> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# OIDC: Okta Configuration

> This document provides instructions for creating an application within Okta for compatibility with BloodHound Enterprise.

export const IDPIntro = ({auth_mode}) => {
  const mode = (auth_mode || '').toUpperCase();
  const isOIDC = mode === 'OIDC';
  const href = isOIDC ? '/manage-bloodhound/auth/oidc' : '/manage-bloodhound/auth/saml';
  const label = isOIDC ? 'OIDC' : 'SAML';
  return <Tip>
      See <a href={href}>{label} in BloodHound</a> for order of operations, general {label} setup, and user configuration in BloodHound.
    </Tip>;
};

<img noZoom src="https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max&auto=format&n=tTIczgde9H07oLXf&q=85&s=ad49a576589f4d2a8081df77d07fdf56" alt="Applies to BloodHound Enterprise and CE" width="482" height="45" data-path="assets/enterprise-AND-community-edition-pill-tag.svg" />

<IDPIntro auth_mode="OIDC" />

## Create an Okta application

To create an Okta application for BloodHound, complete the following steps:

<Steps>
  <Step title="Create a new Okta application">
    Follow the [Okta documentation](https://help.okta.com/oie/en-us/content/topics/apps/apps_app_integration_wizard_oidc.htm) to create a new application.

    <Note>Set your application type to **Native**.</Note>
  </Step>

  <Step title="Configure the Okta application">
    When configuring the Okta application, use the following settings:

    | Field               | Value                                                                                                                                                          |
    | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | **Login redirect**  | `https://{domainname}/api/v2/sso/{chosenProviderName}/callback`<br /><br />**Example**: `https://test.bloodhoundenterprise.io/api/v2/sso/bhestandard/callback` |
    | **Logout redirect** | `https://{domainname}/`<br /><br />**Example**: `https://test.bloodhoundenterprise.io/`                                                                        |

    <Tip>
      Note the following values:

      * **Client ID**
      * **Issuer URL**

      You'll use the **Client ID** from the Okta *Client Credentials* and the **Issuer URL** from the Okta *Authorization Server* when you [configure BloodHound](/manage-bloodhound/auth/oidc#configure-bloodhound).
    </Tip>
  </Step>

  <Step title="Create custom claims">
    If you want to map additional user attributes (first name, last name, role) from Okta to BloodHound, you must create [custom claims](https://help.okta.com/oie/en-us/content/topics/apps/federated-claims-overview.htm) in Okta.

    Go to **Security** > **API** > **Authorization Servers** > **Claims** and create the following claims:

    <Tabs>
      <Tab title="First name">
        | Field                     | Setting                |
        | ------------------------- | ---------------------- |
        | **Name**                  | first\_name            |
        | **Include in token type** | ID Token → Always      |
        | **Value type**            | Expression             |
        | **Value**                 | `user.firstName`       |
        | **Include in**            | Any scope (or Profile) |
      </Tab>

      <Tab title="Last name">
        | Field                     | Setting                |
        | ------------------------- | ---------------------- |
        | **Name**                  | last\_name             |
        | **Include in token type** | ID Token → Always      |
        | **Value type**            | Expression             |
        | **Value**                 | `user.lastName`        |
        | **Include in**            | Any scope (or Profile) |
      </Tab>

      <Tab title="Role">
        | Field                     | Setting                |
        | ------------------------- | ---------------------- |
        | **Name**                  | roles                  |
        | **Include in token type** | ID Token → Always      |
        | **Value type**            | Groups                 |
        | **Filter**                | Starts with --> `bh-`  |
        | **Include in**            | Any scope (or Profile) |
      </Tab>
    </Tabs>
  </Step>
</Steps>