Skip to main content

Single Sign On with Okta

This tutorial explains how to set up single sign on with Okta, and authorize users based on Okta group membership information

Single Sign On with Okta​

  1. Make sure your OneDev instance can be accessed publicly, and configure the public server url in Administration / System Setting

    Configure Server Url

  2. Login to Okta to manage the applications

    Okta Your Org

  3. Add OneDev as a web application to get the client id and secret

    Okta Client Credentials

    create-app-options.png

    client-id-and-secret.png

caution

For versions before 7.8, use https://onedev.example.com/sso/callback/Okta instead of https://onedev.example.com/~sso/callback/Okta for Sign-in redirect URI

  1. Switch to api/authorization servers to get the default issuer URL

    Okta Issuer Uri

  2. At OneDev side, switch to page Administration / Authentication Source / Single Sign On, add a provider of type OpenID , with information from previous steps

    Add Okta Sso

caution

For versions before 7.9, you will see issuer url instead of configuration discovery url. In that case, fill with default issuer url obtained in above step directly.

  1. Now sign out and a button Login with Okta will appear at bottom of the login page. Anyone in your Okta organization assigned to OneDev application will be able to login via this button

    Okta Login Button

Authorize Users Based On Okta Group Membership Information​

  1. At OneDev side, edit Okta single sign on provider, and specify groups claim as groups

    Okta Sso Groups Claim

  2. At Okta side, switch to page api / authorization servers, select default authorization server to add groups claim like below

    Okta Add Groups Claim

  3. At OneDev side, switch to page Administration / Group Management, add necessary Okta groups (same name) and assign appropriate permissions

  4. Now users signed in via Okta will be added to corresponding groups at OneDev side to get appropriate permissions

Access OneDev from Okta Side​

To access OneDev from Okta side, edit the application to enable implicit grant type, tick the option display application icons to users, and configure initiate login url as below:

login-from-okta.png

Then for all users added to the application, they will be able to access OneDev directly from their Okta dashboards:

okta-my-apps.png