Skip to main content

​
Okta

This page covers the Okta side. Saving, testing and activating the connection are in Single Sign-On (OIDC).

​
Create the app integration

  1. In the Okta Admin Console, go to Applications → Applications and select Create App Integration.
  2. Choose OIDC - OpenID Connect and Web Application.
  3. Under Grant type, keep Authorization Code.
  4. Under Sign-in redirect URIs, enter the connection’s redirect URI: https://<console host>/oauth/sso/callback.
  5. Under Assignments, choose who may use the app, and save.
  6. On the app’s General tab, copy the Client ID and Client secret.

​
Issuer

Use your Okta domain exactly, including a custom domain if you sign in through one: the issuer must match the one Okta’s discovery document states.

​
Scopes and claims

The default scopes, openid email profile, are enough. Okta sends email, email_verified and name in the ID token, so the default claim mapping works as is. Okta sends no groups unless you configure a groups claim:
  • Org authorization server: on the app’s Sign On tab, under OpenID Connect ID Token, set the Groups claim type to Filter, the claim name to groups, and a filter for the groups to include.
  • Custom authorization server: under Security → API → Authorization Servers, open the server and, on Claims, add a claim named groups, included in the ID Token, with value type Groups and a filter.
If you name the claim something other than groups, set claims.groups on the connection to that name.

​
Example

Then run a test login and activate the connection; see Single Sign-On (OIDC).