Okta with OpenID SSO

Connect Okta to Document360 with OpenID Connect (OIDC) so your users and readers sign in to Document360 with their existing Okta credentials. You create an OIDC web application in Okta, exchange the connection values with Document360, and can optionally add SCIM provisioning so Okta creates, updates, and deactivates people in Document360 for you. When you finish, your users sign in to the knowledge base portal and your readers sign in to the knowledge base site through Okta.

When to use Okta with OpenID Connect

Use this setup when:

• Your organization manages identities in Okta and prefers the OAuth 2.0 based OpenID Connect protocol over SAML.
• You want users and readers to sign in with one set of Okta credentials instead of separate Document360 passwords.
• You want Okta to provision and deactivate users and readers in Document360 through SCIM.

With Okta as your OpenID Connect identity provider (IdP), you can use the following:

Before you begin

• You have the Owner or Admin project role in Document360. Only these roles can configure SSO.
• You have an active Okta account with administrator access. If you need one, sign up at developer.okta.com/signup.
• Open Document360 and Okta in two separate browser tabs. You switch between them several times during setup.

How to set up OpenID Connect SSO with Okta

Step 1: Create an OpenID Connect application in Okta

1. Log in to your Okta account and click Admin in the top-right corner to open the admin console.
2. In the left navigation, expand Applications and Resources and click Applications.
3. Click Create App Integration.
4. Select OIDC - OpenID Connect as the sign-in method.
5. Select Web Application as the application type and click Next.
6. On the New Web App Integration page, enter a name in the App integration name field.

The New Web App Integration page stays open. Leave it open while you get the values from Document360.

Step 2: Get the service provider parameters from Document360

1. In the Document360 tab, go to Settings () > Users & Permissions > Enterprise SSO.
2. Click Create SSO, and then select OpenID Connect (Modern SSO using OpenID Connect (OIDC)).

3. On the Choose IdP step, select Okta as your identity provider.

The Configure SP step opens and shows the parameters you need in Okta.

Step 3: Enter the Document360 parameters in Okta

1. Switch to the Okta tab on the New Web App Integration page.
2. Copy each Document360 value into the matching Okta field.

3. Scroll down to Assignments and select the Controlled access option that includes the people who should sign in to Document360 with Okta.

4. Click Save.

Okta opens the application's General page, which shows the Client ID and Client Secret you need in the next step.

Step 4: Configure the identity provider in Document360

1. Return to the Document360 tab and click Next on the Configure SP step.

The Configure IdP step opens.

2. Copy each value from your Okta application into the matching Document360 field.

3. (Optional) In the Scope field, type a scope value and click + to add it as a chip. Scopes define what user information Document360 requests from Okta. You can add up to 3 scopes.
4. Check that the Client ID and Client Secret in Document360 match the values in Okta.
5. Click Next.

The SCIM provisioning step opens.

Step 5: Configure SCIM provisioning (optional)

If you don't need SCIM provisioning, leave Enable SCIM provisioning turned off, click Next, and go to Step 6.

Enable SCIM in Document360

1. Turn on the Enable SCIM provisioning toggle.
2. In the confirmation dialog, review the terms and click Agree.

Document360 shows the SCIM parameters you need in Okta. Copy the SCIM Base URL and Primary secret token and keep them somewhere secure until you finish the Okta steps.

Add the SCIM OAuth Bearer Token app in Okta

1. In Okta, expand Applications in the left navigation and click Applications.
2. Click Browse App Catalog, search for SCIM 2.0 (OAuth Bearer Token), and select See all results.

3. Select (OAuth Bearer Token) Governance with SCIM 2.0 and click Add Integration. Don't select the Test app version.

4. On the General Settings page, change the Application label if needed and click Next.

5. On the Sign-On options page, click Done. This app is only for SCIM provisioning, so it needs no sign-on settings.

Connect the SCIM app to Document360

1. In the SCIM app, open the Provisioning tab and select Configure API Integration.
2. Select the Enable API Integration checkbox.
3. Copy each Document360 value into the matching Okta field.

4. Return to the Document360 tab.

Set the default role and groups in Document360

1. Turn on the Enable group sync toggle if you want to sync groups from Okta.
2. In the Default role field, keep Contributor (the default) or select another role. The default role applies to users only.
3. In the User groups and Reader groups fields, select one or more groups. Users in the selected user groups get the default role. Readers in the selected reader groups always get read-only access.
4. Click Next.

Step 6: Configure more settings and create the configuration

1. In the SSO name field, enter a name for the SSO configuration.
2. In the Login button text field, enter the text for the sign-in button. If you leave the default, the button reads Login with SSO.
3. (Optional) Turn on Idle session SSO timeout and set the Timeout duration (HH:MM) after which Document360 signs out an idle SSO user.
4. (Optional) To move existing accounts to SSO now, turn on Convert existing team and reader accounts to SSO. Then, under Send invite to, select All users or Selected users.

5. Click Create.

Document360 creates the OpenID Connect SSO configuration and lists it on the Enterprise SSO page.

Step 7: Complete the SCIM integration in Okta (only if you enabled SCIM)

Skip this step if you left SCIM provisioning turned off in Step 5.

1. Return to the SCIM app in Okta.
2. Click Test API Credentials.

Okta shows a success message confirming that the SCIM app connects to Document360.

3. Click Save.
4. On the Provisioning tab, select To App and click Edit in the Provisioning to App section.
5. Select only these actions:
   • Create Users
   • Update User Attributes
   • Deactivate Users

6. Click Save.

Okta now provisions the assigned users and readers to Document360. To manage them after setup, see Managing Users and Readers with SCIM in Okta.

Step 8: Test the sign-in

1. Open the Document360 sign-in page in a private browser window.
2. Enter your email or subdomain and click Login with SSO (or the custom button text you set in Step 6).
3. Sign in with an Okta account that is assigned to the application.

Okta redirects you back to Document360 and you are signed in. If sign-in fails, see OpenID SSO issues.

Limits and limitations

Best practices

• Select the correct SCIM app. Search for (OAuth Bearer Token) Governance with SCIM 2.0, not the Test app version.
• Create the Document360 configuration before you test SCIM. Testing the API credentials in Okta fails until you click Create in Document360.
• Select only the three supported provisioning actions. Other actions can cause provisioning errors.
• Test with one account first. Assign a single test account in Okta and complete Step 8 before you convert existing accounts or assign everyone.
• Keep the default login page until SSO works. Disable it only after you confirm sign-in. See Deactivating Document360 login page.

Related articles

• Sign out idle SSO user
• Mapping an existing SSO configuration to other projects
• Log in using SSO - Knowledge base portal

FAQ