Specify your integration settings

This portion of the guide takes you through the steps for configuring your specific SSO integration using the Okta Admin Console.

After you create your integration in the previous task, the Admin Console opens the main settings page for your new integration. In here, you can specify General Settings and Sign On options, as well as assign the integration to users in your org. Click Edit if you need to change any of the options, and Save when you have made your changes.

• OpenID Connect
• SAML 2.0

Specify OIDC settings

• On the General tab, in the Application area, you can rename your integration and select which grant type options are allowed.

  An OAuth 2.0 grant is the authorization granted to the client by the user. Each type of grant has a corresponding grant flow.

  The grant types permitted for OIN applications depend on the application type selected:

  • Web:
    • Authorization code — mandatory for Web application types
    • Optional. Refresh token
    • Optional. Implicit (Hybrid)
  • SPA:
    • Implicit (Hybrid) — choose either Allow ID Token with implicit grant type or Allow Access Token with implicit grant type

  Note: The Client acting on behalf of itself grant type is not permitted in OIN app integrations.

• If you only want to support direct SSO to your application (so the integration isn't launched from the Okta End-User Dashboard), then:

  1. Enter one or more Login redirect URI values where Okta sends the OAuth responses.
  2. Set the Login initiated by drop-down box to App Only.
  3. Leave all of the remaining entries at their default values.

• If you want to support launching your application from the Okta dashboard:

  1. Enter one or more Login redirect URI values where Okta sends the OAuth responses.
  2. (Optional). Enter the Logout redirect URIs where Okta redirects the browser after receiving the sign out request from the relying-party and terminating its end-user session. See Single Logout or the /logout API endpoint.
  3. Change the Login initiated by field to Either Okta or App to give your integration an Okta tile.

     Note: When you select this option, an App Embed Link section appears at the bottom of the page with the URL that can be used to sign in to the OIDC client from outside of Okta.

  4. Check the box for Display application icon to users.
  5. Select the Login flow option. For OIN application integrations, you must select Redirect to app to initiate login (OIDC Compliant).
  6. Enter or change the URI used to initiate the sign-in request.
  7. Click Save to commit your changes.

• If required, you can generate a new client secret. In the Client Credentials section, click Edit, then Generate New Client Secret.

• You can use the .well-known/openid-configuration API endpoint to configure Okta interactions programmatically. When a web integration has the implicit value set for the grant_types_supported property, then admins can publish integrations with the Login initiated by feature.

  For more information, see the OpenID Connect API reference.

Next: Test your integration