Okta Single Sign-on (SSO) Setup Guide

Okta SSO Setup Guide

This guide walks you through setting up Single Sign-On (SSO) with Okta for your Yogen organization. Prerequisites • Active Okta organization with admin access • Organization admin role in GetYogen • Your organization’s domain registered with Okta Benefits of SSO • Simplified Login: Users sign in once with their Okta credentials • Enhanced Security: Centralized authentication and access control • Automatic User Sync: Employee count, user profiles, and team mem- berships sync automatically from Okta • Team Auto-Mapping: Automatically creates teams from Okta groups and assigns users • Profile Synchronization: Keeps job titles, departments, locations, and managers up to date • Optional Enforcement: Require all users to use SSO instead of pass- words Step 1: Create Okta Application

Log in to your Okta Admin Console
Navigate to Applications → Applications
Click “Create App Integration”
Select the following options: • Sign-in method: OIDC - OpenID Connect • Application type: Web Application
Click “Next” Step 2: Configure Application Settings General Settings • App name: GetYogen SSO • App logo: (Optional) Upload your company logo Sign-in redirect URIs Add the following redirect URI based on your environment: • Production: https://yourdomain.com/oidc/callback • Development: http://localhost:3000/oidc/callback 1 Sign-out redirect URIs Leave empty for now. Assignments • Select which user groups should have access to GetYogen • You can assign Everyone or specific groups Save Click “Save” to create the application Step 3: Enable Client Credentials Grant Type To allow GetYogen to validate your Client Secret during “Test Connection”, you need to enable the Client Credentials grant type:
On the application details page, scroll to General Settings
Click “Edit”
Under Grant type, ensure the following are checked: • Authorization Code (should already be checked) • Client Credentials (enable this)
Click “Save” Why is this needed?: GetYogen uses the Client Credentials grant type to verify that your Client ID and Client Secret are correct when you click “Test Connection”. This ensures you catch credential errors before saving your SSO configuration. Step 4: Copy Application Credentials After creation, you’ll see the application details page:
Copy the Client ID (visible on the “General” tab)
Click “Show” next to “Client secret”
Copy the Client Secret immediately • Store this securely - you won’t be able to view it again Step 5: Get OIDC Endpoints
In Okta Admin Console, go to Security → API
Click on Authorization Servers
Click on the default authorization server
Find the Issuer section on this page • It will show something like: https://yourcompany.okta.com/oauth2/default • Note your Okta domain from the Issuer URL (e.g., yourcompany.okta.com) 2 Important: You are NOT entering these URLs into Okta. You will construct them and enter them into GetYogen in Step 5. Using your Okta domain from the Issuer, construct the following endpoint URLs: • Authorization URL: https://{yourOktaDomain}/oauth2/default/v1/authorize • Token URL: https://{yourOktaDomain}/oauth2/default/v1/token • JWKS URI: https://{yourOktaDomain}/oauth2/default/v1/keys Example: If your Issuer shows https://acmecorp.okta.com/oauth2/default, then: - Authorization URL: https://acmecorp.okta.com/oauth2/default/v1/authorize

Token URL: https://acmecorp.okta.com/oauth2/default/v1/token - JWKS URI: https://acmecorp.okta.com/oauth2/default/v1/keys Step 6: Configure SSO in GetYogen

Log in to GetYogen as an organization admin
Navigate to Settings → Single Sign-On
Click “Set Up SSO” Basic Configuration Tab Enter the values you copied: • Client ID: (from Step 3) • Client Secret: (from Step 3) • Authorization URL: (from Step 4) • Token URL: (from Step 4) • JWKS URI: (from Step 4) • Additional Email Domains: (Optional) Enter additional email do- mains for contractors or partners who use SSO but have different email domains (e.g., atbabers.com, partner.com) Domain Matching: The system automatically allows SSO for: - Email do- mains from your Company Website (Settings → Company Info) - Email do- mains from your Org URL (Settings → Org Info) - Any additional domains you specify above Example: If your company is getyogen.com but you have contractors with @atbabers.com emails in your Okta organization, add atbabers.com to Addi- tional Email Domains. Optional: Check “Enforce SSO” if you want to disable password logins Test the Configuration
Click “Test Connection”
Verify you see a success message
If you see errors, double-check your URLs and credentials 3 Save Click “Save Configuration” when ready Step 7: (Optional) Enable Advanced Sync Features To enable automatic synchronization of employee count, user profiles, and team mappings from Okta: Create Okta API Token
In Okta Admin Console, go to Security → API → Tokens
Click “Create Token”
Name: GetYogen API
Click “Create Token”
Copy the token immediately (you won’t see it again) Required Permissions: The API token needs read access to: - Users (to count active employees and fetch profile data) - Groups (to auto-create teams from Okta groups) Configure in GetYogen
Go to Settings → Single Sign-On → Advanced Settings
Enter: • Okta API Token: (token from above) • Okta Domain: company.okta.com (without https://)
Check “Enable Advanced Sync (Employee Count, User Profiles, Team Mapping)”
Click “Save Advanced Settings”
Optionally click “Sync Now” to test What Gets Synced When Advanced Sync is enabled, the following data syncs automatically on user login: Organization Data: - Total count of active employees in Okta User Profile Data: - Job title - Department - Office location - Manager’s email address Team Memberships: - Automatically creates teams from Okta groups - Adds users to teams based on their group memberships - Excludes system groups (e.g., “Everyone”, “Administrators”) Note: Profile data only updates for fields originally synced from Okta. Manual changes to user profiles are preserved. 4 Step 7: Test SSO Login
Open a new incognito/private browser window
Go to GetYogen login page
Enter an email address from your Okta organization
You should see “SSO available for your organization”
Click “Sign in with Okta”
You’ll be redirected to Okta to authenticate
After authentication, you’ll be redirected back to GetYogen Troubleshooting “Invalid client credentials” Cause: Client ID or Client Secret is incorrect Solution: - Verify you copied the credentials correctly from Okta - Check for extra spaces or characters - Regenerate the client secret if needed “Redirect URI mismatch” Cause: The callback URL doesn’t match what’s configured in Okta Solution: - Ensure the redirect URI in Okta exactly matches: {yourDomain}/oidc/callback

