> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Set up your organization's OIDC connection with Okta.

# Okta

This page covers the Okta side. Saving, testing and activating the connection are in
[Single Sign-On (OIDC)](https://docs.qumo-deploy.com/guides/sso/overview.md).

## Create the app integration

1. In the Okta Admin Console, go to **Applications → Applications** and select
   **Create App Integration**.
2. Choose **OIDC - OpenID Connect** and **Web Application**.
3. Under **Grant type**, keep **Authorization Code**.
4. Under **Sign-in redirect URIs**, enter the connection's redirect URI:
   `https://<console host>/oauth/sso/callback`.
5. Under **Assignments**, choose who may use the app, and save.
6. On the app's **General** tab, copy the **Client ID** and **Client secret**.

## Issuer

| Authorization server | `issuer` |
| :- | :- |
| Org authorization server | `https://<your-org>.okta.com` |
| Custom authorization server (for example `default`) | `https://<your-org>.okta.com/oauth2/default` |

Use your Okta domain exactly, including a custom domain if you sign in through one: the
issuer must match the one Okta's discovery document states.

## Scopes and claims

The default scopes, `openid email profile`, are enough. Okta sends `email`,
`email_verified` and `name` in the ID token, so the default claim mapping works as is.

Okta sends no groups unless you configure a groups claim:

* **Org authorization server:** on the app's **Sign On** tab, under **OpenID Connect ID
  Token**, set the **Groups claim type** to **Filter**, the claim name to `groups`, and a
  filter for the groups to include.
* **Custom authorization server:** under **Security → API → Authorization Servers**, open the
  server and, on **Claims**, add a claim named `groups`, included in the **ID Token**, with
  value type **Groups** and a filter.

If you name the claim something other than `groups`, set `claims.groups` on the connection
to that name.

## Example

```json theme={null}
{
  "issuer": "https://acme.okta.com",
  "client_id": "0oa8f2k3l9XyZ1abc357",
  "client_secret": "<client secret>"
}
```

Then run a test login and activate the connection; see
[Single Sign-On (OIDC)](https://docs.qumo-deploy.com/guides/sso/overview.md#3-run-a-test-login).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.