---
title: "Okta with OpenID SSO"
slug: "okta-with-openid-sso"
description: "Set up Single Sign-On (SSO) between Document360 and Okta using OpenID. Follow our guide for seamless integration and enhanced security."
updated: 2026-10-12T08:19:48Z
published: 2026-10-12T08:19:48Z
canonical: "docs.document360.com/okta-with-openid-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.document360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta with OpenID SSO

Connect Okta to Document360 with OpenID Connect (OIDC) so your users and readers sign in to Document360 with their existing Okta credentials. You create an OIDC web application in Okta, exchange the connection values with Document360, and can optionally add SCIM provisioning so Okta creates, updates, and deactivates people in Document360 for you. When you finish, your users sign in to the knowledge base portal and your readers sign in to the knowledge base site through Okta.

---

## When to use Okta with OpenID Connect

Use this setup when:

- Your organization manages identities in Okta and prefers the OAuth 2.0 based OpenID Connect protocol over SAML.
- You want users and readers to sign in with one set of Okta credentials instead of separate Document360 passwords.
- You want Okta to provision and deactivate users and readers in Document360 through SCIM.

With Okta as your OpenID Connect identity provider (IdP), you can use the following:

| Capability | Supported |
| --- | --- |
| User (portal) authentication | Yes |
| Reader (knowledge base site) authentication | Yes |
| SCIM user provisioning | Yes |
| SCIM reader provisioning | Yes |
| SCIM group sync | Yes |
| SSO configuration inheritance (parent-child projects) | Yes |

               NOTE

              

With OpenID Connect, SCIM provisioning needs a **separate OAuth Bearer Token app** from the Okta app catalog. Unlike the SAML setup, you can't enable SCIM within the same OIDC application.

---

## Before you begin

- You have the **Owner** or **Admin** project role in Document360. Only these roles can configure SSO.
- You have an active Okta account with administrator access. If you need one, sign up at [developer.okta.com/signup](https://developer.okta.com/signup/).
- Open Document360 and Okta in two separate browser tabs. You switch between them several times during setup.

---

## How to set up OpenID Connect SSO with Okta

### Step 1: Create an OpenID Connect application in Okta

1. Log in to your Okta account and click **Admin** in the top-right corner to open the admin console.
2. In the left navigation, expand **Applications and Resources** and click **Applications**.
3. Click **Create App Integration**.
4. Select **OIDC - OpenID Connect** as the sign-in method.
5. Select **Web Application** as the application type and click **Next**.
6. On the **New Web App Integration** page, enter a name in the **App integration name** field.

![Okta admin console: Create App Integration with OIDC - OpenID Connect and Web Application selected.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/creating application(1).gif)

The **New Web App Integration** page stays open. Leave it open while you get the values from Document360.

### Step 2: Get the service provider parameters from Document360

1. In the Document360 tab, go to **Settings** () > **Users & Permissions** > **Enterprise SSO**.
2. Click **Create SSO**, and then select **OpenID Connect** (Modern SSO using OpenID Connect (OIDC)).

![Enterprise SSO page in Document360 with the Create SSO button.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/SSO-configurations.png)

1. On the **Choose IdP** step, select **Okta** as your identity provider.

![Identity provider list in Document360 with Okta selected.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/oidc-okta.png)

The **Configure SP** step opens and shows the parameters you need in Okta.

![Configure SP step in Document360 showing the OpenID Connect redirect values to copy into Okta.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/OIDC-okta-SP(1).png)

### Step 3: Enter the Document360 parameters in Okta

1. Switch to the Okta tab on the **New Web App Integration** page.
2. Copy each Document360 value into the matching Okta field.

| Document360 | Okta |
| --- | --- |
| Sign-in redirect URL | Sign in redirect URI |
| Signed out callback path | Sign out redirect URI |

![Okta New Web App Integration page with the Sign-in redirect URIs and Sign-out redirect URIs fields filled in.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/sign in(1).png)

1. Scroll down to **Assignments** and select the **Controlled access** option that includes the people who should sign in to Document360 with Okta.

![Okta Assignments section with the Controlled access options.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/assigned.png)

1. Click **Save**.

Okta opens the application's **General** page, which shows the **Client ID** and **Client Secret** you need in the next step.

### Step 4: Configure the identity provider in Document360

1. Return to the Document360 tab and click **Next** on the **Configure SP** step.

The **Configure IdP** step opens.

![Configure IdP step in Document360 with the Client ID, Client Secret, Authority, and Scope fields.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/OIDC-okta-idp.png)

1. Copy each value from your Okta application into the matching Document360 field.

| Okta | Document360 |
| --- | --- |
| Client ID | Client ID |
| Client Secret | Client Secret |
| Issuer URI | Authority |

               NOTE

              

To find the Issuer URI in Okta, go to **Security** > **API**.

