Skip to content
FluxGate

Enterprise · FluxGate with Okta

Set up sign-in

Okta's sign-in app and FluxGate's Okta provider know each other: redirect URI, issuer, client ID and secret, and a passing connection test.

4:23 videoBuilds on:FluxGate with Okta

Before you start

  • The license page (Settings, License) shows the edition Enterprise and, under Entitlements, Single sign-on and SCIM provisioning.
  • The roles and teams you want to map exist. The built-in roles Approver and Requester are enough. The examples use the team Routing.
  • FluxGate is open at its public address, for example https://fluxgate.example.com. Sign in as admin System admin.
  • The Okta Admin Console is open in a second tab.

Values the two sides exchange

ValueFromToExample
Redirect URIFluxGateOkta sign-in apphttps://fluxgate.example.com/api/v1/auth/sso/okta/callback
IssuerOktaFluxGate providerhttps://<your-org>.okta.com
Client IDOktaFluxGate provider<client ID>
Client secretOktaFluxGate provider<client secret>

The redirect URI is <public_base_url>/api/v1/auth/sso/<slug>/callback. Okta matches it exactly. The Redirect URI field in FluxGate is built from the address in your browser, so open FluxGate at its public address before you copy it.

Start the provider in FluxGate

  1. Under Settings, click Single Sign-On (/settings/sso), then Add provider.
  2. In Add SSO provider, type Display name Okta. The login page shows it on the button Sign in with Okta.
  3. Type Slug okta. The slug is part of every URL of this provider.
  4. Redirect URI now shows the callback address. Click Copy.
  5. Keep the dialog open. Client ID is required, and it comes from Okta in the next steps.

Create the Okta sign-in app

  1. In the Okta Admin Console, open Applications and Resources, Applications, then Create App Integration.
  2. Choose the tab Classic experience, then OIDC - OpenID Connect and Web Application. Click Next.
  3. In New Web App Integration, replace the pre-filled App integration name ("My Web App") with FluxGate sign-in.
  4. Keep Grant type Authorization Code.
  5. In Sign-in redirect URIs, replace the sample URI with the redirect URI from FluxGate.
  6. Remove the sample entry under Sign-out redirect URIs. FluxGate does not use one.
  7. Under Assignments, choose Skip group assignment for now. You assign groups on Groups, roles and teams.
  8. Click Save. The app opens on General.
  9. Under Client Credentials, copy the client ID. Under CLIENT SECRETS, copy the secret.

Finish the provider in FluxGate

  1. Back in the Add SSO provider dialog, type Issuer URL: the address of your Okta organization, https://<your-org>.okta.com, with no path.
  2. Paste Client ID and Client secret.
  3. Leave Scopes at the defaults. Clear Groups claim (it is pre-filled with groups). FluxGate takes groups from Okta provisioning instead.
  4. Set Role sync mode to Off (do not sync roles). The default is Authoritative (IdP groups are the source of truth). You switch it to SCIM once Okta pushes groups.
  5. Switch Create accounts on first sign-in off. With provisioning, only people that Okta created in FluxGate may sign in.
  6. Leave Link to existing accounts by email off and Enabled off.
  7. Click Create provider. The toast "SSO provider created" appears, and the row okta shows Disabled.
  8. Click Edit provider on the row, then Test connection. The result reads Connection OK with the issuer and the authorization endpoint. Click Cancel.

Good to know

  • The issuer is Okta's org authorization server. A custom authorization server (https://<your-org>.okta.com/oauth2/<id>) is only needed for a groups claim at sign-in, which this setup does not use.
  • Test connection checks the saved issuer only. It does not check the redirect URI. The first real sign-in does.
  • Create accounts on first sign-in is on by default. Turn it off when Okta provisions accounts.
  • The SCIM (groups pushed by the IdP) option of Role sync mode stays disabled until the provider has a SCIM token.
  • Do not use the Okta Integration Wizard tab for this app. Its apps do not show the client secret in the Admin Console.

Troubleshooting

Okta reports a redirect URI error at sign-in

The URI in Sign-in redirect URIs must equal <public_base_url>/api/v1/auth/sso/okta/callback exactly. Copy it from FluxGate opened at its public address, and check that public_base_url is set.

Test connection fails

Check that Issuer URL is the Okta organization address with no trailing path, and that the FluxGate backend can reach Okta.

Next

Create the SCIM token, the link pair and the Okta provisioning app: Set up provisioning.