Org Authorization Server
Each Okta tenant comes with the so-called Org Authorization Server. It is not visible in the admin panel, but always accessible through the endpoints:
The Org Authorization Servers are not customizable, but provide a wide range of claims and scopes that are suitable for most applications. For example, the Org Authorization Server supports group scopes and claims, so applications that require role or group assignment information do not require a custom authorization server.
In the Okta OIDC app, the ID token can be configured to show only groups that are relevant for the app. In the following example all Okta groups starting with "OIDCApp_Role_" will be presented in the groups claim of the ID token.
Relevant Okta documentation:
https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server
Custom Authorization Servers
Tenants with the API Access Management license SKU will see the option “Authorization Servers” in the Okta admin panel under Security → API. By default, there is always a default custom authorization server defined.
Figur 1 - Default Custom Authorization Server - NOT the Org Authorization Server
The Default Custom Authorization Server can be used as a reference for other authorization servers or for testing development applications. It is already preconfigured with the standard scopes and claims.
Any added custom authorization server can be fully configured. It is not necessary to have an individual authorization server for each app, but it can make sense to separate different configurations or use cases into separate authorization endpoints.
The discovery endpoints for the Default Custom Authorization Server are:
For any additional Custom Authorization Server:
Since the Default Custom Authorization Server is part of the API Access Management license, all users assigned to an application that is using this authorization server will count towards the API Access Management licenses. If you require API Access Management only for a subset of your users, make sure that all standard OIDC apps are using the Org Authorization Server. All your custom authorization servers (even the default one) should be limited to the exact apps that they are required for. This mainly to increase security, but also to avoid additional license costs since the API license is calculated by the amount of users with potential access to an authorization server.
