Updated Date: 04/30/2026
Creating an OAuth authentication subroutine
You should have a per-request policy, an OAuth authentication server for authentication with Okta, and RADIUS server for authentication with MFA.
Create the subroutines to allow continuous checks and authentication with OAuth and MFA when the user goes to a specific URL.
-
From the Main tab, click Access > Profiles / Policies > Per-Request Policies.
-
Find the policy you want to edit, and in the Per-Request Policy column, click Edit.
-
In the per-request policy, click Add New Subroutine.
-
Name the subroutine for use with OAuth and MFA. For example,
OAuth Login. -
Click Save.
-
Expand the subroutine, and click the plus to add a new item.
-
Click the Authentication tab, select OAuth Client, and click Add Item.
-
Configure the OAuth client settings for your environment.
-
Click Save.
-
On the Successful branch, click the plus to add a new item.
-
Click the Authentication tab, select OAuth Scope, and click Add Item.
-
Configure the OAuth scope settings for your environment.
-
Click Save.
-
On the Successful branch, click (+) to add a new item.
-
Click the Assignment tab, select Variable Assign, and click Add Item.
-
Click Add new entry.
-
On the left, select Custom Variable and type
subsession.logon.last.username. -
On the right, select Session Variable and type
subsession.oauth.client.last.id_token.preferred_username. -
Specify terminals for success and fail branches.
This example shows a completed subroutine for OAuth auth.
The OAuth auth subroutine is now configured.
Configure the MFA subroutine, and add the subroutines to a per-request policy.