Okta with OpenID SSO

Okta is an Identity Provider (IdP) that manages user access across multiple applications from a single platform. With OpenID Connect SSO configured between Okta and Document360, your users and readers can sign in to Document360 using their existing Okta credentials.

What you can do with Okta as your IdP

Before you begin

• You have an active Okta account with administrator access. If you need to create one, sign up at developer.okta.com/signup.
• You have Owner or Admin access in your Document360 project.
• Open Document360 and Okta in two separate browser tabs. You will need to switch between them multiple times during setup.

Step 1: Create an OpenID Connect application in Okta

1. Log in to your Okta account and click Admin in the top right corner to switch to the admin console.
2. In the left navigation, expand Applications and click Applications.
3. Click Create App Integration.
4. Select OIDC - OpenID Connect as the sign-in method.
5. Choose Web Application as the application type and click Next.
6. On the New Web App Integration page, enter a name for your application in the App integration name field.

Step 2: Get the SP parameters from Document360

1. Open Document360 in a separate tab.
2. Navigate to Settings () > Users & permissions > SSO Configuration.
3. Click Create SSO.

4. Select Okta as your identity provider to navigate to the Configure the Service Provider (SP) page automatically.

5. On the Configure the Service Provider (SP) page, select the OpenID radio button.
6. A set of parameters will be displayed.

Step 3: Enter the Document360 parameters in Okta

1. Switch to the Okta tab on the New Web App Integration page.
2. Enter the Document360 parameters using the mapping below.

3. Scroll down to Assignments and select the desired Controlled access option.

4. Click Save. You will be redirected to the application's General page.

Step 4: Configure the Identity Provider in Document360

1. Return to Document360 on the Configure the Service Provider (SP) page and click Next to navigate to the Configure the Identity Provider (IdP) page.

2. Enter the corresponding values from your Okta application using the mapping below.

3. In the Scope (optional) field, type a scope value and click + to add it as a chip. This defines what user information or permissions Document360 requests from Okta. You can add up to 3 scopes.
4. Ensure the Client ID and Client Secret match the values generated in Okta.

5. Click Next to proceed to the SCIM provisioning page.

Step 5: Configure SCIM provisioning

SCIM provisioning automates user and reader lifecycle management between Okta and Document360. When using OpenID Connect, SCIM requires a separate OAuth Bearer Token app in the Okta catalog. It cannot be enabled within the same OIDC application.

If you do not need SCIM provisioning, skip to Step 6: Configure SSO name and login options.

Enable SCIM in Document360

1. Turn on the Enable SCIM provisioning toggle.
2. A confirmation dialog appears. Review the terms and click Agree.
3. The parameters required to complete the SCIM configuration in Okta will then be displayed.

Add the SCIM OAuth Bearer Token app in Okta

1. In Okta, expand Applications in the left navigation and click Applications.
2. Click Browse App Catalog and search for SCIM 2.0 (OAuth Bearer Token), then select See all results.

3. From the search results, select (OAuth Bearer Token) Governance with SCIM 2.0 and click Add Integration.

4. In the General Settings page, you can change the Application label if needed and click Next.

5. Click Done on the Sign-On options page.

Configure the SCIM API connection in Okta

1. In the SCIM app, navigate to the Provisioning tab and select Configure API Integration.
2. Select the Enable API Integration checkbox. A set of fields will be displayed.
3. Enter the Document360 parameters using the mapping below.

4. Once done, navigate back to Document360 to complete the configuration.

Assign default role and groups in Document360

1. Turn on the Enable group sync toggle if needed.
2. In the Default role field, the role is set to Contributor by default. You can change this from the dropdown if needed.
3. In the User groups and Reader groups fields, select the groups you want to add. Multiple groups can be added, and they will inherit the default role you selected earlier.
4. Click Next to navigate to the More settings page.

Step 6: Configure SSO name and login options

1. In the SSO name field, enter a name for the SSO configuration.
2. In Customize login button, enter the text for the login button displayed to users.
3. Auto assign reader group — this option is only available for existing SSO configurations. For newly created SSO configurations, this toggle will not be displayed as SCIM automatically provisions users and groups. Learn more about Auto assign reader group.
4. Enable Sign out idle SSO user if needed, and toggle based on your requirements.
5. Choose whether to invite existing user and reader accounts to SSO.

6. Click Create to complete the OpenID SSO configuration.

Step 7: Complete SCIM integration in Okta

1. Navigate back to the Okta SCIM app.
2. Click Test API Credentials. A success message will appear confirming the SCIM app is integrated successfully.

3. Click Save.
4. Go to the Provisioning tab, select To App, and click Edit on the Provisioning to App section.
5. Select only the following supported actions:
   • Create Users
   • Update User Attributes
   • Deactivate Users

6. Click Save.

SCIM provisioning with Okta OpenID Connect is now configured successfully.

The SSO configuration based on the OpenID protocol has been configured using Okta successfully.

Best practices

• Use a separate SCIM app for provisioning. When using OpenID Connect with Okta, SCIM requires its own OAuth Bearer Token app from the Okta catalog. Do not attempt to enable SCIM within the OIDC app.
• Select the correct SCIM app. Search for (OAuth Bearer Token) Governance with SCIM 2.0 specifically. Do not select the Test app version.
• Complete the Document360 SSO configuration before testing SCIM. Clicking Test Connector Configuration before saving the Document360 configuration will fail. Always save the Document360 configuration first, then return to Okta to test.
• Select only the three supported provisioning actions. Enabling unsupported actions may cause provisioning errors. Limit selection to Create Users, Update User Attributes, and Deactivate Users.

FAQ