Client Secret, and the OpenID Connect metadata document URL — for final configuration.

1. In Okta click on Applications > Applications
2. Click Create App Integration
3. Select OIDC OpenID Connect
4. Select Web Application
5. Enter “BCS” (or any preferred name) in App integration name
6. Enter the BCS redirect URL https://bcs-phoenix-clients.auth.us-east-1.amazoncognito.com/oauth2/idpresponse in the Sign-in redirect URIs field (contact BCS support to confirm the current redirect URL for your environment)
7. Under Assignments you can optionally choose to Skip group assignments for now
   1. Note: The users added to this application will need to be determined by the
      customer performing this configuration
8. Click Save
9. Note the Client ID and the Client Secret — both will need to be provided to BCS for final configuration
   1. Example:
      
10. Note the Okta well known URI to provide to BCS for final configuration.
    1. The URI will be in this format:
       “YOUR_OKTA_DOMAIN.okta.com/.well-known/openid-configuration”
11. The three values noted above will need to be provided to BCS for final configuration.The
    three values are:
    1. Client ID. Example: 0oaf12pcqaSUN28m65d7
    2. Client secret. Example:
       Xy9sPgdQ_YlJA6F4XC31Vu7DSMySQAblcjYrOcn-qP7n71AqgA-b8vhxARC
       WB_E_
    3. OpenID Connect metadata document. Example:
       https://dev-91444013.okta.com/.well-known/openid-configuration
12. After providing BCS with the values BCS will need to add configuration. Once BCS has
    been configured a callback URL will be provided. Example:
    https://YOUR-CLIENT-DOMAIN.auth.us-east-1.amazoncognito.com/oauth2/authorize?client_id=YOUR_CLIENT_ID&response_type=code&scope=email+openid&redirect_uri=https%3A%2F%2Fclient.getbcs.com%2Fcallback%2FYOUR_CLIENT_ID
13. With the callback URL provided from BCS, proceed to the next steps to configure
    Identity Provider Initiated (IdP) login
    1. Return to Applications > Applications
    2. Click the “BCS” application
    3. On the General tab click Edit in the General Settings section
    4. For Login initiated by drop down choose Either Okta or App
    5. Check Display application icon to users. Then enter the BCS-provided callback URL in the Initiate login URI field.
       1. Example:
          
          
       2. Click Save
          
          
14. Assign users to the BCS application as desired and test to ensure they are able to login
    successfully