You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/ROOT/pages/tutorial/index.adoc
+1-1
Original file line number
Diff line number
Diff line change
@@ -10,5 +10,5 @@ The following step-by-step tutorials cover common operational tasks or otherwise
10
10
* xref:tutorial/neo4j-admin-import.adoc[Neo4j Admin import] -- This tutorial provides detailed examples to illustrate the capabilities of importing data from CSV files with the command `neo4j-admin database import`.
11
11
* xref:tutorial/tutorial-composite-database.adoc[Set up and use a Composite database] -- This tutorial walks through the basics of setting up and using Composite databases.
12
12
* xref:tutorial/access-control.adoc[Fine-grained access control] -- This tutorial presents an example that illustrates various aspects of security and fine-grained access control.
13
-
* xref:tutorial/tutorial-sso-configuration.adoc[Configuring Neo4j Single Sign-On (SSO)] -- This tutorial presents examples and solutions to common problems when configuring SSO.
13
+
* xref:tutorial/tutorial-sso-configuration.adoc[Configuring Neo4j Single Sign-On (SSO)] -- Examples and solutions to common problems when configuring SSO.
14
14
* xref:tutorial/tutorial-clustering-docker.adoc[Deploy a Neo4j cluster in a Docker container] -- This tutorial walks through setting up a Neo4j cluster on your local computer for testing purposes.
Copy file name to clipboardExpand all lines: modules/ROOT/pages/tutorial/tutorial-sso-configuration.adoc
+74-39
Original file line number
Diff line number
Diff line change
@@ -47,32 +47,52 @@ Thus, changing the username claim from `sub` is not recommended.
47
47
48
48
== Okta
49
49
50
-
=== Access token
50
+
The following examples show how to configure Okta for authentication and authorization using access tokens and ID tokens.
51
+
It assumes that you are using Okta Developer Edition Service.
52
+
For the complete guide on how to customize tokens returned from Okta with a groups claim, see the https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/[Okta official documentation].
51
53
52
-
This example shows how to configure Okta for authentication and authorization using access tokens.
54
+
=== Configure the client
53
55
56
+
. From the left-hand side of the Okta dashboard, navigate to *Applications* and click *Create App Integration*.
57
+
. Select *OIDC - OpenID Connect* for Sign-in method and *Single-Page Application* for Application type.
58
+
. Click *Next*.
54
59
. Configure the client with the appropriate redirect URI.
. Create groups in Okta, assign users to them (the user can be added to a group either on user creation or editing the group), and map them in the `neo4j.conf` to native groups:
67
-
+
68
-
image::sso-configuration-tutorials/oidc-okta-server-groups.png[title="Okta OIDC server groups"]
82
+
This example shows how to configure Okta for authentication and authorization using access tokens and how to configure Neo4j to use them.
83
+
84
+
==== Add a groups claim to access tokens
85
+
86
+
. From the left-hand side of the Okta dashboard, navigate to *Security -> API*.
87
+
. Click the default authorization server (the one that shows `api://default` as audience) to return the `groups` claim in access tokens:
88
+
.. On the *Claims* tab, click *Add Claim*.
89
+
.. Add a claim with the name `groups`.
90
+
.. From the *Value type* dropdown, select *Groups*.
91
+
.. From the Filter dropdown, select *Matches regex* and the value `.*`.
92
+
.. Click *Create*.
93
+
94
+
==== Configure Neo4j
69
95
70
-
. Configure the default authorization server (the one that shows `api://default` as audience) to return the `groups` claim in access tokens:
You can add a groups claim to ID tokens to configure authentication and authorization using ID tokens.
129
+
130
+
. From the left-hand side of the Okta dashboard, navigate to *Security -> API*.
131
+
. Click the default authorization server (the one that shows `api://default` as audience) to return the `groups` claim in access tokens:
132
+
.. On the *Claims* tab, click *Add Claim*.
133
+
.. Add a claim with the name `groups`.
134
+
.. From the *Include in token type* dropdown, select *ID Token*.
135
+
.. From the *Value type* dropdown, select *Groups*.
136
+
.. From the Filter dropdown, select *Matches regex* and the value `.*`.
137
+
.. Click *Create*.
138
+
. Add a claim with the name `userid` and the value type `User ID`.
111
139
+
112
140
[NOTE]
113
141
====
114
-
In the case of access tokens, a default sub is already provided automatically.
115
-
However, for ID tokens, the name you give to your claim needs to be also indicated in the configuration `dbms.security.oidc.okta.claims.username=userid`.
142
+
The `userid` claim is not included in the ID token by default like the default `sub` claim for access tokens, thus you need to add it manually.
143
+
The name you give to your claim needs to be also indicated in the configuration `dbms.security.oidc.okta.claims.username=userid` in the _neo4j.conf_ file.
116
144
====
117
-
+
118
-
. Configure the default authorization server (the one that shows api://default as audience) as indicated:
145
+
.. Click *Add Claim*.
146
+
.. Add a claim with the name `userid`.
147
+
.. From the *Include in token type* dropdown, select *ID Token*.
148
+
.. From the *Value type* dropdown, select *Expression*.
149
+
.. In the *Value* field, type `(appuser !=null) ? appuser.userName : app.clientId`.
150
+
.. Click *Create*.
151
+
152
+
==== Configure Neo4j
153
+
154
+
. Configure Neo4j to use Okta authentication by configuring the following settings in the _neo4j.conf_ file:
You can find the audience parameter under *OpenID Connect ID Token* of your application on the *Sign On* tab.
174
+
====
139
175
. (Optional) If you want control the authentication and authorization on a user level, configure xref:configuration/configuration-settings.adoc#config_dbms.security.require_local_user[`dbms.security.require_local_user`] to `true` in the _neo4j.conf_ file.
140
176
This setting mandates that users with the relevant auth provider attached to them must exist in the database before they can authenticate and authorize with that auth provider.
141
177
For information on how to create users in this mode, see xref:authentication-authorization/manage-users.adoc#access-control-create-users[Creating users].
@@ -221,7 +257,6 @@ image::sso-configuration-tutorials/oidc-azure-client-creation.png[title="Entra O
221
257
The redirect URI `http://localhost:7474/browser/?idp_id=azure&auth_flow_step=redirect_uri` is the URI that will accept returned token responses after successful authentication.
222
258
. Click *Register*.
223
259
224
-
225
260
==== Configure Neo4j
226
261
. After the successful app creation, on the app's *Overview* page, find the Application (client) ID value. Use it to configure the following properties in the _neo4j.conf_ file.
0 commit comments