Configure Workforce Identity Federation from Okta

Create an application in Okta.

In your Okta Admin dashboard, use the left navigation pane to go to Applications → Applications.

1. On the Applications screen, click Create App Integration.

2. In the Sign-in method section, select OIDC - OpenID Connect.

3. In the Application type section, select Native Application.

4. Click Next.

To learn more, see Create OIDC app integrations.

Configure your New Native App Integration.

After you create an app integration, you are automatically redirected to the New Native App Integration screen.

1. In the App integration name field, enter a name for your application.

2. In the Grant type field, select grant types.

   Enable the following grant types:

   • Authorization Code or Device Authorization

   • (Optional) Refresh Token

     Enabling refresh tokens provides a better user experience. When refresh tokens are not enabled, users must re-authenticate with the identity provider once their access token expires.

3. In the Sign-in redirect URIs section, enter a URL.

   Enter the following URL: http://localhost:27097/redirect.

4. In the Assignments section, configure the Controlled access and Enable immediate access fields.

   1. For the Controlled access field, select Allow everyone in your organization to access.

   2. For Enable immediate access field, ensure Enable immediate access with Federation Broker Mode is checked.

5. Click Save.

To learn more, see Create OIDC app integrations.

Configure PKCE and obtain client ID.

On your application dashboard, go to the General tab and configure the following:

1. In the Client ID field, click the icon to copy the client ID for later use.

2. In the Proof Key for Code Exchange (PKCE) field, ensure Require PKCE as additional verification is enabled (checked by default).

Add an authorization server.

In the left navigation pane, go to Security → API. Click Add Authorization Server.

1. In the Name field, enter a name for your server.

2. In the Audience field, paste the client ID from the previous step.

3. (Optional) In the Description field, enter a description of your server.

4. Click Save.

To learn more, see Create an Authorization Server.

Find and save the issuer URI.

After you create your authorization server, you are automatically redirected to your authorization server's screen.

Under the Settings tab, save the issuer URI by copying the first part of the Metadata URI up to the .well-known section. The URI structure should be similar to: https://trial4238026.okta.com/oauth2/ausabgmhveoOQSMsE697.

Add Groups claim.

On your authorization server screen, go to the Claims tab and click Add Claim.

1. Configure Groups claim with the following configuration information:

   Field	Value
   Name	Enter a name for your claim.
   Include in token type	Click the drop-down and select Access Token.
   Value type	Click the drop-down and select Groups.
   Filter	Click the drop-down and select Matches regex. Next to the drop-down, enter a regular expression that matches only groups used for Atlas authorization. For example, if your Atlas authorization groups use a common naming prefix, enter ^<mongodb-atlas-group-prefix>.* where <mongodb-atlas-group-prefix> is your chosen prefix.
   Disable claim	Do not check.
   Include in	Select Any scope.

2. Click Create.

To learn more, see Create Claims.

Create an access policy.

On your authorization server screen, go to the Access Policies tab and click Add Policy.

1. In the Name field, enter a policy name.

2. In the Description field, enter a description for the policy.

3. In the Assign to field, select All clients.

4. Click Create Policy.

To learn more, see Create an Access Policy.

Create a rule for the access policy.

Under the Access Policies tab, click Add Rule.

1. In the Rule Name field, enter a name for the access policy.

2. For IF Grant Type is, select a grant type.

   When configuring grant types, select the appropriate option based on the client behavior:

   • If the client is acting on behalf of itself, select Client Credentials.

   • If the client is acting on behalf of a user, select the following:

     • Authorization Code

     • Device Authorization

3. Add rule configurations based on your organization's security policy.

   Example Okta rule configuration:

   Field	Value
   AND user is	Select Any user assigned to the app.
   AND Scopes requested	Select Any scopes.
   THEN Use this inline hook	None (disabled)
   AND Access token lifetime is	1 Hours
   AND Refresh token lifetime is	Click the second drop-down and select Unlimited.
   but will expire if not used every	Enter 7 days.

4. Click Create Rule.

To learn more, see Create Rules for each Access Policy.

Create a group.

In the left navigation pane, go to Directory → Groups and click Add Group.

1. In the Name field, name your directory OIDC.

2. (Optional) In the Description field, enter a description for your rule.

3. Click Save.

   To learn more, see Create a group.

4. Follow the Okta documentation to manually assign people to the group.

Add a user to your organization.

In the left navigation pane, go to Directory → People and click Add Person.

