Overview

Meter authenticates Wi-Fi users against Okta using two app integrations: one checks a person's credentials when they connect, and a second reads their group membership.

Prerequisites

• Administrator access to the Okta admin console
• Your Okta org URL, for example https://example.okta.com

Step 1: Create the sign-in app

1. Sign in to the Okta admin console as an administrator.
2. Go to Applications → Applications → Create App Integration.
3. Choose OIDC - OpenID Connect, then Native Application.
4. Enter a name such as Meter NAC.
5. Under Grant type, expand Advanced and select Resource Owner Password.
6. Under Assignments, choose Limit access to selected groups and select the groups that should be able to join Wi-Fi.
7. Click Save.
8. On the General tab, edit Client Credentials and set Client authentication to Client secret.
9. Clear Require PKCE as additional verification.
10. Copy the Client ID and the Client secret.

Step 2: Create the app sign-in policy

Wi-Fi carries only a password so the sign-in app needs a policy that accepts a single factor. Without it, Okta rejects every connection. Create a new policy rather than editing the shared default which is usually applied to your other applications.

1. Go to Security → Authentication Policies.
2. On the App sign-in tab, click Add a policy.
3. Enter a name such as Meter NAC.
4. Open it, go to Rules, and set User must authenticate with to a single factor.
5. On the policy's Applications tab, click Add app and add the Meter NAC app.

Step 3: Create the API services app

Okta does not offer client credentials on the app from step one so directory reads need a second app.

1. Go to Applications → Applications → Create App Integration.
2. Choose API Services and enter a name such as Meter NAC directory read.
3. Click Save, then copy the Client ID.
4. On the Okta API Scopes tab, grant okta.users.read and okta.groups.read.
5. On the Admin roles tab, assign a role that can view users and groups, such as Read-Only Administrator.
6. On the General tab, set Client authentication to Public key / Private key. Leave the key list empty for now.
7. Turn off Require Demonstrating Proof of Possession (DPoP) header in token requests.
8. Click Save.

Step 4: Connect it in Dashboard

1. Log in to the Dashboard.
2. Go to NAC → Identities → IdPs.
3. Click Connect IdP and choose Okta.
4. Fill in the form:
   • Domain: the email domain of your Okta users, for example example.com
   • Org URL: your Okta org address, without -admin
   • Client ID: from step one
   • Client secret: from step one
   • Service client ID: from step three
5. Click Save.

Step 5: Register the directory read key in Okta

Saving the connection generates a key pair. Meter keeps the private half and shows you the public half to register in Okta.

1. On the connection's Config tab, copy the Directory read key.
2. In Okta, open the API services app from step three.
3. Go to General → Client Credentials → Public key / Private key → Add key.
4. Paste the key and save.
5. Return to Dashboard and click Test connection. Connection successful means you are ready to set up group mappings.

Need help?

If you run into any issues or have questions, please reach out to our Support Engineering team by opening a ticket via the Dashboard: https://dashboard.meter.com/support