Okta and Other OIDC Providers
Connect Okta, or any identity provider that supports OpenID Connect, as your SSO provider.
Use Okta or other OIDC for Okta and for any identity provider that supports OpenID Connect (for example OneLogin, JumpCloud, Ping Identity or Auth0).
Create the app in Okta
- In the Okta Admin Console, go to Applications → Applications and click Create App Integration.
- Sign-in method: OIDC - OpenID Connect. Application type: Web Application. Click Next.
- App integration name: for example
ArmorIQ. - Grant type: keep Authorization Code.
- Sign-in redirect URIs: replace the example with the Redirect URI shown on the ArmorIQ setup page:
https://sso.armoriq.ai/callback- Sign-out redirect URIs: remove the example; ArmorIQ does not need one.
- Assignments: choose who may use ArmorIQ, either everyone in your organization or specific groups.
- Click Save. On the app's General tab, copy the Client ID and Client secret.
Find your issuer URL
The issuer URL identifies your Okta authorization server:
| Okta setup | Issuer URL |
|---|---|
| Most organizations | https://<your-okta-domain>, for example https://acme.okta.com |
| A custom authorization server | https://<your-okta-domain>/oauth2/<server-id>, for example https://acme.okta.com/oauth2/default |
For other providers, the issuer is the issuer value in the provider's OpenID configuration at <issuer>/.well-known/openid-configuration.
Connect it in ArmorIQ
- In Settings → Single sign-on, under Identity provider, choose Okta or other OIDC.
- Issuer URL: paste the issuer, starting with
https://. - Client ID and Client secret: paste the values from Okta.
- Name on the sign-in page (optional): for example
Acme Okta. - Click Save connection.
ArmorIQ checks the issuer when you save. It must be reachable over the public internet and publish an OpenID configuration that names the same issuer.
Your identity provider must mark users' email addresses as verified (the email_verified claim). Okta does this for activated users. A user whose email is not verified cannot sign in with SSO.