Okta single sign-on

Let your people sign in with your company’s Okta: make one app in Okta, paste three values, prove your email domain.

Who does this: your Okta administrator, with whoever looks after your company's DNS. About 10 minutes. In Oh! Thyme, an admin opens Connectors > Okta.

How it works#

Once it is on, anyone whose work email is at one of your domains signs in through Okta, with Okta's own password and sign-in policy. Oh! Thyme sends them no email code, and the sign-in page's Okta button takes them there too. Okta must list the person, and they must already be a person in your company in Oh! Thyme: signing in never adds anyone. Every sign-in through Okta, and every one that is refused, with the reason, is in your audit log.

When you turn it on, everyone at those domains who signed in another way is signed out once, and signs in again through Okta.

1. Make the app in Okta#

In the Okta Admin Console: Applications > Applications > Create App Integration. Choose OIDC - OpenID Connect, then Web Application.

• Grant type: Authorization Code only.
• Sign-in redirect URI: https://ohthyme.com/api/auth/sso/callback (the Okta page in Oh! Thyme shows it, with a Copy button).
• Sign-out redirect URI: leave it empty.
• Assignments: the people who use Oh! Thyme, or a group of them.

Save.

2. Paste three values into Oh! Thyme#

• Issuer: your Okta address, like https://acme.okta.com (Security > API lists it as the Issuer URI of your org authorization server). A custom authorization server's issuer, like https://acme.okta.com/oauth2/default, works too.
• Client ID: on the app's General tab, under Client Credentials.
• Client secret: in the same place. Oh! Thyme stores it encrypted and never shows it again.

3. Prove your email domains#

Oh! Thyme's Okta page shows a TXT record, ohthyme-verify= followed by 32 letters and numbers, that belongs to your company alone. Add it at each email domain your people use (the domain itself, like acme.com) in your DNS provider, then type the domains into Email domains, separated by commas.

Press Save. Oh! Thyme first reads your Okta's settings and each domain's TXT record. If either is missing, it says which, beside the field, and keeps nothing. Free mail domains such as gmail.com cannot be used, and a domain can belong to one company's single sign-on only.

Turning it off#

Turn off keeps the values and gives everyone their email code back. Remove deletes them. The app in Okta is not changed either way.

Other OpenID Connect providers#

Any provider that follows OpenID Connect works the same way: an issuer with a discovery document, a client ID and secret, the authorization code flow, and an email_verified claim in the ID token. For Microsoft 365, ask us to turn on Microsoft sign-in instead (see Microsoft 365 sign-in).