# Okta OIDC integration NodeJS

**URL:** <https://devforum.okta.com/t/okta-oidc-integration-nodejs/26058>\
**Category:** OAuth/OIDC\
**Created:** [December 11, 2023, 11:13am UTC](https://devforum.okta.com/t/okta-oidc-integration-nodejs/26058 "2023-12-11T11:13:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![matthiasmaes](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@matthiasmaes](https://devforum.okta.com/u/matthiasmaes)\
**Post date:** [December 11, 2023, 11:13am UTC](https://devforum.okta.com/t/okta-oidc-integration-nodejs/26058/1 "2023-12-11T11:13:49Z")

</div>

Hi,

I’m trying to use Okta to provide SSO for one of our internal NodeJS apps using the documentation: [Sign users in to your web app using the redirect model | Okta Developer](https://developer.okta.com/docs/guides/sign-into-web-app-redirect/node-express/main/#configure-your-application-to-use-okta).

This is my config in my server file (removed the /default as we’re not using custom authorization servers as mentioned here: [OpenID Connect & OAuth 2.0 API | Okta Developer](https://developer.okta.com/docs/reference/api/oidc/#composing-your-base-url)):

```auto
passport.use('oidc', new Strategy({
  issuer: `https://${env.OKTA__DOMAIN}/oauth2`,
  authorizationURL: `https://${env.OKTA__DOMAIN}/oauth2/v1/authorize`,
  tokenURL: `https://${env.OKTA__DOMAIN}/oauth2/v1/token`,
  userInfoURL: `https://${env.OKTA__DOMAIN}/oauth2/v1/userinfo`,
  clientID: env.OKTA__CLIENT_ID,
  clientSecret: env.OKTA__CLIENT_SECRET,
  callbackURL: 'http://localhost:1337/authorization-code/callback',
  scope: 'openid profile',
}, (issuer, profile, done) => done(null, profile)));

```

I’m presented with the following error:

```auto
AuthenticationError: Forbidden
    at allFailed (/Users/matthias/Development/deselect-admin-back/node_modules/passport/lib/middleware/authenticate.js:175:21)
    at attempt (/Users/matthias/Development/deselect-admin-back/node_modules/passport/lib/middleware/authenticate.js:183:28)
    at Strategy.strategy.fail (/Users/matthias/Development/deselect-admin-back/node_modules/passport/lib/middleware/authenticate.js:314:9)
    at /Users/matthias/Development/deselect-admin-back/node_modules/passport-openidconnect/lib/strategy.js:171:56
    at /Users/matthias/Development/deselect-admin-back/node_modules/oauth/lib/oauth2.js:209:7
    at passBackControl (/Users/matthias/Development/deselect-admin-back/node_modules/oauth/lib/oauth2.js:134:9)
    at IncomingMessage.<anonymous> (/Users/matthias/Development/deselect-admin-back/node_modules/oauth/lib/oauth2.js:157:7)
    at IncomingMessage.emit (events.js:412:35)
    at IncomingMessage.emit (domain.js:475:12)
    at endReadableNT (internal/streams/readable.js:1333:12)
    at processTicksAndRejections (internal/process/task_queues.js:82:21)

```

Any ideas?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [December 11, 2023, 7:03pm UTC](https://devforum.okta.com/t/okta-oidc-integration-nodejs/26058/2 "2023-12-11T19:03:54Z")

</div>

What’s returning the forbidden error? Is it attempting to validate a token or is a request to Okta failing?

---

<div class="post-metadata">

**Author:** ![matthiasmaes](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@matthiasmaes](https://devforum.okta.com/u/matthiasmaes)\
**Post date:** [December 12, 2023, 9:11am UTC](https://devforum.okta.com/t/okta-oidc-integration-nodejs/26058/3 "2023-12-12T09:11:59Z")

</div>

I’m assuming it’s the token validation part that fails as I can see the login attempt in the console and its marked as successful.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [December 12, 2023, 5:19pm UTC](https://devforum.okta.com/t/okta-oidc-integration-nodejs/26058/4 "2023-12-12T17:19:56Z")

</div>

If local token validation is occurring, its likely because you are using the Org Authorization Server to mint tokens. More information about this limitation here: [Signature Validation Failed on Access Token | Okta Help Center](https://support.okta.com/help/s/article/Signature-Validation-Failed-on-Access-Token?language=en_US)