# Okta -- Add CodeB Sovereign Communications as an OIDC Identity Provider

Documented integration guide. This is not an Okta Integration Network app,
not certified by Okta -- just a copy-paste OIDC IdP config that surfaces
"European Digital Identity Wallet" sign-in inside your existing Okta org.

Full guide + verification steps:
https://<CODEB_TENANT_HOST>/iam-integrations.html#okta

## Prerequisite
- Okta org admin ("Super Administrator")
- One OIDC client registered on the CodeB tenant admin console
  (`/oidc-clients.html`) with the redirect URI set to your Okta callback:
  `https://<YOUR_OKTA_DOMAIN>/oauth2/v1/authorize/callback`
- The `client_id` and `client_secret` Okta issued for that client

## Steps (Okta admin UI)

1. Security -> Identity Providers -> Add Identity Provider -> OpenID Connect IdP
2. Fill in:
   - Name: `CodeB (EU Digital Identity Wallet)`
   - IdP Username: `idpuser.email`
   - Match against: `Okta Username or Email`
   - If no match is found: `Create new user (JIT)`
   - Client ID: `<CLIENT_ID>`
   - Client Secret: `<CLIENT_SECRET>`
   - Scopes: `openid profile email`
   - Issuer: `https://<CODEB_TENANT_HOST>`
   - Authorization endpoint: `https://<CODEB_TENANT_HOST>/oidc.ashx/authorize`
   - Token endpoint: `https://<CODEB_TENANT_HOST>/oidc.ashx/token`
   - JWKS endpoint: `https://<CODEB_TENANT_HOST>/.well-known/jwks.json`
   - Userinfo endpoint: `https://<CODEB_TENANT_HOST>/oidc.ashx/userinfo`
   - PKCE required: `On` (method `S256`)
3. Save. Okta shows a redirect URI -- copy it back into the CodeB OIDC client's
   allowed redirect URIs at `/oidc-clients.html` if it differs from step-prereq.
4. Security -> Identity Providers -> Routing Rules -> Add Rule. Route the
   users you want (e.g. by email domain) to the new "CodeB (EU Digital Identity
   Wallet)" IdP.

## Verify
- Log out of Okta.
- Visit your Okta org sign-in page. You should see a "Sign in with CodeB"
  button (or your custom-labelled equivalent).
- Click through. CodeB's `/oidc.ashx/authorize` picker appears (password,
  passkey, EU Wallet). Complete any method.
- Okta finishes JIT provisioning and lands you on the Okta dashboard.

## Claim mapping (Okta Profile Editor -> Identity Provider profile)

| CodeB claim          | Okta user attribute            | Notes                                           |
| -------------------- | ------------------------------ | ----------------------------------------------- |
| `sub`                | `externalId`                   | Stable tenant-scoped subject ID                 |
| `email`              | `email`                        | Standard OIDC                                    |
| `email_verified`     | `emailVerified` (custom)        | Boolean                                         |
| `preferred_username` | `login`                        | Display username                                 |
| `role`               | `codebRole` (custom string)     | `admin` / `user` / `siponly` / `guest`          |
| `eudi_verified`      | `eudiVerified` (custom bool)    | True if this session came via EU Wallet         |
| `wallet_attestation` | `walletAttestation` (custom)    | Present iff HAIP 5.11 Wallet Attestation shown  |

Add each custom attribute under Directory -> Profile Editor -> Identity
Providers before saving the mapping.