The Ultimate Engineering Toolkit for Apache Kafka®
Search…
kPow User Guide
About
Introduction
Our Team
Releases
Trials and Licenses
Support
Data Collection
Installation
Quick Start
System Requirements
Deployment Notes
Minimum ACL Permissions
Application Logs
OpenShift
AWS Marketplace
Troubleshooting
Configuration
Environment Variables
Kafka Cluster
Schema Registry
Kafka Connect
Multi-Cluster Management
Azure Event Hubs
Confluent Cloud
Redpanda
User Authentication
Overview
LdapLoginModule
PropertyFileLoginModule
JDBCLoginModule
OpenID/OAuth 2.0
GitHub
Okta
SAML
User Authorization
Overview
Simple Access Control
Role Based Access Control
Multi-Tenancy
Administration
Features
Kafka Streams
Data Governance (Audit Log)
Data Policies
HTTPS Connections
Live Mode
Data Inspect
Data Produce
Prometheus Integration
Slack Integration
Kafka Management
Topics
Groups
Brokers
ACLs
Connect
Schema Registry
Powered By GitBook
Okta
Secure kPow with Okta SSO and RBAC
This integration configures OpenID Connect as the authentication mechanism with Okta as the identity provider (IdP) and kPow as the relying party.

Create an Okta OpenID Application

  1. 1.
    Login to your Okta account.
  2. 2.
    Navigate to Admin > Applications > Create App Integration
  3. 3.
    In Create a New Application Integration popup set these values and click Create:
    • Sign on method: OIDC - OpenID Connect
    • Application type: Web Application
  4. 4.
    In Create OpenID Connect Integration set these values and click Save:
    • App integration name: The name of your kPow instance, e.g. 'kPow Staging'.
    • Sign-in redirect URIs: The absolute kPow callback URI, e.g. https://kpow-staging.mycorp.org/oauth2/okta/callback
    • Sign-out redirect URIs: The absolute URI of where kPow is hosted, e.g. https://kpow-staging.mycorp.org
  5. 5.
    Click Save and next you will be redirected to the applications settings page.
  6. 6.
    Navigate to General Settings > Edit, and configure: Initiate login URI: The absolute kPow login URI, e.g: https://kpow-staging.mycorp.org/oauth2/okta
    Optionally, if you would like Okta to appear in your organization's list of Okta apps:
    • Login initiated by: "Either Okta or App" selected.
    • Application visibility:
      • "Display application icon to users" selected.
      • "Display application icon in the Okta Mobile app" selected.
    • Allowed grant types:
      • "Implicit (Hybrid)" selected.
        • "Allow ID Token with implicit grant type" selected.
        • "Allow Access Token with implicit grant type" selected.
  7. 7.
    Make note of the Client Credentials section that appears below.
  8. 8.
    Click Assignments and assign users to kPow.
Okta OpenID Connect application setup for kPow
​

Integrate kPow with Okta OpenID

Set the following environment variables and start kPow:
  • AUTH_PROVIDER_TYPE=okta
  • OKTA_ORGANISATION= the name of your Okta organization, e.g. mycorp
  • OPENID_CLIENT_ID= the Client ID found in Client Credentials.
  • OPENID_CLIENT_SECRET= the Client Secret found in Client Credentials.
  • AUTH_LANDING_URI= The absolute kPow URI, e.g: https://kpow-staging.mycorp.org
kPow will now authenticate users with Okta (OpenID).

User Authorization (RBAC)

See the guide to Role Based Access Control for full configuration details.

Integration

When RBAC is enabled kPow will request groups scope to view the groups associated with an authenticated user. kPow considers Okta groups as roles in your RBAC configuration.
You will need to configure a relevant group claim filter for the kPow OpenID integration.
To match all groups use either 'Starts with' or 'Matches regex' and '.*'
Previous
GitHub
Next - User Authentication
SAML
Last modified 4mo ago
Copy link
Contents
Create an Okta OpenID Application
Integrate kPow with Okta OpenID
User Authorization (RBAC)