Okta SSO
04/2024
Last updated
04/2024
Last updated
Oort’s platform can leverage your Okta instance for authentication into the Oort console. This allows you to fully manage administrator and role-based access (RBAC) to the Oort Dashboard. Okta integration with Oort is set up using OpenID Connect (OIDC.)
In order to enable SSO using the Okta Integration Network (OIN), please see these .
For more information on RBAC functionality within the Oort platform, please see .
RBAC configuration is not required for Okta SSO. It is optional, but this article includes instructions on the Okta configuration to support it.
Okta SSO integration will be set up with an OpenID Connect style application. The application will be configured in Okta and then assigned to users in the Okta directory.
To add the necessary configuration in Okta, you need to be one of the following:
Super Administrator
Organization Administrator
Application Administrator
These are the steps you need to go through to set up your SSO auth between Okta and CII.
Add OIDC web application in Okta. The callback URL will be specific to the deployment of your CII tenant: US production tenants: https://login.oort.io/login/callback EU production tenants: https://login.eu.oort.io/login/callback AU production tenants: https://login.au.oort.io/login/callback JP production tenants: https://login.jp.oort.io/login/callback UK production tenants: https://login.uk.oort.io/login/callback Canada production tenants: https://login.ca.oort.io/login/callback Singapore production tenants: https://login.sg.oort.io/login/callback
Enter the ClientID, Client Secret, and Okta tenant OIDC discovery URL to the Duo admin panel configuration (step 3) for your CII tenant under the Duo Monitoring section
Assign application to users
Create an Okta bookmark app for your users
Go to Applications -> Applications, and click on Create App Integration.
Please fill in the new app integration wizard as follows:
Sign-in Method - OIDC - OpenID Connect
Application Type - Web Application
Click Next
On the New Web App Integration page, complete the following:
App integration name = CII Dashboard (or desired app name)
Optionally, you can upload a logo. Feel free to use this one:
Grant type = Authorization Code
Sign-in redirect URIs are dependent on the CII environment in which your tenant resides. Ask your Duo representative if you're unsure which one to use. US production tenants: https://login.oort.io/login/callback EU production tenants: https://login.eu.oort.io/login/callback AU production tenants: https://login.au.oort.io/login/callback JP production tenants: https://login.jp.oort.io/login/callback UK production tenants: https://login.uk.oort.io/login/callback Canada production tenants: https://login.ca.oort.io/login/callback Singapore production tenants: https://login.sg.oort.io/login/callback
Sign-out redirect URIs = can be any URL desired, such as the Okta portal or your company portal
Click Save
To support RBAC and associated Triaging Alerts and Remediation Actions, the OIDC app created in Okta must be configured to pass the Groups claim in the OIDC token, with a specific filter.
First, make sure that you have created the groups in Okta (or on-prem AD, if sync'ing from on-prem AD) that will map to the roles available in Oort:
Oort full admin
Oort Help desk / Support
Oort Read only
NOTE: If using the Groups claim filter as shown below (contains "Oort"), then make sure the group names contain the required string. The token returned by Okta must contain less than 40 groups or it will be rejected.
Click Save
Next, you will provide the Client ID and Client secret to Oort.
You will now be on the configured application screen. On this screen, you will provide the Client ID and Client secret to Oort for setup in Oort’s backend.
Client ID
Client secret
If you did not assign the Oort Dashboard app to users during the app setup process, please assign the Oort Dashboard app to the appropriate users.
Assign app to user:
Go to Directory...People
Click on Username that you would like to assign the app to
Click on Assign Applications
Select the Oort Dashboard and click Done
The Oort Customer Success or Support team will provide you with a specific URL for your tenant and SSO connection string. This will have the form of -
Add the Groups claim configuration to the OIDC Token in the app you created, in order to support (optional)
Assignments - add users or groups that will have access to the application here. Alternatively, if intending to use RBAC, then create groups for each role (admin, help desk, read-only) as outlined in the .
From the Sign On tab in the application, click Edit in the OpenID Connect ID Token section
Add a Groups claim filter as shown below, such at the group name contains Oort
Okta Issuer URL - this will be in the format of . Oort does not require a custom Authorization server, unless one is required on the customer Okta tenant for some reason. See this for more information.
Oort strongly recommends creating a corresponding bookmark app in Okta for your Oort users to have quick access to the Oort console from their Okta dashboard. Please see .
Production: