Okta

Enable passwordless, biometric login for your Okta users using 1Kosmos as a SAML 2.0 Identity Provider. Once connected, users authenticate with Touch ID, Face ID, or LiveID instead of a password.

---

Prerequisites

Before starting, make sure you have:

• AdminX portal — Admin access to your 1Kosmos AdminX tenant. The email used here must match the email used to log in to Okta.
• Okta Admin account — Admin access to your Okta tenant. (Sign up here if needed.)
• 1Kosmos mobile app — Installed and enrolled on iOS or Android. (Android · iOS)

  • Biometrics (Touch ID / Face ID or LiveID) must be enrolled before testing.

---

Step 1 — Configure Okta

Note: These steps are performed by your Okta administrator.

1. Sign in to your Okta Admin console (e.g., https://<your_domain>-admin.okta.com).
2. Copy and save your Okta admin domain URL.

Generate an API Token

You'll need an API token to authenticate AdminX with Okta during setup.

1. In the Okta Admin console, go to Security → API → Tokens.
2. Click Create Token and enter a name (e.g., 1Kosmos-AdminX).
3. Copy the generated token value and save it — it won't be shown again.
4. Click OK, got it.

---

Step 2 — Connect Okta in AdminX

Note: These steps are performed by your AdminX administrator. Credentials entered here are one-time use only. 1Kosmos does not store them — rotate passwords and revoke tokens after setup.

1. Sign in to the AdminX portal and go to Applications → Add Application.
2. Under Pre-built integrations, click Add Integration on the Okta card.
3. Fill in the following fields:

   Field	Value
   Application Name	A display name for this integration
   Okta Domain	Your Okta admin domain URL (from Step 1)
   Okta API Token	The token generated in Step 1

4. Click Connect.

AdminX automatically creates an Identity Provider configuration in Okta named BlockID and enables the SAML integration.

---

Step 3 — Configure Routing Rules in Okta (Optional)

Routing Rules let you define which users are redirected to 1Kosmos for authentication based on attributes, device, location, or app context. This step is optional but recommended for production rollouts.

Note: These steps are performed by your Okta administrator.

1. In the Okta Admin console, go to Security → Identity Providers → Routing Rules → Add Routing Rule.
2. Configure the rule as needed:

   Setting	Recommended Value
   Rule Name	e.g., 1Kosmos Biometric Login
   User's IP is	Anywhere
   User's device platform	Any device
   User is accessing	Any application (or specific apps)
   User matches	Set your criteria (e.g., User Attribute, Group)
   Use this identity provider	BlockID

3. Click Create Rule, then click Activate.

Users not matched by the routing rule can still access Okta directly at {your-okta-domain}/login/default.

---

Step 4 — Test the Connection

1. Open a browser and go to your Okta domain URL.
2. You'll be redirected to the 1Kosmos AdminX login screen with a QR code.
3. On the 1Kosmos mobile app home screen, tap Scan QR.
4. Scan the QR code. When prompted, select Allow only while using the app.
5. Tap Authenticate and complete biometric verification (Touch ID, Face ID, or LiveID).
6. On success, you'll be logged in to your Okta application.

---