Connect Okta as your identity provider

autociso connects to Okta over OpenID Connect. Use this guide for Okta itself; for any other OIDC provider the steps are the same and the provider type is Generic OIDC.

Requires the Growth or Scale plan, and the Owner role in autociso.

Before you start

You need an Okta administrator account. Note your Okta domain — the https://your-company.okta.com (or .oktapreview.com) address you use to administer it.

1. Create the application in Okta

1. In the Okta Admin Console go to Applications → Applications → Create App Integration.
2. Sign-in method: OIDC — OpenID Connect.
3. Application type: Web Application. Select Next.
4. Name it something recognisable, for example autociso.
5. Under Sign-in redirect URIs, enter exactly: https://auth.autociso.io/idps/callback
6. Remove the default sign-out redirect URI if you are not using one.
7. Under Assignments, choose who may use the app. Start with a pilot group rather than Everyone.
8. Select Save, then copy the Client ID and Client secret.

2. Find your issuer URL

In autociso the Issuer URL is your Okta org’s OIDC issuer, normally:

https://your-company.okta.com

If you use a custom authorization server, the issuer is instead https://your-company.okta.com/oauth2/<authServerId> — you can read the exact value from Security → API → Authorization Servers.

Do not append /.well-known/openid-configuration; autociso adds that itself.

3. Create the connection in autociso

1. Go to Organization → Sign-In Policy.
2. In the Single Sign-On section choose Okta.
3. Enter the Issuer URL, Client ID and Client secret.
4. Name the connection, for example Acme Okta.
5. Decide on Create accounts automatically on first sign-in. With it off, people need an invitation. With it on, anyone assigned the app in Okta gets an autociso account at the role you choose.
6. Select Save, then Test connection.

On success the status becomes Active.

4. Offer it to your team

1. In Allowed Providers, select the new connection and keep Email / Password selected.
2. Select Save.
3. Sign out and sign in via your organization’s sign-in link — the copyable link on the same page — to confirm the whole path works.

Once you and at least one other Owner have signed in through Okta, you can deselect Email / Password.

Troubleshooting

“User is not assigned to the client application” — add the person, or their group, to the app’s Assignments in Okta.

The test fails immediately — the Issuer URL is the usual cause. Open <issuer>/.well-known/openid-configuration in a browser; if it does not return JSON, the issuer is wrong.

Sign-in succeeds at Okta but autociso says the account is not allowed — either automatic account creation is off and the person has no invitation, or their email domain is outside the list in the Email domains section.