# Configure Persona as an Authentication Method in Okta

> Add Persona as an OIDC identity provider in Okta so sign-on policies can require identity verification, with endpoints and policy setup steps.

Source: https://help.withpersona.com/articles/3ZFkLLXBFVACuqlwQbUcFG/
Section: Marketplace and 3rd-Party Integrations > Authentication > Okta

## About OpenID Connect (OIDC) with Persona

Persona now supports acting as an [OpenID Connect](https://openid.net/) (OIDC) Identity Provider (IdP) authenticator.

This allows Identity and Access Management (IAM) solutions, such as [Okta](https://www.okta.com/), to call Persona for identity verification as part of authentication flows (e.g. application sign-on policies).

For example, your Okta administrator could require identity verification before an employee can access sensitive applications (such as those containing production or financial data).

ℹ️

This differs from Persona’s existing [Okta integration as an IDV identity provider](https://help.withpersona.com/articles/x7vPGY4te68wp1T0Ce5eFi/), which is exclusively triggered through Okta’s account management policy ([OAMP](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/oamp.htm)).

ℹ️

<p>
  You'll need to configure the{' '}
  <a href="/articles/1Acdx2QDfwgE1q3DTVPqW4/">Authentications product feature</a> to obtain the
  client ID and client secret used below.
</p>

## Okta Configuration Guide

Follow the steps below to configure Persona OIDC as an Identity Provider in Okta.

### 1\. Add Persona OIDC as an Identity Provider

In the Okta Admin Dashboard, navigate to:

- **Security > Identity Providers > + Add Identity Provider**
- Select **OpenID Connect**, scroll down, and click **Next**. Fill in the following details and save.

#### General Settings

- **Name:** `Persona IDP` (use a distinct name from “Persona IDV”)
- **IdP Usage:** Factor only
- **Scopes:** No changes

#### Client Details

- **Client ID:** _obtain from Persona Dashboard in Authentications_
- **Authentication Type:** Client secret
- **Client Secret:** _obtain from Persona Dashboard in Authentications_
- **Authorize Requests:** No changes
- **PKCE:** No changes

#### Endpoints

Use the values below or copy from:
`https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configuration`

| Endpoint      | URL                                                              |
| ------------- | ---------------------------------------------------------------- |
| Issuer        | https://authenticate.withpersona.com/authenticate/oidc           |
| Authorization | https://authenticate.withpersona.com/authenticate/oidc/authorize |
| Token         | https://authenticate.withpersona.com/authenticate/oidc/token     |
| JWKS          | https://authenticate.withpersona.com/authenticate/oidc/jwks      |
| Userinfo      | https://authenticate.withpersona.com/authenticate/oidc/userinfo  |

To test using your sandbox environment, use the following instead: [Openid Configuration](https://authenticate.withpersona.com/authenticate/oidc-sandbox/.well-known/openid-configuration)

#### Authentication Settings

- No setting changes

#### JIT Settings

- No setting changes

## 2\. Add the IdP as an Authenticator

Navigate to:

- **Security > Authenticators > Add Authenticator > IdP Authenticator**
- Select the newly created **Persona OIDC**.

## 3\. Update Authentication Policies

Navigate to:

- **Security > Authentication Policies**
- Create a new policy or edit an existing one.

To preserve administrator access in case Persona OIDC is unavailable, ensure at least one admin or group is excluded from this policy.

For testing, the **Okta Dashboard** policy can be useful.

Steps:

1.  Edit the **Catch-all Rule** or create a new rule
2.  Under **Authentication Methods**, select:
    Allow specific authentication methods > Persona IdP

## 4\. Configure Persona Marketplace Integration for Employee Data

### Context

To match IDV results to Okta profiles, Persona requires API access to your Okta tenant.

The only data Okta passes about the user during OIDC authentication is their **username**, which will be the email address they used to sign in. By default, this will be recorded in the Persona account as its Reference ID.

The Persona Marketplace Integration can retrieve additional attributes such as first and last name by looking up the Okta user using the provided username.

### Steps

1.  Follow the [Help Center guide](https://help.withpersona.com/articles/2MTecveKOnadYlNqOY4BFr/)
2.  Add your Okta credentials in the Persona Dashboard
3.  Notify your Persona account team so they can finalize setup and enable profile comparison

## Plans Explained

### Okta Integration by plan

|                  | Startup Program | Essential Plan | Growth Plan | Enterprise Plan |
| ---------------- | --------------- | -------------- | ----------- | --------------- |
| Okta Integration | Not Available   | Not Available  | Limited     | Available       |

[Learn more about pricing and plans](https://withpersona.com/pricing?utm_source=product&utm_medium=referral&utm_audience=a&utm_campaign=cm_gen_ds_hc-plan-table).