Okta dab-config.json

[glick1]

Really not finding great working examples of DAB with Okta. Need to do something like this in dab-config.json in section runtime/host:

  "authentication": {
    "provider": "Okta",
    "jwt": {
      "audience": "???",
      "issuer": "https://???"
    }
  },

Anyone have a real working example to share or anything special done within Okta to use JWT bearer tokens?

[seantleonard]

Hi @glick1, Thanks for reaching out. I'm not familiar with using Okta so this is just what I've gathered from their documentation:

1. Issuer: "https://${yourOktaDomain}/oauth2/default". Ref: https://developer.okta.com/code/dotnet/jwt-validation/
2. Audience: "If you are validating access tokens, you should verify that the aud (audience) claim equals the audience that is configured for your authorization server in the Admin Console."

[glick1]

I don't believe the DAB documentation is complete for use with external OAUTH2 providers.
https://learn.microsoft.com/en-us/azure/data-api-builder/reference-configuration#provider-host-runtime

[glick1]

What would be used for Okta in above picture?

Also for audience and issuer with JWT says provider must be set to AzureAD.

[seantleonard]

I'll go and update the documentation. You can name the provider 'okta', it doesn't make a functional difference and is more "self-documenting" config.
then you need to specify issuer/audience that aligns with your Okta app/okta tenant.

[iulian]

Hello. Pertaining to this, indeed provider name does not impact functionality. However it seems that dab is not able to accept JWTs issued by Okta. So in the configuration below even the audience and issuer are correct, dab is not able to find the signing key.

"host": {
      "authentication": {
        "provider": "AzureAD",
        "jwt": {
          "audience": "api://dab",
          "issuer": "https://{OKTA_TENANT}/oauth2/{AUTH_SERVER_ID}"
        }
      }
    }

Dab response is : Bearer error="invalid_token", error_description="The signature key was not found"
Could be this caused by the fact that dab tries to fetch .well-know configuration from .../.well-known/openid-configuration (e.g. for Azure well-known full path is: https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration )

Okta exposes openid configuration under different path: https://{OKTA-TENANT}/oauth2/{AUTH-SERVER-ID}/.well-known/oauth-authorization-server
Well know config gives details about key set specs so I am thinking that "signature key not found " is caused by the fact that dab is not able to fetch openid configuration from okta and subsequently key set to be able to validate kid present in JWT header

Based on the Oauth 2.0 RFC - https://datatracker.ietf.org/doc/html/rfc8414 okta subpath is the recommended one ( well-known/oauth-authorization-server) but .well-known/openid-configuration is also accepted.

[johningle]

Is there an answer for the .well-known path question asked by iulian above? I'm trying to understand how I can configure a DAB service to verify JWTs issued by third party IDPs.