@@ -146,6 +146,56 @@ OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many ma
146146 -cookie-secure=false
147147 -email-domain example.com
148148
149+The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform
150+the following steps:
151+
152+#### Configuring the OIDC Provider with Okta
153+
154+1. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
155+2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
156+you may wish to configure an authorization server for each application. Otherwise, the provided `default` will work.
157+* Navigate to **Security** then select **API**
158+* Click **Add Authorization Server**, if this option is not available you may require an additional license for a custom authorization server.
159+* Fill out the **Name** with something to describe the application you are protecting. e.g. 'Example App'.
160+* For **Audience**, pick the URL of the application you wish to protect: https://example.corp.com
161+* Fill out a **Description**
162+* Add any **Access Policies** you wish to configure to limit application access.
163+* The default settings will work for other options.
164+[See Okta documentation for more information on Authorization Servers](https://developer.okta.com/docs/guides/customize-authz-server/overview/)
165+3. Navigate to **Applications** then select **Add Application**.
166+* Select **Web** for the **Platform** setting.
167+* Select **OpenID Connect** and click **Create**
168+* Pick an **Application Name** such as `Example App`.
169+* Set the **Login redirect URI** to `https://example.corp.com`.
170+* Under **General** set the **Allowed grant types** to `Authorization Code` and `Refresh Token`.
171+* Leave the rest as default, taking note of the `Client ID` and `Client Secret`.
172+* Under **Assignments** select the users or groups you wish to access your application.
173+4. Create a configuration file like the following:
174+
175+```
176+provider = "oidc"
177+redirect_url = "https://example.corp.com"
178+oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
179+upstreams = [
180+ "https://example.corp.com"
181+]
182+email_domains = [
183+ "corp.com"
184+]
185+client_id = "XXXXX"
186+client_secret = "YYYYY"
187+pass_access_token = true
188+cookie_secret = "ZZZZZ"
189+skip_provider_button = true
190+```
191+
192+The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply https://corp.okta.com
193+The `client_id` and `client_secret` are configured in the application settings.
194+Generate a unique `client_secret` to encrypt the cookie.
195+
196+Then you can start the oauth2_proxy with `./oauth2_proxy -config /etc/example.cfg`
197+
198+
149199### login.gov Provider
150200
151201login.gov is an OIDC provider for the US Government.