Okta

Before you start#

• You need Okta admin access.
• Vectis support completes the configuration on the Vectis side, so be ready to send them the details below.

Step 1: Create an OIDC application#

1. Create an app integration

   In the Okta Admin Console, go to Applications → Create App Integration, and select OIDC - OpenID Connect and Web Application.

2. Configure it

   Set:

   • App integration name: Vectis
   • Grant type: Authorization Code
   • Sign-in redirect URIs: https://<your Vectis address>/sso/callback
   • Sign-out redirect URIs: https://<your Vectis address>/login
   • Controlled access: limit to assigned groups, or allow everyone

3. Save

   Select Save, then note the Client ID and Client Secret.

Step 2: Configure group claims#

1. Go to Security → API → Authorization Servers → default.
2. Go to Claims → Add Claim and set:
   • Name: groups
   • Include in token type: ID Token, Always
   • Value type: Groups
   • Filter: Matches regex .*, or filter to specific groups
3. Select Create.

Step 3: Send the details to Vectis#

Send Vectis support:

• Client ID and Client Secret from step 1.
• Issuer URL: https://your-okta-domain.okta.com, or your custom domain.
• Domain: your organisation's email domain.

Step 4: SCIM provisioning#

Ask Vectis support for a SCIM token and the SCIM base URL (it ends in /scim/v2), then:

1. In Okta, go to Applications → Vectis → Provisioning.
2. Select Configure API Integration and enable API integration.
3. Enter:
   • SCIM connector base URL: the SCIM base URL from Vectis
   • Authentication Mode: HTTP Header
   • Authorization: the SCIM bearer token from Vectis
4. Select Test API Credentials, then Save.
5. Turn on Create Users, Update User Attributes and Deactivate Users.

See SCIM provisioning for the attributes Vectis uses.

Troubleshooting#