Usage Scenario

Single sign on with Okta and authorize users based on Okta group membership information

How to Set Up

Single Sign On with Okta

1. Make sure your OneDev instance can be accessed publicly, and configure the public server url in Administration / System Setting

2. Login to Okta to manage the applications

3. Add OneDev as a web application to get the client id and secret

4. Switch to api/authorization servers to get the default issuer URL

5. At OneDev side, switch to page Administration / Authentication Source / Single Sign On, add a provider of type OpenID , with information from previous steps

8. Now sign out and a button Login with Okta will appear at bottom of the login page. Anyone in your Okta organization assigned to OneDev application will be able to login via this button

Authorize Users Based On Okta Group Membership Information

1. At OneDev side, edit Okta single sign on provider, and specify groups claim as groups

2. At Okta side, switch to page api / authorization servers, select default authorization server to add groups scope

3. Continue to add groups claim to be included in ID token and groups scope like below

4. At OneDev side, switch to page Administration / Group Management, add necessary Okta groups (same name) and assign appropriate permissions

5. Now users signed in via Okta will be added to corresponding groups at OneDev side to get appropriate permissions

Access OneDev from Okta Side

To access OneDev from Okta side, edit the application to enable implicit grant type, tick the option display application icons to users, and configure initiate login url as below:

Then for all users added to the application, they will be able to access OneDev directly from their Okta dashboards: