Relock with Okta

It is a companion to the Relock Integration Guide, which describes the architecture, the relay, and the NGINX/Lua deployment that are the same for every provider. Read that guide first — or alongside this one — and return here for the Okta specifics.

Replace app.example.com throughout with the domain your application is served from (the domain the Relock relay sits in front of).

What Relock needs from Okta. The relay derives its session anchor from the sub and auth_time claims in the access token the ALB injects. Okta exposes both by default, so no custom action or claim mapping is required — the two steps below are the whole configuration.

---

Step 1 — Application sign-in and sign-out URIs

In the Okta admin console: Applications → your application → General → LOGIN.

The sign-out redirect is what lets termination cascade through Okta to the SSO session (see Q2 in the main guide). Without it, a terminated session can silently respawn on the next request.

Step 2 — Trusted origin

In Security → API → Trusted Origins → Add Origin, add:

• /Origin URL: https://app.example.com

This authorizes the browser origin for the OIDC redirect flow.

Step 3 — AWS Application Load Balancer

On the HTTPS (443) listener → Rules → Default rule, add an authenticate-oidc action ahead of the forward action (the mechanics are described in §5.2 of the main guide). Populate it with Okta's OIDC endpoints and the client credentials from your Okta application.

Pull the exact endpoint values from Okta's discovery document — https://<your-okta-domain>/oauth2/default/.well-known/openid-configuration (or the discovery document of the custom authorization server you use). The typical pattern:

Do not add an audience extra parameter. Okta returns a decodable JWT access token by default, which is what the relay reads to derive the anchor. (This is the one field that differs from the Auth0 setup, where it is required.)

The ALB now sets its session cookie and injects x-amzn-oidc-accesstoken (plus x-amzn-oidc-data and x-amzn-oidc-identity) into requests reaching the NGINX target.

---

With Okta and the ALB configured, deploy the relay as described in the Relock Integration Guide → §5.2 The relay. No application code changes are required.