Skip to content

Commit ad57abe

Browse files
JamieStivalaJamieStivala
authored
✨ feat: Add support for Okta Authentication (#8547)
* Add Okta support to auth config and tests * Added documentation * Removed deprecated env variables * Added Okta as SSO Provider * Removed Okta Test * Reverted a micro-change which was changed during some testing (back to original) * Added Okta to SSO providers list
1 parent f60656b commit ad57abe

File tree

6 files changed

+124
-2
lines changed

6 files changed

+124
-2
lines changed

‎docs/self-hosting/advanced/auth.mdx

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ Currently supported identity verification services include:
5555
<Card href={'/docs/self-hosting/advanced/auth/next-auth/keycloak'} title={'Keycloak'} />
5656

5757
<Card href={'/docs/self-hosting/advanced/auth/next-auth/google'} title={'Google'} />
58+
59+
<Card href={'/docs/self-hosting/advanced/auth/next-auth/okta'} title={'Okta'} />
5860
</Cards>
5961

6062
Click on the links to view the corresponding platform's configuration documentation.
@@ -78,6 +80,7 @@ The order corresponds to the display order of the SSO providers.
7880
| ZITADEL | `zitadel` |
7981
| Keycloak | `keycloak` |
8082
| Google | `google` |
83+
| Okta | `okta` |
8184

8285
## Other SSO Providers
8386

‎docs/self-hosting/advanced/auth.zh-CN.mdx

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@ LobeChat 与 Clerk 做了深度集成，能够为用户提供一个更加安全
5151
<Card href={'/zh/docs/self-hosting/advanced/auth/next-auth/logto'} title={'Logto'} />
5252

5353
<Card href={'/zh/docs/self-hosting/advanced/auth/next-auth/keycloak'} title={'Keycloak'} />
54+
55+
<Card href={'/zh/docs/self-hosting/advanced/auth/next-auth/okta'} title={'Okta'} />
5456
</Cards>
5557

5658
点击即可查看对应平台的配置文档。
@@ -73,6 +75,7 @@ LobeChat 与 Clerk 做了深度集成，能够为用户提供一个更加安全
7375
| Microsoft Entra ID | `microsoft-entra-id` |
7476
| ZITADEL | `zitadel` |
7577
| Keycloak | `keycloak` |
78+
| Okta | `okta` |
7679

7780
## 其他 SSO 提供商
7881

‎docs/self-hosting/advanced/auth/next-auth/okta.mdx

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
title: Configure Okta Identity Verification Service for LobeChat
3+
description: >-
4+
Learn how to configure Okta Identity Verification Service for LobeChat for your organization, including creating applications, adding users, and configuring environment variables.
5+
6+
tags:
7+
- Okta
8+
- Identity Verification
9+
- Single Sign-On
10+
- Environment Variables
11+
- User Management
12+
- SSO Integrations
13+
- Social Login
14+
---
15+
16+
# Configure Okta Identity Verification Service
17+
18+
<Steps>
19+
### Create Okta Application
20+
21+
Register and log in to [Okta][okta-client-page], open the "Applications" subtab in the left navigation bar, and click "Applications" to switch to the application management interface. click "Create App Integration" in the upper left corner to create an application.
22+
23+
Select "OIDC - OpenID Connect" in Sign-In Method and then select "Web Application" in Application Type.
24+
25+
Fill in the following settings:
26+
27+
| Setting Name | Description | Sample Information |
28+
| ---------------------- | ------------------------------------------------------------------------------------------------------------ | --------------------------------------------- |
29+
| App Integration Name | The Application Name your users will see | LobeChat Instance |
30+
| Sign-in redirect URIs | Okta sends the authentication response and ID token for the user's sign-in request to these URIs | (http(s)://your-domain/api/auth/callback/okta |
31+
| Sign-out redirect URIs | After your application contacts Okta to close the user session, Okta redirects the user to one of these URIs | (http(s)://your-domain |
32+
33+
<Callout type={'important'}>
34+
You can fill in or modify all the fields after deployment, but make sure the filled URL is
35+
consistent with the deployed URL.
36+
</Callout>
37+
38+
### Add Users
39+
40+
Click on the "Assignments" in the top navigation bar to enter the user management interface, where you can create or assign users in your organization to log in to LobeChat.
41+
42+
### Configure Environment Variables
43+
44+
When deploying LobeChat, you need to configure the following environment variables:
45+
46+
| Environment Variable | Type | Description |
47+
| ------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
48+
| `NEXT_AUTH_SECRET` | Required | Key used to encrypt Auth.js session tokens. You can generate a key using the following command: `openssl rand -base64 32` |
49+
| `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LoboChat. Use `okta` for Okta. |
50+
| `AUTH_OKTA_ID` | Required | Client ID of the Okta application |
51+
| `AUTH_OKTA_SECRET` | Required | Client Secret of the Okta application |
52+
| `AUTH_OKTA_ISSUER` | Required | Domain of the Okta application, `https://example.oktapreview.com` |
53+
| `NEXTAUTH_URL` | Optional | The URL is used to specify the callback address for the execution of OAuth authentication in Auth.js. It needs to be set only when the default address is incorrect. `https://example.com/api/auth` |
54+
55+
<Callout type={'tip'}>
56+
You can refer to the related variable details at [📘Environment Variables](/docs/self-hosting/environment-variable/auth#okta).
57+
</Callout>
58+
</Steps>
59+
60+
<Callout>
61+
After successful deployment, users will be able to authenticate and use LobeChat using the users
62+
configured in Okta.
63+
</Callout>
64+
65+
[okta-client-page]: https://login.okta.com

