Set Up SSO with Okta
Identity provider screens change often. If a menu or button named here has changed, look for the closest match.
Create an OIDC web app integration in Okta, assign it to your people, and copy your Okta domain and the app's credentials into MSPCFO.
1. Create the app integration
- In the Okta Admin Console, go to Applications → Applications and choose Create App Integration.
- Sign-in method: OIDC - OpenID Connect. Application type: Web Application. Choose Next.
- Enter:
- App integration name: e.g.
MSPCFO - Grant type: Authorization Code (selected by default)
- Sign-in redirect URIs:
https://app.mspcfo.com/user/auth/okta/callback(remove the example localhost value) - Sign-out redirect URIs: optional; you can leave it empty
- Assignments: choose who may use MSPCFO, e.g. specific groups
- App integration name: e.g.
- Choose Save.
[SCREENSHOT: Okta New Web App Integration page filled in]
2. Copy the credentials
On the app's General tab, under Client Credentials, copy the Client ID (starts with 0oa) and the Client secret.
[SCREENSHOT: Okta app General tab, Client Credentials section]
3. Find your Okta domain
Your Okta domain is your org's address, shown in the Admin Console's account menu (top right) or in its URL, for example yourcompany.okta.com. Leave out the -admin part.
ALERT Custom domains: MSPCFO accepts only Okta's own domains (okta.com, oktapreview.com, okta-emea.com, okta-gov.com, okta.mil). If your people sign in at a custom domain such as login.yourcompany.com, enter your org's okta.com address instead. Every org has one, and it works the same way.
4. Authorization server (usually leave blank)
- Leave blank to use your Okta org's built-in authorization server. This works for every Okta org and is right for most companies.
- Enter a custom authorization server ID (e.g.
defaultoraus1a2b3c4) only if your organization uses Okta API Access Management and wants MSPCFO sign-ins to go through that server. You can paste the server's Issuer URI instead, and MSPCFO keeps just the ID. The server's access policy must allow the MSPCFO app and theopenid,emailandprofilescopes.
5. Finish in MSPCFO
| Field | Value |
|---|---|
| Provider | Okta |
| Okta domain | e.g. yourcompany.okta.com (step 3) |
| Authorization server ID (optional) | Blank, unless step 4 applies |
| Client ID | From step 2 |
| Client secret | From step 2 |
Save, then run Test sign-in.
Okta-specific problems
| Symptom | Fix |
|---|---|
| Okta error "The 'redirect_uri' parameter must be a Login redirect URI …" | Add the exact callback URL to the app's Sign-in redirect URIs (step 1). |
| Okta error "User is not assigned to the client application" | Assign the person, or a group they're in, to the MSPCFO app (Assignments tab). |
| Okta domain refused when saving | You entered a custom domain or a non-Okta address. Use your org's okta.com address (step 3). |
| "Your identity provider did not confirm this email address …" | Okta reports the person's primary email as unverified, usually for users created or imported without email verification. Have the person verify their email in Okta, or correct their primary email. |
0 Comments
Add your comment