Skip to main content

Configure Okta as SSO

Okta Configuration

On Okta side, you'll have to create a new application:

  • Step 1: Create an OpenID Connect web application

  • Step 2: Configure the callback URI

The redirect URI can be like: http(s)://<Console host>(:<Console port>)/oauth/callback/<OAuth2 config name>.

For example, if you deployed Console locally using the name okta in your configuration file, you can use http://localhost:8080/oauth/callback/okta, like in the screenshot below.

For more details on Console redirect URI for OAuth2, you can check the documentation.

  • Step 3: Configure app assignments, and save changes

  • Step 4: Get client ID and client secret, that you'll use in the configuration file of Console

  • Step 5: Find the issuer URL in the Sign On tab of your application. It's made like https://<domain>


You can find the .well-known at: https://<domain>

Console Configuration

On Console side, you can add the snippet below to your configuration file. You have to replace the client ID, client secret, and domain, with what you got during steps 4 and 5.

- name: "okta"
default: true
client-id: "<client ID>"
client-secret: "<client secret>"
issuer: "https://<domain>"

Please note that if you are using a custom auth server in Okta, the OPENID_ISSUER should be in the form https://<yourOktaDomain>/oauth2/<authorizationServerId>/ rather than https://<domain> You can find documentation on this here.