Configure OIDC with Okta

This page explains how to integrate Okta as an OpenID Connect (OIDC) identity provider to authenticate your users on Reemo.

Note

Depending on your deployment mode, SSO can be enabled at the instance level (Private Cloud / On-Prem) or at the organization level (Public Cloud).

Screenshots and labels may vary slightly depending on your interface version.

Configure SSO in Reemo

Case 1: Instance level (Private Cloud / On-Prem)

From verified_user Admin Area > dashboard General > passkey SSO Connectors, configure SSO for the instance.

Access SSO Connectors in the instance Admin Area.

Case 2: Organization level (Public Cloud)

From domain Organization > dashboard General > passkey SSO Connectors, configure SSO for that organization.

Configure SSO in Organization > SSO Connectors.

Create the OIDC connector in Reemo

1. From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors and click New Connector > New OIDC Connector.

2. Enter the Friendly Name (e.g. Okta), then click Create to generate the connector’s callback URL. You will need it in Okta.

Copy the callback URL generated by the OIDC connector.

Create the application in Okta

1. In the Okta Admin Console > Applications > Create App Integration.

2. Choose OIDC - OpenID Connect, then Web Application.

3. Under Sign-in redirect URIs, paste the callback URL from the Reemo connector.

4. After creation, retrieve the Client ID and Client secret from the General tab.

5. The Issuer is your Okta authorization server, in the format:

   https://[okta_domain]/oauth2/default
   

Complete the OIDC connector in Reemo

Complete the connector with the Okta information:

• Issuer URL: https://[okta_domain]/oauth2/default. Reemo auto-discovers the endpoints from <issuer>/.well-known/openid-configuration.

• Client ID and Client Secret of the Okta application.

• Scopes: leave empty to use openid profile email by default.

Enter Issuer URL, Client ID and Client Secret, then enable the connector.

Enable the connector (check Enabled) then click Update (or Create) to save.

Declare users

Two approaches are available to grant SSO access to users.

Approach A: Explicit provisioning from the organization

From verified_user Admin Area > domain Organizations, select your organization, then go to inventory_2 Inventory > person Users and click New User > Provision SAML User to add users by entering their email.

Select Provision SAML User from the New User menu.

The same button provisions both SAML and OIDC users.

Approach B: Just-In-Time (JIT) Provisioning

From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors, click the connector then enable Just In Time Provisioning: accounts are created automatically on the first successful login.

Enable Just In Time Provisioning to create accounts on first login.

Manage rights dynamically from the directory

In Okta

Add a groups claim to the authorization server: Security > API > your Authorization Server > Claims > Add Claim. Name the claim groups (included in the ID Token) and filter the groups to send (e.g. Matches regex .*).

In Reemo

1. Open the OIDC connector form (Admin Area > General > SSO Connectors), Extra mapping section.

2. In the Collection field, enter groups, then click Update.

Enter the group claim name in the Collection field of Extra Mapping.

3. In Inventory > Collections, edit a collection and fill the SSO Mapping Identifier field with the corresponding group name.

Log in via OIDC

Once the connector is active and users are declared (or JIT is enabled), your users select the OIDC tab on the login screen, pick the connector, and are redirected to Okta.

Select the OIDC tab then the connector to be redirected to Okta.