![Okta application General tab showing the Client ID and Client Secret under Client Credentials.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/client id.png)

1. (Optional) In the **Scope** field, type a scope value and click **+** to add it as a chip. Scopes define what user information Document360 requests from Okta. You can add up to 3 scopes.
2. Check that the **Client ID** and **Client Secret** in Document360 match the values in Okta.
3. Click **Next**.

The **SCIM provisioning** step opens.

### Step 5: Configure SCIM provisioning (optional)

If you don't need SCIM provisioning, leave **Enable SCIM provisioning** turned off, click **Next**, and go to Step 6.

#### Enable SCIM in Document360

1. Turn on the **Enable SCIM provisioning** toggle.
2. In the confirmation dialog, review the terms and click **Agree**.

Document360 shows the SCIM parameters you need in Okta. Copy the **SCIM Base URL** and **Primary secret token** and keep them somewhere secure until you finish the Okta steps.

![SCIM provisioning step in Document360 with Enable SCIM provisioning turned on and the SCIM Base URL and token fields.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/oidc-okta-scim.png)

#### Add the SCIM OAuth Bearer Token app in Okta

1. In Okta, expand **Applications** in the left navigation and click **Applications**.
2. Click **Browse App Catalog**, search for **SCIM 2.0 (OAuth Bearer Token)**, and select **See all results**.

![Okta Applications page with the Browse App Catalog button.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/browse.png)

1. Select **(OAuth Bearer Token) Governance with SCIM 2.0** and click **Add Integration**. Don't select the Test app version.

![Okta app catalog showing the (OAuth Bearer Token) Governance with SCIM 2.0 app and the Add Integration button.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/add integration.png)

1. On the **General Settings** page, change the **Application label** if needed and click **Next**.

![Okta General Settings page for the SCIM app with the Application label field.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/general(1).png)

1. On the **Sign-On options** page, click **Done**. This app is only for SCIM provisioning, so it needs no sign-on settings.

#### Connect the SCIM app to Document360

1. In the SCIM app, open the **Provisioning** tab and select **Configure API Integration**.
2. Select the **Enable API Integration** checkbox.
3. Copy each Document360 value into the matching Okta field.

| Document360 | Okta |
| --- | --- |
| SCIM Base URL | Base URL |
| Primary secret token | OAuth Bearer Token |

![Okta Configure API Integration form with the Base URL and OAuth Bearer Token fields.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/test api(2).png)

               NOTE

              

Don't test the API credentials yet. The test fails until you create the SSO configuration in Document360 in Step 6.

1. Return to the Document360 tab.

#### Set the default role and groups in Document360

1. Turn on the **Enable group sync** toggle if you want to sync groups from Okta.
2. In the **Default role** field, keep **Contributor** (the default) or select another role. The default role applies to users only.
3. In the **User groups** and **Reader groups** fields, select one or more groups. Users in the selected user groups get the default role. Readers in the selected reader groups always get read-only access.
4. Click **Next**.

### Step 6: Configure more settings and create the configuration

1. In the **SSO name** field, enter a name for the SSO configuration.
2. In the **Login button text** field, enter the text for the sign-in button. If you leave the default, the button reads **Login with SSO**.
3. (Optional) Turn on **Idle session SSO timeout** and set the **Timeout duration (HH:MM)** after which Document360 signs out an idle SSO user.
4. (Optional) To move existing accounts to SSO now, turn on **Convert existing team and reader accounts to SSO**. Then, under **Send invite to**, select **All users** or **Selected users**.

              WARNING

              

Converting an account switches that existing account to SSO. Document360 does not create a second account. Converted users and readers sign in through Okta and can no longer use their Document360 password. To convert accounts later instead, see [Convert user to SSO](https://docs.document360.com/docs/convert-user-to-sso) and [Convert reader to SSO](https://docs.document360.com/docs/convert-reader-to-sso).

![More settings step in Document360 with the SSO name, Login button text, idle timeout, and account conversion options.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/oidc-okta-more-settings.png)

1. Click **Create**.

Document360 creates the OpenID Connect SSO configuration and lists it on the **Enterprise SSO** page.

               NOTE

              

The **Auto assign reader group** toggle appears only when you edit an existing SSO configuration. It is hidden when you create a new one. Learn more in [Managing SSO readers and reader groups](https://docs.document360.com/docs/auto-assign-reader-group).