1. Provide user details by entering the following values in the corresponding fields:

   Field	Value
   User type	Select User.
   First name	Provide name as needed.
   Last name	Provide name as needed.
   Username	Enter an email as a username.
   Primary email	Enter an email. The email must be same as the one used for the Username field.
   Secondary email	Optional.
   Groups	Enter OIDC.
   Activation	Select Activate Now and check I will set password.
   Password	Enter a password.
   User must change password on first login	Select Optional

2. Click Save.

To learn more, see Add Users Manually.

In Atlas, go to the Federation Management console for your organization.

1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

2. In the sidebar, click Federation under the Identity & Access heading.

3. Click Open Federation Management App.

The Federation page displays.

Configure identity providers.

1. Click Identity Providers in the left sidebar.

2. Do one of the following steps:

   • If you do not have any Identity Providers configured yet, click Set Up Identity Provider.

   • Otherwise, on the Identity Providers screen, click Configure Identity Provider(s).

3. Select Workforce Identity Federation and click Continue.

4. Select OIDC for Data Access.

Enter the following Workforce Identity Provider Protocol Settings.

Click Save and Finish.

(Optional) Associate a domain to your Workforce IdP.

1. In your Workforce Identity Provider card, click Associate Domains.

2. In the Associate Domains with Identity Provider modal, select one or more domains.

3. Click Submit.

Enable your Workforce Identity Provider in an organization.

1. Click Connect Organizations.

2. For the organization you want to connect to Workforce Identity Provider, click Configure Access.

3. Click Connect Identity Provider.

   Note

   If you have another IdP configured, this button says Connect Identity Provider(s).

Select Workforce Identity Federation for Data Access.

In the Connect Identity Provider(s) modal, select a Workforce Identity Provider where the Purpose is Workforce Identity Federation.

Click Connect.

When you connect your Workforce Identity Provider to an organization, Atlas enables your Workforce Identity Provider for all the projects within that organization.

In Atlas, go to the Database & Network Access page for your project.

1. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your project from the Projects menu in the navigation bar.

3. In the sidebar, click Database & Network Access under the Security heading.

The Database & Network Access page displays after you complete the preceding steps.

Open the Add New Database User or Group dialog box.

Click Add New Database User or Group.

Select Federated Auth.

In the Authentication Method section, select Federated Auth.

Select Identity Provider and Identifier

In the Select Identity Provider section, select a configured OIDC Identity Provider.

Specify either the user identifier or group identifier associated with your configured Workforce Identity Provider.

Assign user or group privileges.

To assign privileges to the new user or group, do one or more of the following tasks:

• Select a built-in role from the Built-in Role dropdown menu.

  • You can select one built-in role per database group in the Atlas UI.

  • If you delete the default option, you can click Add Built-in Role to select a new built-in role.

• Select or add custom roles.

  • If you have any custom roles defined, you can expand the Custom Roles section and select one or more roles from the Custom Roles dropdown menu.

  • Click Add Custom Role to add more custom roles.

  • Click the Custom Roles link to see the custom roles for your project.

• Add privileges.

  • Expand the Specific Privileges section and select one or more privileges from the Specific Privileges dropdown menu.

  • Click Add Specific Privilege to add more privileges. This assigns the group specific privileges on individual databases and collections.

• Remove an applied role or privilege.

  • Click Delete next to the

    role or privilege to delete.

  Note

  Atlas doesn't display the Delete icon next to your Built-in Role, Custom Role, or Specific Privilege selection if you selected only one option. You can delete the selected role or privilege once you apply another role or privilege.

Atlas can apply a built-in role, multiple custom roles, and multiple specific privileges to a database group.

To learn more about authorization, see Role-Based Access Control and Built-in Roles in the MongoDB manual.

Specify the resources in the project that the user or group can access.

By default, groups can access all the clusters and federated database instances in the project. To restrict access to specific clusters and federated database instances:

1. Toggle Restrict Access to Specific Clusters/Federated Database Instances to On.

2. Select the clusters and federated database instances to grant the group access to from the Grant Access To list.

Save as a temporary user or group.

Toggle Temporary User or Temporary Group to On and choose a time after which Atlas can delete the user or group from the Temporary User Duration or Temporary Group Duration dropdown. You can select one of the following time periods for the group to exist:

• 6 hours

• 1 day

• 1 week

In the Database Users tab, temporary users or groups display the time remaining until Atlas deletes the users or group. After Atlas deletes the user or group, any client or application that uses the temporary user's or group's credentials loses access to the cluster.

Add the new database user or group.

Do one of the following steps:

• If you added a user, click the Add User button.

• If you added a group, click the Add Group button.