Example Auth with OKTA

[Fran-Rg]

I'm trying to setup a OAUTH with OKTA

Here's my config:

"AUTH_TYPE"                                               = "OKTA"
"SERVER_FORWARDHEADERSSTRATEGY"                           = "native"
"SPRING_SECURITY_OKTA_CLIENT_REGISTRATION_AUTH0_CLIENTID" = <OKTA_CLIENT_ID>
"SPRING_SECURITY_OKTA_CLIENT_PROVIDER_AUTH0_ISSUER_URI"   = <OKTA_ISSUER_URL>
"SPRING_SECURITY_OKTA_CLIENT_REGISTRATION_AUTH0_SCOPE"    = "openid"
"SPRING_SECURITY_OKTA_CLIENT_REGISTRATION_AUTH0_CLIENTSECRET" = <OKTA_SECRET>

These are the places I checked:

• https://github.com/provectus/kafka-ui/blob/master/documentation/guides/SSO.md -> base env vars
• Enable OKTA SSO for kafka-ui #2490 -> renamed OAUTH2 for OKTA
• 0.3.x Regression: SSO/OAuth2 support #1359 -> Added a scope when I don't have one

The login is still failing with "Invalid Credentials".

What is the OKTA expected traditional setup like?

[Haarolean]

Hi, auth_type should be "oauth2", not "okta".

I wonder though why do you have it enabled with an invalid property in this case.

[Fran-Rg]

Thanks for the answer
Using OAUTH2 for auth_type breaks the applications, I've attached the logs.

kafka-ui-20230103.log

Caused by: java.lang.IllegalArgumentException: registrations cannot be null or empty

I found the lib code that generates that: https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/InMemoryReactiveClientRegistrationRepository.java#L55

But I don't get why I'm having this issue

[Fran-Rg]

This worked

AUTH_OAUTH2_CLIENT_AUTH0_CLIENTID=<>
AUTH_OAUTH2_CLIENT_AUTH0_CLIENTSECRET=<>
AUTH_TYPE=OAUTH2
AUTH_OAUTH2_CLIENT_AUTH0_SCOPE=openid
AUTH_OAUTH2_CLIENT_AUTH0_ISSUER_URI=<>
AUTH_OAUTH2_CLIENT_AUTH0_PROVIDER=okta

[Haarolean]

@Fran-Rg hey, glad it worked! Sometimes it's not, depending on the provider. But "openid" is a default option for that,, right.

[sneharghya]

@Fran-Rg @Haarolean I am trying to configure the tool with Okta as well. Can you please let me know what is the login redirect URI that should be used?

[Fran-Rg]

For the above with "AUTH0" being the "env name", it's:
/oauth2/code/auth0

[krumft]

Thank you for sharing the env vars that worked for you! The redirect URI is actually login/oauth2/code/auth0