### Step 7: Complete the SCIM integration in Okta (only if you enabled SCIM)

Skip this step if you left SCIM provisioning turned off in Step 5.

1. Return to the SCIM app in Okta.
2. Click **Test API Credentials**.

Okta shows a success message confirming that the SCIM app connects to Document360.

![Okta Configure API Integration form with the Test API Credentials button.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/test api(2).png)

1. Click **Save**.
2. On the **Provisioning** tab, select **To App** and click **Edit** in the **Provisioning to App** section.
3. Select only these actions:
  - Create Users
  - Update User Attributes
  - Deactivate Users

![Okta Provisioning to App section with Create Users, Update User Attributes, and Deactivate Users selected.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/supported actions.png)

1. Click **Save**.

Okta now provisions the assigned users and readers to Document360. To manage them after setup, see [Managing Users and Readers with SCIM in Okta](https://docs.document360.com/docs/scim-with-okta).

### Step 8: Test the sign-in

1. Open the Document360 sign-in page in a private browser window.
2. Enter your email or subdomain and click **Login with SSO** (or the custom button text you set in Step 6).
3. Sign in with an Okta account that is assigned to the application.

Okta redirects you back to Document360 and you are signed in. If sign-in fails, see [OpenID SSO issues](https://docs.document360.com/docs/openid-sso-issues).

---

## Limits and limitations

| Limit | Detail |
| --- | --- |
| Scopes | You can add up to 3 scopes on the **Configure IdP** step. |
| SCIM app | SCIM needs a separate OAuth Bearer Token app in Okta. You can't enable it within the OIDC application. |
| Default role | Applies to users only. Readers always get read-only access. |
| People managed through SCIM | When SCIM is on, you can't change roles and permissions in Document360. You can only manage content access. |
| Auto assign reader group | Available only on existing SSO configurations. Hidden when you create a new one. |
| Last active configuration | If this is the only active SSO or JWT configuration and the default login page is disabled, Document360 blocks you from turning it off or deleting it. See [Remove a configured OpenID SSO](https://docs.document360.com/docs/removing-a-configured-openid-sso). |

---

## Best practices

- **Select the correct SCIM app.** Search for **(OAuth Bearer Token) Governance with SCIM 2.0**, not the Test app version.
- **Create the Document360 configuration before you test SCIM.** Testing the API credentials in Okta fails until you click **Create** in Document360.
- **Select only the three supported provisioning actions.** Other actions can cause provisioning errors.
- **Test with one account first.** Assign a single test account in Okta and complete Step 8 before you convert existing accounts or assign everyone.
- **Keep the default login page until SSO works.** Disable it only after you confirm sign-in. See [Deactivating Document360 login page](https://docs.document360.com/docs/disable-document360-login-page).

---

## Related articles

  
    
      

OpenID

    
    

Learn how OpenID Connect works in Document360 and compare supported identity providers.

    [OpenID overview →](https://docs.document360.com/docs/openid)
  
  
    
      

Managing Users and Readers with SCIM in Okta

    
    

Manage users, readers, and groups that Okta provisions to Document360.

    [Manage SCIM in Okta →](https://docs.document360.com/docs/scim-with-okta)
  
  
    
      

OpenID SSO issues

    
    

Fix common errors when users sign in with OpenID Connect SSO.

    [Troubleshoot OpenID SSO →](https://docs.document360.com/docs/openid-sso-issues)
  

- [Sign out idle SSO user](https://docs.document360.com/docs/team-account-idle-timeout)
- [Mapping an existing SSO configuration to other projects](https://docs.document360.com/docs/mapping-an-existing-sso-configuration-to-other-projects)
- [Log in using SSO - Knowledge base portal](https://docs.document360.com/docs/login-using-sso-knowledge-base-portal)

---

## FAQ

**Why do I need a separate app for SCIM when using OpenID Connect with Okta?**

The OIDC app integration in Okta handles authentication only and doesn't support SCIM provisioning. A separate OAuth Bearer Token app creates the SCIM connection between Okta and Document360. In the SAML setup, you can enable SCIM within the same Okta application.

**Where do I find the Issuer URI in Okta?**

In Okta, go to **Security** > **API**. Enter the Issuer URI in the **Authority** field on the **Configure IdP** step in Document360.

**What are scopes and do I need to add them?**

Scopes define what user information Document360 requests from Okta during sign-in. The **Scope** field is optional. You can add up to 3 scopes by typing a value and clicking **+**. If you're not sure whether you need scopes, check with your Okta administrator.

**Can I use OpenID Connect and SAML at the same time?**

No. SAML and OpenID Connect are mutually exclusive in a project. Either one can be active alongside a JWT configuration.