Skip to main content

​
Okta Single Sign-On

Okta sign-in uses the Generic OIDC connection. Register an OIDC web application in the Okta Admin Console, then save the issuer, client ID, and client secret on Platform settings → SSO Configuration → Generic OIDC. Using a different identity provider? For Microsoft, see Microsoft Entra ID SSO. For Google Workspace, see Google Workspace SSO. For Auth0, PingIdentity, or another OIDC provider, see Generic OIDC SSO.
SSO Configuration and SCIM are Enterprise plan features. The Free plan hides both screens in Platform Settings. Plans & Billing lists them under Enterprise.

​
What this page covers

Directory pull, Sync now, automatic deprovisioning, and automatic member enrollment are not available for Okta yet. This page is organization sign-in. Accepting Okta tokens on TrustGate is a separate setup: Okta.

​
Prerequisites

  • Owner role in the NeuralTrust organization
  • Okta administrator access to create an application
  • An issuer that serves OIDC Discovery at {issuer}/.well-known/openid-configuration

​
One provider at a time

Only one identity provider can be active at a time (Microsoft Entra ID, Google Workspace, or Generic OIDC). Remove the current provider before saving Okta on the Generic OIDC tab.

​
Part 1: Create the Okta app integration

In the Okta Admin Console:
  1. Go to Applications → Create App Integration
  2. Select OIDC - OpenID Connect and Web Application
  3. Set Sign-in redirect URI to the callback in the table below
  4. Under Assignments, assign the users or groups who should access NeuralTrust
  5. Copy Client ID and Client Secret
  6. Use your org URL as the Issuer URL, for example https://your-org.okta.com
Paste the issuer base URL. Validate in NeuralTrust checks /.well-known/openid-configuration on that host.

​
Redirect URI

The path is /api/auth/callback/oidc for every Generic OIDC provider, including Okta. The in-app setup guide shows the callback for the current origin. The connection uses the same grant type and scopes as Generic OIDC SSO: Authorization Code, and openid, profile, and email. Optionally set Sign-out redirect URI to https://app.neuraltrust.ai.

​
Part 2: Save the connection in NeuralTrust

  1. Open the sidebar gear → Platform settings → SSO Configuration → Generic OIDC
  2. Click Edit
  3. In Generic OIDC Configuration, enter:
    • Issuer URL — the Okta org URL from Part 1
    • Click Validate to check the discovery endpoint
    • Client ID and Client Secret from the Okta application
    • Display Name (optional) — text on the login button, for example Sign in with Okta
    • Scopes (optional) — extra scopes beyond the default openid profile email
  4. Trust Identity Provider, role mapping, and session policy are the shared Generic OIDC fields. See Configuration fields, Role Mapping from IdP, and Session Policy.
  5. Click Save

​
Part 3: Verified domains and Enforce SSO

Email domains are shared across SSO providers. Add the domain and complete DNS verification in Email Domain Verification. Saving the connection sends verified-domain members through Okta. Enforce SSO is the toggle documented in Enable SSO Enforcement. Guests follow the same rule as on that page. The toggle needs a verified domain and an active Break the Glass account.
Before you save the connection, confirm that members on verified domains can sign in through Okta. Keep a Break the Glass account for IdP outages.

​
Troubleshooting

Connection errors match Generic OIDC troubleshooting. The rows that apply to this setup: