# OpenID Connect Plugin Okta Integration Issue **URL:** \ **Category:** Questions\ **Tags:** kubernetes\ **Created:** [June 26, 2020, 3:56pm UTC](https://discuss.konghq.com/t/openid-connect-plugin-okta-integration-issue/6624 "2020-06-26T15:56:37Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 26, 2020, 3:56pm UTC](https://discuss.konghq.com/t/openid-connect-plugin-okta-integration-issue/6624/1 "2020-06-26T15:56:37Z")
Hi, I have deployed Kong Ingress Controller (dbless) and created an OIDC Kong Plugin (Okta) which looks like this: apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1) kind: KongPlugin metadata: name: oidc-auth config: issuer: https://\/oauth2/default/.well-known/openid-configuration client\_id: - XXXXXXXX client\_secret: - XXXXXX redirect\_uri: - https://\/\ http\_proxy: http://\:/ https\_proxy: http://\:/ plugin: openid-connect I have also created an Ingress Rule referencing the KongPlugin in annotations: [konghq.com/plugins:](http://konghq.com/plugins:) oidc-auth However when I try to access my resource, I get a 500 error code and the Kong-Proxy logs show the following message: 2020/06/26 15:39:20 [notice] 22#0: \*239609 [lua] cache.lua:371: [openid-connect] loading configuration for https://\/oauth2/default/.well-known/openid-configuration from database, client: XX.XXX.X.X, server: kong, request: “HEAD /users HTTP/1.1”, host: “\” 2020/06/26 15:39:20 [error] 22#0: \*239609 [lua] handler.lua:98: [openid-connect] **authorization endpoint was not specified** , client: XX.XX.X.X, server: kong, request: “HEAD /users HTTP/1.1”, host: “\” 99.198.2.1 - - [26/Jun/2020:15:39:20 +0000] “HEAD /users HTTP/1.1” 500 0 “-” “Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36” What would be the reason for this issue “ **authorization endpoint was not specified** ” ? Thanks Jon ---
**Author:** ![Satwant\_Singh](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/satwant_singh/32/2048_2.png) [@Satwant\_Singh](https://discuss.konghq.com/u/Satwant_Singh)\ **Post date:** [June 26, 2020, 8:42pm UTC](https://discuss.konghq.com/t/openid-connect-plugin-okta-integration-issue/6624/2 "2020-06-26T20:42:25Z")
> [@jondow](#): > > issuer: https://\/oauth2/default/.well-known/openid-configuration Could you change issuer: https://\/oauth2/default ---
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 27, 2020, 1:44pm UTC](https://discuss.konghq.com/t/openid-connect-plugin-okta-integration-issue/6624/3 "2020-06-27T13:44:18Z")
Hi Satwant, Unfortunately, https://\/oauth2/default does not work, as https://\/oauth2/default/.well-known/openid-configuration is the Okta endpoint which gives all the information needed to get the Autorization and Token Introspection endpoints. The strange thing is that there are not error when https://\/oauth2/default/.well-known/openid-configuration is invoked, but still I see an error showing that the “Authorization Point was not specified”, although The Authorization enpoint is returned in the result of the https://\/oauth2/default/.well-known/openid-configuration invocation. Is there any additionnal configuration of the OpenID COnnect Kong Plugin that has to be done? Thanks Jon ---
**Author:** ![Satwant\_Singh](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/satwant_singh/32/2048_2.png) [@Satwant\_Singh](https://discuss.konghq.com/u/Satwant_Singh)\ **Post date:** [June 28, 2020, 12:18am UTC](https://discuss.konghq.com/t/openid-connect-plugin-okta-integration-issue/6624/4 "2020-06-28T00:18:30Z")
I just tested it out with following version repository: [kong-docker-kong-enterprise-k8s.bintray.io/kong-enterprise-k8s](http://kong-docker-kong-enterprise-k8s.bintray.io/kong-enterprise-k8s) tag: 2.0.4.1-alpine Deployed a httpbin service kubectl apply -f [https://bit.ly/k8s-httpbin](https://bit.ly/k8s-httpbin) Here is my OIDC plugin configuration apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1) kind: KongPlugin metadata: name: okta-oidc-pl disabled: false config: client\_id: - myclientxxxx client\_secret: - mysecretxxxx issuer: [https://dev-xxxxx.okta.com/oauth2/myauthserverxxxx/.well-known/openid-configuration](https://dev-xxxxx.okta.com/oauth2/myauthserverxxxx/.well-known/openid-configuration) redirect\_uri: - [http://myhostxxxx/bin/get](http://myhostxxxx/bin/get) plugin: openid-connect ingress apiVersion: extensions/v1beta1 kind: Ingress metadata: name: okta-bin annotations: [konghq.com/strip-path:](http://konghq.com/strip-path:) “true” [konghq.com/plugins:](http://konghq.com/plugins:) okta-oidc-pl spec: rules: - http: paths: - path: /bin backend: serviceName: httpbin servicePort: 80 And it all works when i make a request get redirected for okta to authenticate 10.128.0.18 - - [28/Jun/2020:00:13:34 +0000] “GET /bin/get HTTP/1.1” 302 110 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:76.0) Gecko/20100101 Firefox/76.0” 2020/06/28 00:14:19 [notice] 22#0: \*7823 [lua] cache.lua:672: tokens\_load(): [openid-connect] loading tokens from the identity provider, client: 10.128.0.18, server: kong, request: “GET /bin/get?code=86mfkxV0PV-xSENljzxT&state=l5zpKUeN6kEJ9ASdxe56E1\_4 HTTP/1.1”, host: “myhostxxxxxx” 10.128.0.18 - - [28/Jun/2020:00:14:19 +0000] “GET /bin/get?code=86mfkxV0PV-xSENljzxT&state=l5zpKUeN6kEJ9ASdxe56E1\_4 HTTP/1.1” 200 1373 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:76.0) Gecko/20100101 Firefox/76.0” Maybe try deleting your plugin and reconfiguring also make sure your authorization server is setup correctly > **[Open-Source API Management and Microservice Management](https://docs.konghq.com/enterprise/1.5.x/plugins/oidc-okta/)** > > Secure, Manage & Extend your APIs or Microservices with plugins for authentication, logging, rate-limiting, transformations and more. ---
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 29, 2020, 12:16pm UTC](https://discuss.konghq.com/t/openid-connect-plugin-okta-integration-issue/6624/5 "2020-06-29T12:16:38Z")
Hi Satwant, Thank you. Actually I was able to solve the issue by adding the authorization\_endpoint and the token\_endpoint in the Kong Plugin configuration. I think that this is due to the fact that there is a Http Proxy. I had also to set the http\_proxy and https\_proxy variables in the Kong Plugin configuration Now it works. Thank you Best Regards Jon ---
**Author:** ![subramanil](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@subramanil](https://discuss.konghq.com/u/subramanil)\ **Post date:** [December 2, 2025, 6:18pm UTC](https://discuss.konghq.com/t/openid-connect-plugin-okta-integration-issue/6624/6 "2025-12-02T18:18:31Z")
Yes it works by adding authorization\_endpoint in kong openid plugin but, by default it should auto discover with the help of keycloak issuer address http://:/realms/\ In my case I mentioned it as localhost but, since communication between keycloak and kong was through container network, we have to define keycloak host name or (host.docker.internal: since my underlying machine was MAC.