Skip to main content
In this tutorial, you’ll configure HashiCorp Vault to authenticate users through Okta. You will:
  1. Create an Okta API token
  2. Enable and verify the Okta auth method in Vault
  3. Configure Vault with your Okta organization details
  4. Map Okta users (and groups) to Vault policies
  5. Sign in to Vault via Okta (CLI and UI)
By the end, Vault will trust Okta as an identity provider, enforcing your Vault policies based on Okta users and groups.

​
1. Create an Okta API Token

  1. Log in to the Okta Admin Console.
  2. Go to Security → API → Tokens.
  3. Click Create Token, give it a descriptive name (for example, Vault-Integration), and copy the generated token.
The image shows a web interface for creating an API token on Okta, with a pop-up message confirming the token creation and displaying the token value.
Treat your Okta API token like a password. Store it securely (for example, in Vault’s Cubbyhole or an environment variable).

​
2. Enable the Okta Auth Method in Vault

On your Vault server (shown here running in dev mode), enable the Okta auth backend:
Sample output:

​
3. Configure the Okta Auth Method

Provide Vault with your Okta base URL, organization name, and the API token you created:
Verify the settings:
Expected response:
If your organization requires multi-factor authentication, set bypass_okta_mfa to false (default) to enforce it.

​
4. Map an Okta User to a Vault Policy

Assign an Okta user (for example, bryan@krausen.io) to a Vault policy (e.g., bryan):
Output:

​
5. Sign in to Vault via Okta

​
CLI Authentication

You will be prompted for your Okta password and any additional MFA factors.

​
UI Authentication

  1. Open the Vault UI and select Okta as the login method.
  2. Enter your Okta username and password, then click Sign in.
The image shows a login page for "Vault" with fields for method, username, and password, and a "Sign in" button. The method selected is "Okta."
After signing in, view mapped users under Access → Okta → Users. You can also add or edit users:
The image shows a user interface for creating a new user in a system, with fields for name, groups, and policies, and options to save or cancel.
To map Okta groups in Vault, navigate to Access → Okta → Groups, specify the group name and Vault policies, then save:
The image shows a web interface for creating a group in a Vault application, with fields for entering a name and policies, and options to save or cancel. A pop-up warning about unsaved changes is also visible.
With these steps complete, Vault is now integrated with Okta for user and group authentication. Policies defined in Vault will be enforced based on your Okta identities.

Watch Video