We are building Angular 5 SPA and using Okta OIDC for user authentication. The angular app will be called from an external app like Salesforce within the enterprise. The user from external app will already be authenticated in Okta and the ID token will be passed from the external app.
In angular we should not display the sign in page to user, instead we have to validate the ID token received with Okta for authenticity and establish Okta SSO session. We were originally using getWithRedirect method where we pass the userid/pwd and get the Id token in Angular and add it to tokenManager within the webstorage
login() {
this.oktaAuth.token.getWithRedirect({
responseType: ['id_token', 'token'],
scopes: ['openid', 'email', 'profile']
});
}
async handleAuthentication() {
const tokens = await this.oktaAuth.token.parseFromUrl();
tokens.forEach(token => {
if (token.idToken) {
this.oktaAuth.tokenManager.add('idToken', token);
}
if (token.accessToken) {
this.oktaAuth.tokenManager.add('accessToken', token);
}
});
}
Please advice how can we validate the ID token received from external app and use the same token for validating the user instead of asking the user to login again