# Issues implementing OIDC authentication with Okta
**URL:** https://discourse.sensu.io/t/issues-implementing-oidc-authentication-with-okta/2499
**Category:** Sensu Go
**Created:** [March 12, 2021, 10:04pm UTC](https://discourse.sensu.io/t/issues-implementing-oidc-authentication-with-okta/2499 "2021-03-12T22:04:51Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@jbs](https://discourse.sensu.io/u/jbs)
#### Post date: [March 12, 2021, 10:04pm UTC](https://discourse.sensu.io/t/issues-implementing-oidc-authentication-with-okta/2499/1 "2021-03-12T22:04:51Z")
Hi, I am attempting to configure OIDC with Okta by following instructions [OpenID Connect 1.0 protocol (OIDC) reference - Sensu Docs](https://docs.sensu.io/sensu-go/5.21/operations/control-access/oidc-auth/#register-an-oidc-application) as closely as possible.
After following the instructions it appears I can login successfully
> ```
> $ ./sensuctl login oidc
> Launching browser to complete the login via your OIDC provider at following URL:
>
> https://our-api-domain-name//api/enterprise/authentication/v2/oidc/authorize?callback=http%3A%2F%2Flocalhost%3A8000%2Fcallback
>
> You may also manually open this URL. Waiting for callback...
>
> OIDC authentication has been successful
>
> ```
however, it seems I am not authenticated when I attempt commands
> ```
> $ ./sensuctl event list
> Error: unauthorized to perform action
>
> $ ./sensuctl auth list
> Error: unauthorized to perform action
>
> $ ./sensuctl entity list
> Error: unauthorized to perform action
>
> ```
Then when I attempt to login using the new dashboard login button “SIGN-IN WITH OKTA” it again appears my login was partially successful but with errors
Note: the blue block-out is my email address
To setup the OIDC in Sensu I used the following yaml file
> ```
> type: OIDC
> api_version: authentication/v2
> metadata:
> created_by: admin
> labels:
> sensu.io/managed_by: sensuctl
> name: okta
> spec:
> additional_scopes:
> - email
> - groups
> client_id: our-client-id
> client_secret: our-client-secret
> groups_claim: groups
> groups_prefix: ""
> redirect_uri: https://our-api-domain-name/api/enterprise/authentication/v2/oidc/callback
> server: https://our-domain-name.okta.com
> username_claim: email
> username_prefix: ""
>
> ```
and my Okta configuration is
> ```
> General Tab
> Client Credentials:
> Client ID: our-client-id
> Client secret: our-client-secret
> General Settings
> Okta domain: our-domain-name.okta.com
> Application:
> Application name: our-application-name
> Application type: Web
> Allowed grant types:
> Client acting on behalf of itself: [x] Client Credentials
> Client grant types:
> [x] Authorization Code
> [x] Refresh Token
> [x] Implicit (Hybrid)
> [x] Allow Token with implicit grant type
> [] Allow Access Token with implicit grant type
> USER CONSENT
> User consent: [x] Require consent
> Terms of Service URI:
> Policy URI:
> Logo URI:
> LOGIN
> Login redirect URIs: https://our-api-domain-name/api/enterprise/authentication/v2/oidc/callback
> Logout redirect URIs:
> Login initiated by: Either Okta or App
> Application visibility:
> [x] Display application icon to users
> [] Display application icon in the Okta Mobile app
> Login flow:
> (x) Redirect to app to initiate login (OIDC Compliant)
> ( ) Send ID Token directly to app (Okta Simplified)
> Initiate login URI: https://our-api-domain-name/api/enterprise/authentication/v2/oidc/callback
>
> Sign on Tab
> Settings
> Sign on methods: (x) OpenID Connect
> Token Credentials: Automatic
> OpenID Connect ID Token
> Issuer: https://our-domain-name.okta.com
> Audience: client-id
> Claims: Claims for this token include all user attributes on the app profile.
> Groups claim type: Filter
> Groups claim filter: [groups][Matches reges][.*]
> Sign On Policy
> Default sign on rule
>
> ```
Versioning:
- Sensu Go Backend (Docker): 5.21.3
- sensuctl: 5.21.4
Is there something I have misconfigured?
---
### Author:  [@ccressent](https://discourse.sensu.io/u/ccressent)
#### Post date: [March 15, 2021, 11:28pm UTC](https://discourse.sensu.io/t/issues-implementing-oidc-authentication-with-okta/2499/2 "2021-03-15T23:28:40Z")
Hi @jbs,
Do you have appropriate roles and role bindings defined for those OIDC users/groups? Without those, you can login with OIDC, like you did, but it’s expected that you would have no permissions whatsoever by default. In other words, you would have _authentication_ working correctly but there is no _authorization_ configured!
I see you’re using 5.21; here is a relevant entry point in the docs:
[https://docs.sensu.io/sensu-go/5.21/operations/control-access/#authorization](https://docs.sensu.io/sensu-go/5.21/operations/control-access/#authorization)
---
### Author:  [@jbs](https://discourse.sensu.io/u/jbs)
#### Post date: [March 18, 2021, 7:47pm UTC](https://discourse.sensu.io/t/issues-implementing-oidc-authentication-with-okta/2499/3 "2021-03-18T19:47:00Z")
Hi @ccressent,
Thanks, as a test I created a cluster-role-binding for the default cluster-role cluster-admin:
> sensuctl cluster-role-binding create okta --cluster-role=cluster-admin --group=our-group
With this sensuctl authentication worked correctly.
To get a direct Okta auth to redirect me to the dashboard I had to modify my Okta configuration with:
> Initiate login URI: [https://our-api-domain-name/api/enterprise/authentication/v2/oidc/authorize?callback=https://our-dashboard-domain-name/a/oidc/callback?redirect-to=/c/~/n/default/events](https://our-api-domain-name/api/enterprise/authentication/v2/oidc/authorize?callback=https://our-dashboard-domain-name/a/oidc/callback?redirect-to=/c/~/n/default/events)
All is working now. Thanks again.