‎docs/self-hosting/environment-variables/auth.mdx

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,29 @@ LobeChat provides a complete authentication service capability when deployed. Th
249249
- Default: `-`
250250
- Example: `https://your-instance-abc123.zitadel.cloud`
251251

252+
### Okta
253+
254+
#### `AUTH_OKTA_ID`
255+
256+
- Type: Required
257+
- Description: Client ID of the Okta application. This can be found under your application settings in the Okta console.
258+
- Default: `-`
259+
- Example: `ac12c950f3ce48c8a45a`
260+
261+
#### `AUTH_OKTA_SECRET`
262+
263+
- Type: Required
264+
- Description: Client Secret of the Okta application. This can be found under your application settings in the Okta console.
265+
- Default: `-`
266+
- Example: `ex1HqvSOOkC5INqo42grOSqNvHoD4p84em1yy5QU7v88IZlaWGywFjYkrkpkSopt`
267+
268+
#### `AUTH_OKTA_ISSUER`
269+
270+
- Type: Required
271+
- Description: Issuer of the Okta application. This is the URL of the Okta instance -- If branding is set up, it can be your custom domain.
272+
- Default: `-`
273+
- Example: `https://your-instance.okta.com`
274+
252275
### Generic OIDC
253276

254277
#### `AUTH_GENERIC_OIDC_ID`

‎src/libs/next-auth/sso-providers/index.ts

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,16 @@ import Authentik from './authentik';
44
import AzureAD from './azure-ad';
55
import Casdoor from './casdoor';
66
import CloudflareZeroTrust from './cloudflare-zero-trust';
7+
import Cognito from './cognito';
78
import GenericOIDC from './generic-oidc';
89
import Github from './github';
910
import Google from './google';
1011
import Keycloak from './keycloak';
1112
import Logto from './logto';
1213
import MicrosoftEntraID from './microsoft-entra-id';
14+
import Okta from './okta';
1315
import WeChat from './wechat';
1416
import Zitadel from './zitadel';
15-
import Cognito from "./cognito";
1617

1718
export const ssoProviders = [
1819
Auth0,
@@ -29,5 +30,6 @@ export const ssoProviders = [
2930
WeChat,
3031
Keycloak,
3132
Google,
32-
Cognito
33+
Cognito,
34+
Okta,
3335
];

‎src/libs/next-auth/sso-providers/okta.ts

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
import Okta from 'next-auth/providers/okta';
2+
3+
import { CommonProviderConfig } from './sso.config';
4+
5+
const provider = {
6+
id: 'okta',
7+
provider: Okta({
8+
...CommonProviderConfig,
9+
authorization: { params: { scope: 'openid email profile' } },
10+
clientId: process.env.AUTH_OKTA_ID,
11+
clientSecret: process.env.AUTH_OKTA_SECRET,
12+
issuer: process.env.AUTH_OKTA_ISSUER,
13+
// Remove End
14+
profile(profile) {
15+
return {
16+
email: profile.email,
17+
id: profile.sub,
18+
image: profile.picture,
19+
name: profile.name ?? profile.preferred_username,
20+
providerAccountId: profile.sub,
21+
};
22+
},
23+
}),
24+
};
25+
26+
export default provider;

0 commit comments

Comments
 (0)