# Connect Okta as your identity provider
URL: https://docs.autociso.io/product/sso/okta/
Description: Create an OIDC application in Okta and connect it to AutoCISO so your team signs in with their Okta accounts.

AutoCISO connects to Okta over OpenID Connect. Use this guide for Okta itself;
for any other OIDC provider the steps are the same and the provider type is
**Generic OIDC**. If your Okta app uses SAML instead, follow
[Connect a SAML 2.0 identity provider](https://docs.autociso.io/product/sso/saml/).

Requires [The Growth plan or higher](https://docs.autociso.io/getting-started/plans-and-features/) and the [**Owner** role](https://docs.autociso.io/getting-started/roles-and-permissions/) in AutoCISO. The sign-in settings used here are explained in [Single Sign-On](https://docs.autociso.io/product/sso/overview/).

## Before you start

You need an Okta administrator account. Note your Okta domain — the
`https://your-company.okta.com` (or `.oktapreview.com`) address you use to
administer it.

## 1. Create the application in Okta

1. In the Okta Admin Console go to **Applications → Applications → Create App
   Integration**.
2. Sign-in method: **OIDC — OpenID Connect**.
3. Application type: **Web Application**. Select **Next**.
4. Name it something recognisable, for example `AutoCISO`.
5. Under **Sign-in redirect URIs**, enter exactly:
   `https://auth.autociso.io/ui/login/login/externalidp/callback`
6. Remove the default sign-out redirect URI if you are not using one.
7. Under **Assignments**, choose who may use the app. Start with a pilot group
   rather than Everyone.
8. Select **Save**, then copy the **Client ID** and **Client secret**.

## 2. Find your issuer URL

In AutoCISO the **Issuer URL** is your Okta org's OIDC issuer, normally:

```
https://your-company.okta.com
```

If you use a custom authorization server, the issuer is instead
`https://your-company.okta.com/oauth2/<authServerId>` — you can read the exact
value from **Security → API → Authorization Servers**.

Do not append `/.well-known/openid-configuration`; AutoCISO adds that itself.

## 3. Create the connection in AutoCISO

1. Go to **user menu → [Organization Settings](https://docs.autociso.io/console/settings/organization/) → Sign-In Policy**.
2. In the **Single Sign-On** section choose **Okta**.
3. Enter the **Issuer URL**, **Client ID** and **Client secret**.
4. Name the connection, for example `Acme Okta`.
5. Decide on **Create accounts automatically on first sign-in**. With it off,
   people need an invitation. With it on, anyone assigned the app in Okta gets
   an AutoCISO account at the role you choose.
6. Select **Save**, then **Test connection**.

On success the status becomes **Active**.

## 4. Offer it to your team

1. In **Allowed Providers**, select the new connection and keep
   **Email / Password** selected.
2. Select **Save**.
3. Sign out and sign in via your organization's sign-in link — the copyable
   link on the same page — to confirm the whole path works.

Once you and at least one other Owner have signed in through Okta, you can
deselect **Email / Password**. If you lock yourself out, see [Single Sign-On](https://docs.autociso.io/product/sso/overview/#if-you-lock-yourself-out).

## Troubleshooting

**"User is not assigned to the client application"** — add the person, or their
group, to the app's Assignments in Okta.

**The test fails immediately** — the Issuer URL is the usual cause. Open
`<issuer>/.well-known/openid-configuration` in a browser; if it does not return
JSON, the issuer is wrong.

**Sign-in succeeds at Okta but AutoCISO says the account is not allowed** —
either automatic account creation is off and the person has no invitation, or
their email domain is outside the list in the [Email domains](https://docs.autociso.io/product/sso/overview/#3-email-domains) section.