Do you see the 400 while you are still on the /authorize route in the Okta org, or after a redirect back to your application via the redirect_uri provided?
Do you see any details on the 400 error page returned back that explains what is wrong with your request?
If you’re seeing an Okta error page, double check that the client_id you provided exactly (case sensitive!) matches the one you see for the app in question in Okta and that the redirect_uri is added to the app (again, in Okta) as a Login redirect URI.
More details for the errors I’m describing found in the following docs:
I have checked the client_d and the redirect URI and read the referenced documentation. I attach various screenshots to show the OKTA dashboard settings, the error page and the start_auth_flow code at which point the code fails.
I have also tried using the code from the the okta-hosted-login directory in the https://github.com/okta/samples-php package using a similar .env file to code at …/RIBITuk/okta
I’m sure there must be something simple which is causing my frustration.
If you’re looking to use the Org Authorization Server, make sure you set the issuer to just your Okta domain (leave off the /oauth2 portion).
I couldn’t help but notice that a couple of your screenshots are from a trial org, but the one where you are getting a 400 is in a production org. Make sure you’re not mixing anything up in your config and that the Client Id you have in your code comes from the same org you are using as the issuer.
Since you’re using environment variables, there I can’t confirm that its the cause, but I have seen customers trip up on that in the past. A quick peek in our logs seems to confirm that the client_id being provided in that /authorize request does not correspond to an active OIDC application in the affected org.
After logging in return to the webpage used to login to OKTA (ie go to step 1 above).
I haven’t been able to find an example using just PHP and HTML but I don’t mind using a Javascript based solution.
Thank you for any enlightenment.
Graham
Why are you setting the redirect_uri to your Okta org’s login page? The redirect_uri should be a route within your OIDC application that will receive the authorization code and request tokens from Okta to log the user into your application. Thats why the sample uses a route within your locally hosted application as the redirect_uri.
As far as I know, you cannot convert from a Trial org to a Dev org, but you can sign up for a new dev org here. If you need your trial extended or are looking to convert this org a paid account, I recommend reaching out to our sales team
I was under the impression that instead of implementing my own password protected web pages I could use OKTA’s code to have Rotarians sign in to rotary.okta.com and then once they have signed in I would be able to show them the protected webpages on my website. I don’t need to know their names or emails I just need to know they have valid Rotary sign in credentials.
I now presume it’s not possible to do what I want to do or is it possible and if so how?
Graham
PS I have tried the route you suggested to get a dev account but the only way I can do that is by using another work email address which I will set up if what I want to achieve is possible.
Your application shouldn’t be relying on an Okta session alone and instead should be implementing an SSO protocol like SAML or OIDC to make sure that, not only the user has a session for your Okta org, but that they are already assigned to the application within that same Okta org.
Your application would then use the SAML assertion or OIDC tokens to create a session for the user within the application and not worry about the status of the Okta session. Then your application would rely on this session to determine if the user should have access to any secure routes in your application.
If you don’t need any of their use details, within OIDC you can simply request an ID and Access Token pair with the openid scope. This will ensure you get both types of tokens back, but no user profile data will be present within the token claims
Andrea,
I have looked at the code in ‘Build Simple Login in PHP’ and it is very similar to that in https://github.com/okta/samples-php (okta-hosted-login). I will study the SAML doc and attempt to create a web page which uses SAML as this seems to be what would fit my needs.
Thanks for your help.
Graham
