OLLETOllet compares a person's verified identity with the attributes supplied from their Okta profile. Okta receives the outcome and decides whether the requested account action can continue.
This guide is for administrators. The integration runs through the Okta account management policy, which applies to account management actions rather than application sign-in. Identity verification providers cannot be used in identity-provider routing rules. See Okta account management policy.
Before you begin
You need an Okta Identity Engine organization, an administrator who can manage identity providers, authentication policies, and authenticators, and a group of test users.
Enable Identity verification with third-party identity verification vendors under Settings > Features if your organization lists it as Early Access. Contact Okta Support if the feature is unavailable. See Enable self-service features.
For the third-generation Sign-In Widget, use version 7.20 or later across all brands. This is an Okta prerequisite for the identity verification rule.
Test users should have Ollet installed and identity setup complete on a supported iPhone. Follow Getting started before relying on the app for account recovery.
1. Obtain credentials
Email info@ollet.id to request an Okta integration. Include your company name, technical contact, Okta organization URL, and whether you need sandbox credentials, production credentials, or both.
Ollet supplies a client ID and client secret for your environment. You will enter them in the next step. Contact Ollet for credential rotation or an additional organization.
Provide the end-user organization URL your users sign in at, such as https://acme.okta.com or a custom domain like https://login.acme.com. Okta returns from verification to the same host:
https://acme.okta.com/idp/identity-verification/callback2. Add the identity verification provider
- In the Admin Console, open Security > Identity Providers.
- Select Add identity provider, choose Ollet from the list of identity providers, and select Next.
- Enter the Client ID and Client secret you received from Ollet in step 1.
- Select Finish.
Keep the client secret in the provider configuration; do not put it in website code.
3. Map the user's identity attributes
Open Security > Identity Providers, find Ollet, and select Actions > Edit profile and mappings > Mappings. Select the relevant user type if prompted.
Mappings send attributes from Okta to Ollet. Configure and preview the following mappings, then select Save mappings and Apply updates.
| Ollet attribute | Okta value | Required |
|---|---|---|
First Name (given_name) | user.firstName, or the legal given-name attribute | Yes |
Last Name (family_name) | user.lastName, or the legal surname attribute | Yes |
Middle Name (middle_name) | Your middle-name attribute, if applicable | No |
Date of Birth (birthdate) | Your date-of-birth attribute in YYYY-MM-DD format | Yes |
Use names that correspond to the user's passport. Ollet combines a mapped middle name with the first name when comparing given names. Include all passport given names, either in the first-name value or through the middle-name mapping, without duplicating them. Preferred names that differ from the passport can cause a mismatch.
Ollet compares the date of birth with the passport alongside the names. Creating an attribute does not populate it; your organization must supply a value for every user who will verify with Ollet.
A missing required attribute causes Okta's initial request to fail. See Map profile attributes and Okta's supported claims.
4. Require verification in the account management policy
- Create a test group, such as Ollet verification pilot, and add your test users.
- Open Security > Authentication Policies > Okta account management.
- Select Add rule and name it Ollet identity verification.
- Under IF, set User's group membership includes to the test group. Review the other conditions for your intended users.
- For the initial pilot, leave The following custom expression is true blank. This applies the rule to all account management actions that meet its other conditions.
- Under THEN, set Access is to Allowed after successful, choose Identity verification, and select your Ollet instance as the Identity verification service.
- Save the rule and place it above the catch-all.
Okta uses the first matching rule. Keep existing first phishing-resistant authenticator and password-expiry rules at their required higher priorities. If a higher rule matches the action, Ollet will not be invoked.
For narrower rules, Okta documents accessRequest.operation == 'enroll' for enrollment and accessRequest.operation == 'recover' || accessRequest.operation == 'unlockAccount' for recovery and unlock. See the identity verification rule and recovery rule conditions.
5. Enable self-service recovery and unlock
Authenticator enrollment and Reset password in signed-in account settings already use Account Management Policy. Forgot password and Account unlock on the sign-in page require an additional setting.
- Open Security > Authenticators and edit Password.
- Find the password policy that applies to your test users and edit its applicable rule.
- Under Recovery authenticators > Access control, select Authentication policy in place of the legacy setting.
- Confirm that the self-service permissions allow password reset, account unlock, or both, according to your intended flows.
- Select Update rule. Repeat for other applicable password rules.
See Edit the account management policy.
Admin-initiated password reset email flows do not enforce Account Management Policy. Password-expiration flows require separate configuration. See Okta's recovery exceptions.
6. Test the user journeys
When a policy invokes Ollet, the user opens the verification on their iPhone, completes the face check, and approves sharing the requested details. Ollet returns the result to Okta, which continues or blocks the original action.
| Journey | Start here | Expected outcome |
|---|---|---|
| Authenticator enrollment | Sign in and add a security method in account settings. | Ollet runs before enrollment completes. |
| Signed-in password reset | Select Reset password in account settings. | Ollet runs before the password action completes. |
| Forgot password | Sign out and select Forgot password. | After step 5, Ollet runs before a new password can be set. |
| Account unlock | Use a locked test account and select Account unlock. | After step 5, Ollet runs before the account is unlocked. |
Also test a mismatched identity, cancellation, and an expired session. None should authorize the requested action. Confirm that users outside the pilot group continue to follow their intended policies before expanding the rollout.
Troubleshooting
| Symptom | What to check |
|---|---|
| Ollet is never offered | Confirm group membership and rule priority. For sign-in-page recovery, also check Password access control from step 5. |
| The request fails before verification opens | Check the client ID and client secret, the callback host, and required profile attributes. |
| Identity verification returns a mismatch | Compare the mapped names with the passport, including middle names. Confirm the birthdate is populated and uses YYYY-MM-DD. |
| The verification session expires | Restart the Okta action. The outer flow lasts about ten minutes, but the phone verification session is shorter; complete both promptly. |
| A reset email bypasses Ollet | Check whether an administrator initiated the reset. That flow does not enforce Account Management Policy. |
For help, contact info@ollet.id with your company name, Okta organization URL, the journey being tested, and the error shown. Include whether the failure occurred before Ollet opened, during verification, or after returning to Okta.