Ctrlk
Useful links
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Okta (SAML / OIDC)

Configure SSO with Okta using SAML or OIDC protocols.

This guide explains how to configure SSO integration between Organizations and Okta. After configuring Okta, return to the Organizations SSO Configuration Guide to complete the setup.

Before you begin: Open Authentication → SSO in Organizations and copy the Entity ID and ACS URL (SAML) or Redirect URI (OIDC) as described in Step 2 of the SSO Configuration Guide.

Prerequisites

  • Administrator access to Okta

  • Super Admin access to Organizations

Choose the Protocol

SAML Configuration

Create Application in Okta

  1. Access the Okta Admin Console

  2. Navigate to Applications → Applications

  3. Click Create App Integration

Okta - Create App Integration

  1. Select SAML 2.0 and click Next

Okta - Select SAML 2.0

  1. Configure the App name (e.g., "Certta") and click Next

Okta - App Name

Configure SAML Settings

In the SAML Settings section, configure:

Okta Field
Value

Single sign-on URL

Paste the ACS URL copied from Organizations

Audience URI (SP Entity ID)

Paste the Entity ID copied from Organizations

Okta - SAML Settings

Configure Attribute Statements

Configure the attributes that will be sent to Organizations:

Name
Value

email

user.email

name

user.displayName

given_name

user.firstName

family_name

user.lastName

Okta - Attribute Statements

Configure Group Attribute Statements (Optional)

If you use Group assignment rules based on IdP groups:

Name
Filter

groups

Matches regex: .* (or filter specific groups)

Okta - Group Attribute Statements

Click Next and then Finish.

Get Metadata URL

  1. In the created application, access the Sign On tab

  2. Copy the Metadata URL

Okta - Metadata URL

The URL will have the format:

OIDC Configuration

Create Application in Okta

  1. Access the Okta Admin Console

  2. Navigate to Applications → Applications

  3. Click Create App Integration

Okta - Create App Integration

  1. Select OIDC - OpenID Connect

  2. Select Web Application and click Next

Okta - Select OIDC

Configure OIDC Settings

Okta Field
Value

App integration name

(e.g., "Certta")

Grant type

✅ Authorization Code

Sign-in redirect URIs

Paste the Redirect URI copied from Organizations

Sign-out redirect URIs

Paste your organization URL (for example, https://{your-alias}.sso.caf.io)

Controlled access

Select who can access the application

Okta - OIDC Settings

Click Save.

Get Credentials

In the created application, copy the following information:

Okta Field
Use in Organizations as

Client ID

Client ID

Client Secret

Client Secret

Okta - Client Credentials

Get Issuer URL

The Okta Issuer URL follows the format:

Or, if you use a custom Authorization Server:

  1. Navigate to Security → API → Authorization Servers

  2. Copy the Issuer URL from the Authorization Server you use for this application

Okta - Authorization Server Issuer

Configure the step below when you use Group assignment rules based on IdP groups. Otherwise, skip to Assign Users or Groups.

Configure Group Scopes (Optional)

To include groups in OIDC tokens for Group assignment rules:

  1. Access Security → API → Authorization Servers

  2. Select the Authorization Server being used (for example, default)

  3. Open the Claims tab and add a groups claim mapped to user groups

  4. Open the Scopes tab and add a groups scope if your server requires explicit scopes

Okta - Add Groups Claim

  1. Click Add Scope if you need a dedicated groups scope

Okta - Add Groups Scope

  1. In Organizations, add groups to Authorization scopes on the SSO tab (for example, openid email profile groups) and map Groups on the Attribute mapping tab to groups

Okta - Groups Scope Details

Assign Users or Groups

  1. In the created application, access the Assignments tab

  2. Click Assign

  3. Select Assign to People or Assign to Groups

Okta - Assignments

  1. Select the users or groups that will have access and click Assign

Okta - Assignments

  1. Click Save and Go Back

Okta - Assignments

Next Steps

After configuring the identity provider, return to the Organizations SSO Configuration Guide to:

  1. Configure attribute mapping

  2. Configure group assignment rules

  3. Save and test

Troubleshooting

Problem
Probable Cause
Solution

Redirect URI error

URI does not match

Verify that the reply URL is identical in both systems

Invalid token

Incorrect Client Secret

Regenerate the Client Secret in Okta and update it in Organizations

Groups not received

Groups claim not configured

Configure the groups claim in the Authorization Server

User not found

User not assigned

Add the user in the application's Assignments

References

Last updated