Skip to main content

Setting up Okta for Single Sign-On

This document outlines the setup process for integrating Okta with Abacus.AI for Single Sign-On (SSO). It includes OAuth-based integration, along with best practices, security requirements, and answers to commonly asked enterprise questions.

Overview​

Okta can be used to integrate with Abacus.AI for Single Sign-On (SSO) using either OAuth or SAML. This document provides step-by-step instructions for OAuth, along with details on security requirements and troubleshooting. If you would like to set up Okta SAML SSO, please see the instructions here.

Using OAuth​

Step 1: Navigate to Okta Admin Dashboard​

  1. Log in to your Okta Admin Console.
  2. Go to <your-okta-admin-subdomain>.okta.com/admin/apps/add-app.
    Example: abacusai-admin.okta.com/admin/apps/add-app.

Step 2: Browse App Integration Catalog​

  1. Browse the App Integration Catalog and click the Create New App button.

    Create New App

Step 3: Create a New App Integration​

  1. Select the following settings:

    • Sign-in method: OIDC - OpenID Connect
    • Application type: Web Application

  2. Click Next.

    App Integration

Step 4: Configure Redirect URL and Sign-Out Redirect URIs​

  1. App integration name: Enter a name for your app integration.
  2. Sign-in redirect URIs: Set the Redirect URL to: https://dev-kkhyscwx.us.auth0.com/login/callback.

Integration Choices
  1. Sign-out redirect URIs: Leave the sign-out redirect URIs blank.
  2. You may set the assignments now or skip this step.
  3. Click Save.
Additional Okta Configurations

Step 5: Provide Okta URL and Client Credentials​

  1. Email us at connectors@abacus.ai with the following information:

    • Your Okta URL (e.g., abacusai.okta.com)
    • The client ID
    • The client secret for your newly generated app.
    Client Credentials

Step 6: Wait for Setup Completion​

  1. After providing us with your Okta information, please wait while we set up your Abacus.AI environment to enable Okta SSO.
  2. We will notify you when the setup is complete.
  3. After setting up the app on Okta, make sure your application is active and then assign users to the app.

Automated provisioning with SCIM​

To have Okta create, update, and deactivate Abacus.AI users automatically — and to push your Okta groups to Abacus.AI — enable SCIM provisioning.

info

Okta's OIDC / OAuth application type does not expose a Provisioning tab, so SCIM cannot be enabled on the application you created above. You need a separate Okta application dedicated to SCIM, in addition to the OIDC application used for sign-in.

  1. In Abacus.AI, go to Profile → SCIM Provisioning, select Okta, and click Enable SCIM Provisioning to get your Tenant URL and Bearer Token.
  2. Leave the OIDC application above unchanged. In the Okta Admin Console, go to Applications → Browse App Catalog and add the SCIM 2.0 Test App (Header Auth) integration (or another app integration that supports SCIM with header authentication). Name it something clear, such as Abacus.AI SCIM.
  3. Open the new application's Provisioning tab → Configure API Integration → Enable API integration, and set:
    • SCIM connector base URL: https://<subdomain>.abacus.ai/scim/v2
    • Unique identifier field for users: email
    • Supported provisioning actions: Push New Users, Push Profile Updates, Push Groups
    • Authentication Mode: HTTP Header with Authorization: Bearer <token>
  4. Test the API credentials and save, then under To App enable Create Users, Update User Attributes, and Deactivate Users.
  5. Assign the same users and groups to the SCIM application that you assign to the OIDC application, so that sign-in access and provisioning stay in sync.

See SCIM Provisioning for the full walkthrough, the attribute mapping reference, and group-to-role mapping.