Check for trailing slashes - Verify you’re using the correct protocol (https vs http) “SSO is not configured for your organization” Cause: The configuration is not enabled or the email domain doesn’t match Solution: - Verify SSO is enabled in GetYogen settings - Check that the user’s email domain matches your Okta organization Users can’t sign in Cause: Users aren’t assigned to the Okta application Solution: - In Okta, go to Applications → GetYogen SSO → Assign- ments - Verify the user or their group is assigned - Add assignments as needed Employee count or user data not syncing Cause: API token is missing, invalid, or lacks permissions Solution: - Verify the Okta API token is entered correctly - Check the Okta domain is correct (without https://) - Ensure the API token has read permis- sions for Users and Groups - Try creating a new API token with appropriate scopes - Check that “Enable Advanced Sync” is checked in Advanced Settings 5 Teams not being created from Okta groups Cause: Group data not accessible or sync disabled Solution: - Verify the API token has permission to read Groups - Check that users are assigned to groups in Okta - System groups like “Everyone” are in- tentionally excluded - Look for team names with ” (Okta)” suffix if there are naming conflicts - Check team creation in GetYogen after a user from that group logs in Email domain not recognized for SSO Cause: Email domain doesn’t match organization’s configured domains Solution: - Ensure your Company Website (Settings → Company Info) con- tains your primary domain - Ensure your Org URL (Settings → Org Info) contains your primary domain - For contractors/partners with different email domains, add them to Additional Email Domains in the SSO configuration (e.g., atbabers.com, partner.com) - Domains are automatically extracted and normalized from URLs - Example: https://www.getyogen.com/ → matches [email protected] “Client ID format is invalid” Cause: The Client ID doesn’t match Okta’s format requirements Solution: - Okta Client IDs are exactly 20 alphanumeric characters - Verify you copied the entire Client ID from Okta - Check for extra spaces at the beginning or end - Don’t include any labels like “Client ID:” in the field “Configuration URLs must all be from the same Okta domain” Cause: The Authorization URL, Token URL, and JWKS URI are from different Okta domains or tenants Solution: - Verify all three URLs use the exact same Okta domain - Exam- ple: All should use company.okta.com, not mixing company.okta.com and company-dev.okta.com - Double-check you constructed the URLs correctly from your Issuer URL - Ensure you’re using the same authorization server (typ- ically /oauth2/default/) “JWKS endpoint did not return valid key data” Cause: The JWKS URI is incorrect or the authorization server has no keys configured Solution: - Verify the JWKS URI follows the pattern: https://{yourDomain}/oauth2/default/v1/keys
Test the JWKS URI in a browser - it should return JSON with a “keys” array
Ensure you’re using the correct authorization server in Okta - Check that the authorization server is active and has keys configured 6 “Client Credentials grant type is not enabled” Cause: The Okta application doesn’t have Client Credentials grant type en- abled Solution: 1. Go to your Okta application settings 2. Navigate to General Settings 3. Click “Edit” 4. Under Grant type, ensure both are checked: - Authorization Code - Client Credentials 5. Click “Save” 6. Return to GetYogen and try “Test Connection” again Why is this needed?: GetYogen validates your Client ID and Secret are correct during “Test Connection” using the Client Credentials flow. This catches credential errors before you save your configuration. “invalid Client ID or Client Secret” Cause: The credentials you entered don’t match what’s configured in Okta Solution: - Double-check you copied the Client ID and Client Secret correctly
In Okta, regenerate the Client Secret if you’re unsure - Ensure there are no extra spaces or hidden characters - Try copying the credentials again from Okta
Verify you’re looking at the correct Okta application Required Scopes Your Okta application must have these scopes enabled: • openid - Required for OIDC • profile - User profile information • email - User email address • phone - User phone number (optional but recommended) To verify scopes: 1. Go to Applications → GetYogen SSO 2. Click “Okta API Scopes” tab 3. Ensure the above scopes are granted Security Best Practices

Enforce SSO: Once testing is complete, consider enforcing SSO to disable password logins
Regular Audits: Periodically review who has access to the GetYogen app in Okta
API Token Security: Store your Okta API token securely and rotate it regularly
Monitor Logs: Review authentication logs in both Okta and GetYogen
MFA: Enable Multi-Factor Authentication in Okta for additional security 7 Managing SSO Disabling SSO
Go to Settings → Single Sign-On
Click the delete/disable button
Users will revert to password-based login Updating Configuration
Go to Settings → Single Sign-On
Update any fields as needed
Click “Test Connection” to verify
Click “Save Configuration” Viewing SSO Status The Basic Configuration tab shows: - Whether SSO is enabled - When it was last updated - Whether SSO is enforced The Advanced Settings tab shows: - Advanced sync status (employee count, profiles, teams) - Last sync timestamp - Manual sync button for testing Support If you encounter issues not covered in this guide:
Check the GetYogen application logs
Review Okta system logs for authentication attempts
Contact GetYogen support with: • Your organization ID • Timestamp of the error • Screenshot of any error messages • Steps to reproduce the issue Additional Resources • Okta OIDC Documentation • OpenID Connect Specification • GetYogen Security Documentation Last updated: 2025-11-22