Configuring Duo Security as an OpenID Connect (OIDC) Identity Provider (IdP) in Okta requires Okta Support to enable specific feature flags. Once enabled, the OpenID Connect IdP option becomes available in the Okta Admin Console, allowing the integration to proceed.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Duo Security
• OpenID Connect (OIDC) Identity Provider (IdP)

How is Duo Security configured as an OpenID Connect Identity Provider?

Request the required feature flags from Okta Support, verify the enablement in the Okta Admin Console, and configure the integration.

1. Contact Okta Support and request the enablement of the following features on the Okta tenant:
   • TOP_WINDOW_REAUTH_FROM_ENDUSER_SETTINGS
   • STATE_TOKEN_ALL_FLOWS
   • CLAIMS_AS_FACTOR
   • GENERIC_OIDC_IDP
2. Verify the feature enablement by navigating to the Okta Admin Console and checking for the OpenID Connect IdP option under Identity Providers.
3. Configure the OIDC IdP by following the Okta documentation for generic OIDC identity providers.

NOTE: If the Factors API is not retrieving the Duo IdP factor, contact Okta Support and verify that all four features listed above are enabled on the tenant.

What are the additional considerations for Duo Federal?

When setting up Duo Federal OIDC Universal Prompt and requiring the "(Beta) Asymmetric Signing for WebSDK 4" feature flag, contact Duo Support directly to request enablement.

Related References

• Generic OpenID Connect
• How to Integrate Okta with Duo Authenticator Universal Prompt