Setup Okta SSO

A Complete Guide

To set up Okta SSO, follow the instructions below.

Service Provider (SP)-Initiated Authentication (SSO) Flow: This authentication flow occurs when the user attempts to log in to the application from OpenPolicy.
SCIM Provisioning‍
- Push Users.
  ‍Users in Okta that are assigned to the OpenPolicy application in Okta are automatically added as members to your organization in OpenPolicy.‍
- Delete Users.
  Users in Okta that are unassigned from the OpenPolicy application in Okta are automatically deleted as members to in organization in OpenPolicy.‍
- Update Users.
  Updating user information(e.g. first name, last name) on Okta would automatically reflect in the OpenPolicy application.

In Okta, navigate to Applications → Browse App Catalog, search for and add OpenPolicy.
During the installation you will be required to add a "subdomain" varaible, request it from OpenPolicy support.
If you intend to use SCIM - make sure to go to "Provisioning" tab and check the boxes in this photo:

Also, when using SCIM go to Provisioning->Integration

Go to "API Token" field and fill it in. you should receive it from OpenPolicy support.

Go to the OpenPolicy App → Assignments tab
Click the “Assign” button
- Choose People if you wish to add specific people access to OpenPolicy
- Choose Group if you want to give access to OpenPolicy to anyone in a specific group.
Anyone that is assigned via Okta should be included in a list of emails sent to your OpenPolicy representative so that they could be configured to work.
1. If you use SCIM - you do not need to send us a list of emails, it will be done automatically.
  ‍
Go to Applications -> OpenPolicy and provide your OpenPolicy representative with the following:
1. Okta Domain
2. Client ID
3. Client Secret
4. Company email domain (for example if your users have an email like joe@example.com - send us example.com)

After being invited or created via SCIM - to OpenPolicy, go to https://app.openpolicy.co/
You will be prompted for your email, you must use your organizational email that was included in the list above or was assigned via SCIM.

That’s it, should any questions arise don’t hesitate to contact your OpenPolicy representative.

Contents