@@ -203,7 +203,7 @@ you may wish to configure an authorization server for each application. Otherwis
203203
204204```
205205provider = "oidc"
206−redirect_url = "https://example.corp.com"
206+redirect_url = "https://example.corp.com/oauth2/callback"
207207oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
208208upstreams = [
209209 "https://example.corp.com"
@@ -224,6 +224,39 @@ Generate a unique `client_secret` to encrypt the cookie.
224224
225225Then you can start the oauth2-proxy with `./oauth2-proxy -config /etc/example.cfg`
226226
227+#### Configuring the OIDC Provider with Okta - localhost
228+1. Signup for developer account: https://developer.okta.com/signup/
229+2. Create New `Web` Application: https://${your-okta-domain}/dev/console/apps/new
230+3. Example Application Settings for localhost:
231+ * **Name:** My Web App
232+ * **Base URIs:** http://localhost:4180/
233+ * **Login redirect URIs:** http://localhost:4180/oauth2/callback
234+ * **Logout redirect URIs:** http://localhost:4180/
235+ * **Group assignments:** `Everyone`
236+ * **Grant type allowed:** `Authorization Code` and `Refresh Token`
237+4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
238+5. Make note of the **default** Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
239+6. Example config file `/etc/localhost.cfg`
240+ ```
241+ provider = "oidc"
242+ redirect_url = "http://localhost:4180/oauth2/callback"
243+ oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
244+ upstreams = [
245+ "http://0.0.0.0:8080"
246+ ]
247+ email_domains = [
248+ "*"
249+ ]
250+ client_id = "XXX"
251+ client_secret = "YYY"
252+ pass_access_token = true
253+ cookie_secret = "ZZZ"
254+ cookie_secure = false
255+ skip_provider_button = true
256+ # Note: use the following for testing within a container
257+ # http_address = "0.0.0.0:4180"
258+ ```
259+7. Then you can start the oauth2-proxy with `./oauth2-proxy -config /etc/localhost.cfg`
227260
228261### login.gov Provider
229262