OKTA AEM integration in AMS

[Mahesh_Gunaje]

Hello Team,

Anyone has implemented OKTA integration with AEM running on AMS? I am fine with this configuration steps on Author: https://experienceleague.adobe.com/en/docs/experience-manager-learn/foundation/authentication/okta-s...

But, wanted to know about publish env. Sample scenario:

End user has created account in Okta. Then, the user logs in to my AEM live site(consider AMS has multiple publish env.) How to maintain the server session in sync with all publish env?  Note: This user is not an author. Will not get access to author env.

cc @arunpatidar  @aanchal-sikka  @VeenaVikraman  @SureshDhulipudi  @lukasz-m 

Thanks in advance.

[arunpatidar]

Hi @Mahesh_Gunaje 

You need to enable Encapsulated Token

 https://experienceleague.adobe.com/en/docs/experience-manager-65/content/security/encapsulated-token 

[HrishikeshKagne · Accepted solution]

Hi @Mahesh_Gunaje ,

In AMS with multiple publish nodes, OKTA login works per node, but sessions are not auto-shared.
Put a load balancer/dispatcher with sticky sessions so each user stays on the same publish node.

Or use a shared session store/SSO token (e.g., OKTA JWT or SAML token validated on every request) instead of relying on AEM’s local session.

Avoid creating AEM users for site visitors-handle auth at the edge (dispatcher/CDN) or via OAuth bearer tokens.

Use sticky sessions or token-based validation, not AEM user sync, to keep sessions consistent across publish nodes.
Refer:

https://aem4beginner.blogspot.com/enabling-encapsulation-token-support-in

https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-21491

https://experienceleague.adobe.com/en/docs/experience-manager-65/content/security/encapsulated-token

[Mahesh_Gunaje]

Hi @HrishikeshKagne  @Saravanan_Dharmaraj  @SreenivasBr  @arunpatidar 

Sorry for late reply. I have referred this article: https://www.linkedin.com/pulse/how-configure-saml-local-aem-author-using-okta-aliaksei-baranouski/

Able to achieve the SSO configuration in AEM author side. As of now, I am not looking for publish env side.

Thanks all for your replies.

[Saravanan_Dharmaraj]

@Mahesh_Gunaje  Check this one on encapsulated token like other suggested. 

https://experienceleague.adobe.com/en/docs/experience-manager-65/content/security/encapsulated-token 

[SreenivasBr]

Check this one if it helps - https://medium.com/@lars.auffarth/building-an-aem-custom-authentication-handler-for-okta-openid-conn...