Skip to main content

External Application Cannot Authenticate Using Arc XP's Okta

Symptoms

  • Users of an external application must log in separately, even though they're already authenticated in Arc XP.

  • Arc XP's built-in Okta instance cannot be configured as an identity provider for a custom external application.

Cause

The Okta instance Arc XP provides only authenticates users into Arc XP. It's not an enterprise identity provider (IdP) for external or custom applications. It doesn't support the group management, role administration, or access controls an external application needs to manage its own permissions. It also allows self-registration, which isn't appropriate for gating access to an internal tool.

Solution

  1. Provision your own identity provider (IdP), for example your own Okta org or Microsoft Entra ID (Azure AD) tenant.

  2. Connect that IdP to Arc XP using the standard integration:

    1. Integrating Arc XP with Okta

    2. Integrating Arc XP with Microsoft Entra ID (Azure AD)

  3. Build and manage your own authentication flow (for example, OAuth/OIDC) in the external application against that same IdP.

Once your IdP is the shared source of truth for both systems, editorial users authenticated in one are recognized in the other, with no separate credentials to maintain. Arc XP validates its own login requests against your IdP the same way it always has. It doesn't issue or validate authentication tokens for external, non-Arc applications.

In this section: