Okta OIDC

​

Overview

​

Prerequisites

• Okta Administrator Access: Permissions to create and configure applications in your Okta organization.
• Fiddler AuthN Administrator Access: Org Owner role in Fiddler’s AuthN management console.
• Deployment Information: The hostname of your Fiddler deployment, e.g. idpexample.dev.fiddler.ai.

​

Configuring Okta

​

Configuring Fiddler

1

Fiddler AuthN Console Sign-in

The URL to the Fiddler AuthN management console is your Fiddler instance base URL prepended with authn-. For example, if your Fiddler base URL is https://idpexample.dev.fiddler.ai then you will access the AuthN management console at https://authn-idpexample.dev.fiddler.ai.

Sign in using the AuthN console Org Owner user account credentials provided by your Fiddler representative.

2

Select Your Organization

Ensure your organization is selected in the dropdown. You may see the fiddler organization, but this is reserved for system use and should not be edited. Here we are using the idpexample organization.

3

Navigate to Identity Providers in Settings

Select Settings tab from the top menu and then select Identity Providers from the left navigation menu.

4

Add a New OIDC Provider

1. Select the Generic OIDC option in the Add provider section, which brings up the OIDC Provider form.
2. Note the callback URL shown in the form — it corresponds to the redirect URIs you registered in Okta earlier, so no further changes are needed in Okta.

5

Configure the Identity Provider in Fiddler

1. In the OIDC Provider form, enter the following values:
   1. Enter a name in the Name text box. This name is displayed on the SSO login button on the Fiddler sign-in page, so choose one your users will recognize.
   2. In the Issuer text box, paste the Issuer URL copied from the Okta admin console.
   3. In the Client ID and Client Secret text boxes, paste those values copied from the Okta admin console.
   

6

Configure Additional Parameters

1. Expand the optional section.
2. Add the text groups to the Scopes List text box and ensure it is listed along with openid, profile, and email.
3. Ensure the Automatic create and Automatic update checkboxes are selected.
4. Set the Determines whether an identity will be prompted to be linked to an existing account dropdown to Check for existing Username.

7

Save the Configuration Changes

Select the Create button and then select the Save button. You will be returned to the Organization Settings page.

8

Activate the Okta OIDC IdP

1. Select your IdP from the list and select the Activate button on the identity provider page.
2. Close the settings and then select Login Behavior and Security from the left nav menu and ensure the External login allowed checkbox is selected.
3. Select the Save button.

9

Create a Custom Action

Select the Actions tab from the top menu.

1. Select the New button in the Scripts section to create a new action script.
2. Copy the Okta OIDC Action Script below and paste it into the script text area.
3. Enter setAttributesOnOktaOIDCAuth in the Name text box.
4. Select the Add button.

File: Okta OIDC Action Script

function setAttributesOnOktaOIDCAuth(ctx, api) {
    let firstName = ctx.v1.providerInfo.getFirstName();
    let lastName = ctx.v1.providerInfo.getLastName();
    let email = ctx.v1.providerInfo.getEmail();
    let groups = ctx.getClaim('groups');

    let nameParts = [firstName, lastName];
    let filteredParts = nameParts.filter(part => part);
    let displayName = filteredParts.join(' ');

    if (firstName != undefined) {
      api.setFirstName(firstName);
    }
    if (lastName != undefined) {
      api.setLastName(lastName);
    }
    if (email != undefined) {
      email = email.toLowerCase();
      api.setEmail(email);
      api.setEmailVerified(true);
      api.setPreferredUsername(email);
    }

    if (displayName) {
      api.setDisplayName(displayName);
    }

    api.v1.user.appendMetadata('fiddler_authentication_type', 'SSO:OKTA:OIDC');
    if (groups === null || groups === undefined){
      groups = []
    }
    api.v1.user.appendMetadata('fiddler_groups', groups);
}

10

Configure the Action Trigger

Scroll down to the Flows section.

1. Select the External Authentication option for the Flow Type dropdown.
2. Select the + Add trigger button.
3. Select the Post Authentication option for the Trigger Type dropdown.
4. Select the setAttributesOnOktaOIDCAuth option for the Actions dropdown.
5. Select the Save button.

11

Set the Organization SSO Authentication Type

Add an organization metadata key so Fiddler can correctly identify and process this SSO connection. Set this once during setup.

1. Go to the Metadata section and select Edit.
2. Select the Add button, then enter the key fiddler_sso_authentication_type with the value SSO:OKTA:OIDC.
3. Select the Save button next to the new entry.

12

Validate the Integration

Before validating, ensure your Okta user account is assigned to the new Okta application you created.

1. Open your Fiddler URL (e.g. https://idpexample.dev.fiddler.ai).
2. Ensure you see the Fiddler sign-in page and that it displays an SSO login button labeled with the name you configured (e.g. Okta OIDC).
3. Select the button and confirm that the Fiddler application loads.

The first user to sign in to the Fiddler application is automatically assigned the Fiddler Org Admin role; subsequent members are Org Members by default.

​

Getting Help

​

Important Notes

• Data Storage: Fiddler stores the following profile attributes from Okta: first name, last name, display name, email address, and group memberships (used to map users to Fiddler teams).
• API Access: For programmatic API access, users create an API key from the Credentials tab in Fiddler’s Settings page.
• Single Authentication Method: Users can only authenticate via either SSO or email authentication, not both.

​

Next Steps

• Train Users: Provide guidance on accessing Fiddler through Okta SSO.
• Configure Teams: Map your identity provider groups to Fiddler teams — see Mapping AD Groups to Fiddler Teams.
• Test Group Sync: Verify automatic group synchronization is working as expected.
• Monitor Usage: Review authentication logs and user access patterns.