> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/secure-and-govern/identity-providers/okta.md).
# Okta
Use Okta as your identity provider so users sign in to Dispel with their Okta credentials over OAuth (OIDC) or SAML.
## Overview
Connect Okta — Okta's enterprise identity platform — as your organization's identity provider. Once connected, your users sign in to Dispel with their Okta credentials through single sign-on. You can connect Okta over **OAuth (OIDC)** or **SAML**.
This page covers the Okta-specific setup. For the shared behavior that applies to every provider — how users sign in, group mapping, MFA, and disconnecting — see [Identity Providers](/secure-and-govern/identity-providers.md).
{% hint style="info" %}
**Where to find it.** Sign in as an organization administrator and open **Settings → Integrations** (or the dedicated **Settings → Authentication** page). Okta appears in the **Identity & Authentication (IdP / SSO)** section. Click **Connect** on its card to begin.
{% endhint %}
## Before you begin
* You'll configure the IdP side in the **Okta Admin Console**, so you'll need administrative access there.
* Decide on a protocol — **OAuth (OIDC)** or **SAML**. See [Choosing a protocol](/secure-and-govern/identity-providers.md#choosing-a-protocol).
* Make sure the users who will sign in via Okta are already **invited to your organization** in Dispel. SSO authenticates users but doesn't create access on its own.
{% hint style="warning" %}
**One provider at a time.** If your organization is already connected to another identity provider, disconnect it before connecting Okta.
{% endhint %}
## Connect with OAuth (OIDC)
#### In Okta
1. In the Okta Admin Console, go to **Applications → Create App Integration** and choose **OIDC — OpenID Connect**.
2. Set the **sign-in redirect URI** to your Dispel address followed by `/oauth/login-callback` — for example `https://app.dispel.com/oauth/login-callback`. Confirm the exact address for your environment with your Dispel representative if you're unsure.
3. Assign the app to the users or groups who should have access.
4. From the app's **General** tab, copy the **Client ID** and **Client secret**, and note your Okta domain / issuer.
#### In Dispel
1. Click **Connect** on the Okta card and **Select Authentication Protocol → OAuth**.
2. Fill in the fields:
| Field | Value from Okta |
| --------------------------- | ------------------------------------------------------------------------- |
| **Client URL** | Your Okta OAuth/OIDC endpoint (issuer), e.g. `https://your-org.okta.com`. |
| **Client ID** | The application's **Client ID**. |
| **Client Secret** | The application's **Client secret**. |
| **Organization Identifier** | A unique identifier you choose; users type it on the sign-in screen. |
3. Click **Save settings**.
## Connect with SAML
#### In Okta
1. In the Okta Admin Console, go to **Applications → Create App Integration** and choose **SAML 2.0**.
2. In the SAML settings, paste the values Dispel shows at the top of its SAML form:
* **Single sign-on URL / Recipient / Destination** ← Dispel's **Assertion Consumer Service URL**.
* **Audience URI (SP Entity ID)** ← Dispel's **Service Provider (SP) Entity ID**.
3. Finish creating the app, then open its **Sign On** tab and collect:
* **Identity Provider Single Sign-On URL** → Dispel's **SSO URL**.
* **Identity Provider Issuer** → Dispel's **Identity Provider Entity ID**.
* The **X.509 / signing certificate** → Dispel's **Base64 Signing Certificate**.
4. Assign the app to the users or groups who should have access.
#### In Dispel
1. Click **Connect** on the Okta card and **Select Authentication Protocol → SAML**.
2. Copy the **Service Provider (SP) Entity ID** and **Assertion Consumer Service URL** shown at the top of the form (use **Copy ID** / **Copy URL**) into Okta, as above.
3. Fill in the fields:
| Field | Value from Okta |
| ------------------------------- | --------------------------------------------------------------------- |
| **SSO URL** | The **Identity Provider Single Sign-On URL**. |
| **Identity Provider Entity ID** | The **Identity Provider Issuer**. |
| **Base64 Signing Certificate** | The Okta signing certificate. Paste it or use **Upload Certificate**. |
| **Organization Identifier** | A unique identifier you choose; users type it on the sign-in screen. |
4. Click **Save settings**.
5. Click **Test connection**. Dispel redirects you to Okta to sign in, then shows the email and name it received. If the test fails, confirm the values match your Okta app and that the test user is invited to your organization.
## After connecting
* **Users sign in** by entering your Organization Identifier on the Dispel sign-in screen and authenticating with Okta. See [How users sign in](/secure-and-govern/identity-providers.md#how-users-sign-in).
* **Map Okta groups to Dispel groups** so membership stays in sync — see [OIDC Group Mapping](/integrate-and-administer/integrations/oidc-group-mapping.md).
* **MFA** enforced in Okta applies during sign-in; Dispel's email one-time codes don't apply to SSO users. See [SSO and multi-factor authentication](/secure-and-govern/identity-providers.md#sso-and-multi-factor-authentication).
* **To switch protocols or providers**, disconnect first. See [Switching or disconnecting a provider](/secure-and-govern/identity-providers.md#switching-or-disconnecting-a-provider).
## Frequently asked questions
Which protocol should I use with Okta?
Either works. Use whichever matches the app you create in Okta — an OIDC app integration for OAuth, or a SAML 2.0 app integration for SAML.
Do I need to assign users to the Okta app?
Yes. Only users (or groups) assigned to the Okta app can authenticate through it. They must also be invited to your Dispel organization.
My SAML test connection failed. What should I check?
Confirm the SSO URL, Issuer, and certificate match your Okta app's Sign On settings, that you pasted Dispel's SP Entity ID and ACS URL into Okta's SAML settings, and that the test user is assigned to the Okta app and invited to your Dispel organization.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.dispel.com/secure-and-govern/identity-providers/okta.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.