FluxGate with Okta

Before you start

• FluxGate Enterprise. The license must include Single sign-on and SCIM provisioning. Check it under Settings, License.
• FluxGate runs at a public HTTPS address that Okta can reach, and public_base_url in config.toml is set to it.
• The backend has FLUXGATE_ENCRYPTION_KEY set, so FluxGate can store the Okta client secret. See Single sign-on.
• An Okta administrator who knows the Okta Admin Console, and a FluxGate admin System admin. They work together in the next pages.

What you get

Okta and FluxGate share two jobs:

Job	Standard	What it does
Sign-in	OpenID Connect	People click Sign in with Okta. Okta checks the password and any second factor. FluxGate never sees a password.
Provisioning	SCIM 2.0	Okta creates, updates and deactivates FluxGate accounts, and sends group membership.

Okta groups then decide roles, teams and admin access in FluxGate through group mappings. When a person joins, moves or leaves in Okta, FluxGate follows within seconds:

• Joiner. Add the person to an Okta group. FluxGate creates the account with its role and team.
• Profile change. Change the name or email in Okta. FluxGate updates the account.
• Mover. Move the person to another group. The role in FluxGate changes with it.
• Leaver. Deactivate the person in Okta. FluxGate disables the account and ends its open sessions. The history stays.
• Rehire. Activate the person again. The same FluxGate account comes back.

How the pieces fit

In Okta you create two apps, both assigned to the same groups:

• A sign-in app of type OpenID Connect, web application. It holds the redirect URI from FluxGate and gives FluxGate a client ID and a client secret.
• A provisioning app of type secure web authentication with SCIM provisioning. It calls the FluxGate SCIM endpoint with a bearer token from FluxGate. People never sign in through it, so its icon is hidden.

Okta needs two apps because an app made with the Okta Integration Wizard, which combines both, does not show its OpenID Connect client secret in the Admin Console.

In FluxGate you create one SSO provider for Okta. It holds the sign-in settings, the SCIM token, the link pair that joins a provisioned person to their first sign-in, and the group mappings.

The pages in this chapter

The examples use a fictional company, Brightwater Logistics, with the team Routing and the flag smart-dispatch.

1. Set up sign-in: the Okta sign-in app and the FluxGate provider.
2. Set up provisioning: the SCIM token, the link pair and the Okta provisioning app.
3. Groups, roles and teams: Okta groups, Push Groups and group mappings.
4. People sign in: three people with three roles.
5. Lifecycle: joiner, profile change, mover, leaver and rehire.
6. Troubleshooting: where to look when something fails.

Next

Connect Okta sign-in to FluxGate: Set up sign-in.