Administrators require information on how to make an OpenID Connect (OIDC) or OAuth application visible in the Okta Dashboard and the different login flows available. Okta provides specific configuration options within the application settings to enable dashboard visibility and define the login initiation process. Configure the application settings to allow the ID token with the implicit grant type, set the login initiation, and enable application visibility.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC) Application of type Web
• OpenID Connect (OIDC) Application of type Single Page Application (SPA)

How do administrators make an OpenID Connect or OAuth application visible in the Okta Dashboard?

Configure the application settings in the Okta Admin Console to allow the ID token with the implicit grant type, set the login initiation, and enable application visibility.

1. Navigate to the General settings of the application.
2. (Optional) Select Implicit (hybrid) and check Allow ID Token with implicit grant type. NOTE: Administrators must complete this step to use the Okta Simplified option discussed below.
3. Set Login initiated by to Either Okta or App.
4. Configure the login flow options and the Initiate login URI setting that becomes available.
5. Check Display application icon to users under Application visibility.

The following image displays the login configuration options within the general settings of an OIDC application.

What login flows are available when Okta or the application initiates the login?

When administrators configure the Login initiated by setting as Either Okta or App, two login options and the Initiate login URI setting become available. Review the following list to understand the available login flows and their requirements.

• Redirect to app to initiate login: Okta redirects to an application endpoint, which starts an authorized redirect back to Okta. Since the user is on the Okta Dashboard when this happens, Okta typically responds with a code or token to the callback and expects the application to move forward with the regular flow. This flow is available for a SPA or a Web application type. When end-users click an application on the Okta Dashboard, Okta redirects them to the initiate_login_uri of the client application with the query parameter iss (the Okta org). The application constructs an authorization request and redirects the end-user back to Okta. This login flow conforms to Section 4 of the OpenID Connect specification.
• Send ID Token directly to app (Okta Simplified): This flow is available only for a SPA. When choosing this option, administrators can also choose scopes. When the end-user clicks the application tile on the Okta Dashboard, Okta mints an id_token and makes a POST request to the initiate_login_uri with the id_token in the body of the POST request. Okta sends the token directly to an application endpoint, which consumes and uses it. NOTE: Administrators must enable the Implicit (hybrid) grant type and check Allow ID Token with implicit grant type to use this option.

Native OIDC applications require a Bookmark application for dashboard visibility.

Native OIDC applications do not appear on the end-user dashboard, and administrators cannot configure them to appear. Create a Bookmark application that redirects users to the specified application to have an application tile appear on the end-user dashboard for a Native OIDC integration. The configured initiate_login_uri is the URL that Okta redirects to when the end-user clicks the application on the Okta Dashboard. Only users assigned to the application see the bookmark.

Related References

• Create OIDC app integrations
• Develop a Custom OpenID Connect Application that can support SSO when launched from the Okta Dashboard
• Enabling OIDC Application Visibility to End Users in Okta