Restrict IP Addresses on OIDC App

Loading

Skip to Navigation Skip to Main Content

Search

Search

Select Language

0D5KZ00000axaR60AIOkta Classic EngineAuthenticationAnswered2025-03-31T15:21:39.000Z2025-03-25T02:39:24.000Z2025-03-31T15:21:39.000Z

NeilC.50012 (Customer) asked a question.

Edited March 25, 2025 at 2:41 AM

Restrict IP Addresses on OIDC App

I have tried a number of different methods to restrict inbound IP addresses on an OIDC application with no luck. I have added a zone and created a rule. Applying one or both of these does not result in users getting blocked from authenticating through OKTA on IP addresses outside of the range I provided.

How can I set an IP range in an OIDC application and ensure that any user outside of that range cannot authenticate through the OKTA app

Authentication

Top Rated Answers

NeilC.50012 (Customer)
a year ago
The answer here is that when you create a zone and then go to create your rules in your SAML or OIDC app, you need to create two rules each time. One rule for allow and one rule for deny
Expand Post
Selected as Best

All Answers

paul.stiniguta1.508386743840768E12 (Okta, Inc.)
a year ago
Hello @NeilC.50012 (Customer) Thank you for posting on our Community page!

As long as the rule and Zone are configured properly, users trying to access the application outside of the set rage should not access the application.
Please see below a similar question on this topic:
https://devforum.okta.com/t/restrict-oidc-app/25978

Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Expand Post
NeilC.50012 (Customer)
a year ago
I guess that is the issue then. they must not be configured correctly but there is not a lot to the configuration. My rule is only using IF user's IP is In Zone. My zone has a single IP address range. When I Edit my IP Zone it shows my current IP address and the address in the gateway IP section. These are different but never blocks me from connecting.
Expand Post
NeilC.50012 (Customer)
a year ago
I have seen this work with countries but trying the same exact set up with IP addresses does not block users
Expand Post
NeilC.50012 (Customer)
a year ago
The answer here is that when you create a zone and then go to create your rules in your SAML or OIDC app, you need to create two rules each time. One rule for allow and one rule for deny
Expand Post
Selected as Best

This question is closed.

Recommended content

Forum

Okta IP restriction on Syria given the recently lifted U.S. sanctions under OFAC General License 25 May 23, 2025

Forum

Could an app be provisoned based on ip zone through Okta signin policy?

Forum

Okta user group assignment based on source ip address

Forum

OAuth2.0/OIDC implementation documentation on server/app side

Loading

Restrict IP Addresses on OIDC App