Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Okta (SAML / OIDC)

Configure SSO with Okta using SAML or OIDC protocols.

This guide explains how to configure SSO integration between Trust and Okta. After configuring Okta, return to the Trust SSO Configuration Guide to complete the setup.

Before you begin: Access Trust and copy the Identifier and Reply URL fields as described in Step 2 of the SSO Configuration Guide.

Prerequisites

  • Administrator access to Okta

  • Administrator access to Trust

  • Verified corporate email domain

Choose the Protocol

SAML Configuration

Create Application in Okta

  1. Access the Okta Admin Console

  2. Navigate to Applications → Applications

  3. Click Create App Integration

Okta - Create App Integration

  1. Select SAML 2.0 and click Next

Okta - Select SAML 2.0

  1. Configure the App name (e.g., "Trust - Caf") and click Next

Okta - App Name

Configure SAML Settings

In the SAML Settings section, configure:

Okta Field
Value

Single sign-on URL

Paste the Reply URL copied from Trust

Audience URI (SP Entity ID)

Paste the Identifier copied from Trust

Okta - SAML Settings

Configure Attribute Statements

Configure the attributes that will be sent to Trust:

Name
Value

email

user.email

name

user.displayName

given_name

user.firstName

family_name

user.lastName

Okta - Attribute Statements

Configure Group Attribute Statements (Optional)

If you want to use custom group mapping:

Name
Filter

groups

Matches regex: .* (or filter specific groups)

Okta - Group Attribute Statements

Click Next and then Finish.

Get Metadata URL

  1. In the created application, access the Sign On tab

  2. Copy the Metadata URL

Okta - Metadata URL

The URL will have the format:

OIDC Configuration

Create Application in Okta

  1. Access the Okta Admin Console

  2. Navigate to Applications → Applications

  3. Click Create App Integration

Okta - Create App Integration

  1. Select OIDC - OpenID Connect

  2. Select Web Application and click Next

Okta - Select OIDC

Configure OIDC Settings

Okta Field
Value

App integration name

(e.g., "Trust - Caf")

Grant type

✅ Authorization Code

Sign-in redirect URIs

Paste the Reply URL copied from Trust

Sign-out redirect URIs

Paste the Trust URL https://trust.caf.io/

Controlled access

Select who can access the application

Okta - OIDC Settings

Click Save.

Get Credentials

In the created application, copy the following information:

Okta Field
Use in Trust as

Client ID

Client ID

Client Secret

Client Secret

Okta - Client Credentials

Get Issuer URL

The Okta Issuer URL follows the format:

Or, if you use a custom Authorization Server:

  1. Navigate to Security

  2. Access API -> Authorization Servers

  3. Copy the Issuer URL

Okta - Authorization Server Issuer

If you plan to use Custom mode for permission group mapping, configure the step below. Otherwise, skip to the Assign Users or Groups step.

Configure Group Scopes (Optional)

To include groups in tokens:

  1. Access Security → API → Authorization Servers

  2. Select the Authorization Server being used (e.g., "default")

  3. Click the edit option

Okta - Add Groups Claim

  1. Access the Scopes tab

  2. Click Add Scope

Okta - Add Groups Claim

Fill in the scope following the information below. If you already have a groups scope created, use the same scope in Trust as well. Configure Properties and Scopes

Okta - Add Groups Claim

Assign Users or Groups

  1. In the created application, access the Assignments tab

  2. Click Assign

  3. Select Assign to People or Assign to Groups

Okta - Assignments

  1. Select the users or groups that will have access and click Assign

Okta - Assignments

  1. Click Save and Go Back

Okta - Assignments

Next Steps

After configuring Okta, return to the Trust SSO Configuration Guide to:

  1. Configure Properties and Scopes

  2. Configure Permission Groups

  3. Configure Attribute Statements

  4. Configure Domains

  5. Save and Test

Troubleshooting

Problem
Probable Cause
Solution

Redirect URI error

URI does not match

Verify that the reply URL is identical in both systems

Invalid token

Incorrect Client Secret

Regenerate the Client Secret in Okta and update it in Trust

Groups not received

Groups claim not configured

Configure the groups claim in the Authorization Server

User not found

User not assigned

Add the user in the application's Assignments

References

Last updated