@ConditionalOnMissingBean(name = "oktaAuthenticationHandler")
        @Bean
        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)
        public AuthenticationHandler oktaAuthenticationHandler(
            @Qualifier("oktaPrincipalFactory") final PrincipalFactory oktaPrincipalFactory,
            @Qualifier(ServicesManager.BEAN_NAME) final ServicesManager servicesManager,
            @Qualifier("oktaAuthenticationClient") final AuthenticationClient oktaAuthenticationClient,
            final ConfigurableApplicationContext applicationContext,
            final CasConfigurationProperties casProperties) {
            return BeanSupplier.of(AuthenticationHandler.class)
                .when(CONDITION.given(applicationContext.getEnvironment()))
                .supply(() -> {
                    val okta = casProperties.getAuthn().getOkta();
                    val handler = new OktaAuthenticationHandler(okta.getName(), servicesManager,
                        oktaPrincipalFactory, okta, oktaAuthenticationClient);
                    handler.setState(okta.getState());
                    handler.setPrincipalNameTransformer(PrincipalNameTransformerUtils.newPrincipalNameTransformer(okta.getPrincipalTransformation()));
                    handler.setPasswordEncoder(PasswordEncoderUtils.newPasswordEncoder(okta.getPasswordEncoder(), applicationContext));
                    handler.setCredentialSelectionPredicate(CoreAuthenticationUtils.newCredentialSelectionPredicate(okta.getCredentialCriteria()));
                    return handler;
                })
                .otherwiseProxy()
                .get();
        }
This is {@link OktaAuthenticationConfiguration}.

@author Misagh Moayyed
@since 6.2.0
support/cas-server-support-okta-authentication/src/main/java/org/apereo/cas/config/OktaAuthenticationConfiguration.java