Updated Date: 04/30/2026
Configuring an Okta OAuth provider with discovery
Configure the Okta OAuth server and make a note of the OpenID URI to use for discovery.
OAuth Discover uses the global system DNS (not DNS resolvers) so you need to have configured a DNS remote lookup server using System > Configuration > Device > DNS to use discovery.
You can configure an Okta OAuth provider to obtain opaque tokens or JSON web tokens (JWTs) from an OAuth authorization server that supports them. When an OAuth provider supports discovery from a well-known endpoint, APM can discover JWTs and JSON web key (JWK) configurations from the provider.
Without discovery, you can still create token and key configurations in Access > Federation > JSON Web Token.
Note: APM includes preconfigured providers named AzureAD (Azure Active Directory from Microsoft), F5 (APM), Facebook, Google, Okta, and Ping (PingFederate from Ping Identity).
-
On the Main tab, click Access > Federation > OAuth Client / Resource Server > Provider.
The Provider screen opens.
-
Click Create.
-
Type the Name for the provider.
-
From the Type field, select Okta.
-
Select the Trusted Certificate Authorities.
-
Select Use Auto JWT.
-
In the OpenID URI field, specify the OpenID URI of the server.
-
Click Discover to fill in the remaining fields.
Note: This only works if you have configured a system DNS server in System > Configuration > Device > DNS.
-
Click Save.
The new Okta OAuth provider displays on the Provider screen.