# Setup Okta SSO

URL: https://select.dev/docs/reference/using-select/access-management/okta-sso
Index of all SELECT docs: https://select.dev/docs/llms.txt

> Learn how to setup Okta SSO with SELECT

## Connecting Okta

> [!NOTE]
> SELECT's Okta integration is an add-on feature. Please contact SELECT to determine your eligibility and receive a quote.

To manage access and authentication to SELECT using your Okta account, please follow the steps below.

### Step 1: Create App Integration

Launch the create app integration flow in the Okta console.

![SELECT Okta integration setup step #1](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/docs/okta1.png/width=2640,quality=75)

Select OIDC for the sign-in method, and web application as the application type.

![SELECT Okta integration setup step #2](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/docs/okta2.png/width=1980,quality=75)

On the next page, set the app name to SELECT. Check all the grant type boxes so that they match the screenshot below. Set the sign-in redirect URI to `https://auth.select.dev/login/callback`.

![SELECT Okta integration setup step #3](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/ec724c42-a209-48e5-89b9-61e5b5984900/width=1280,quality=75)

On the next page, scroll to ‘General Settings’ and click ‘Edit’. Under ‘Login’, set the ‘Login initiated by’ dropdown to ‘Either Okta or app’. Under ‘Application visibility’, check the box next to ‘Display application icon to users’. You can find your `ORGANIZATION_ID` value in [settings](https://select.dev/app/settings).

![Find your organization ID SELECT](https://cdn.sanity.io/images/wn0ylp2c/production/4e7878f4fc488065620d278b6e1fdfd5a07aef64-2214x1304.png)

Set the Initiate Login URI value to `https://select.dev/api/auth/login?organization=ORGANIZATION_ID`, replacing `ORGANIZATION_ID` with the value you have.

![SELECT Okta integration setup step #4](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/17ebb209-96d2-4468-b1a3-d557a8e2e500/width=1506,quality=75)

Set Federation Broker Mode to Disabled to ensure that the app tile shows up for users. Add the required assignments under the ‘Assignments’ tab at the top of the page.

![SELECT Okta integration setup step #5](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/docs/okta5.png/width=1516,quality=75)

### Step 2: Add SSO Connection in SELECT

Once complete, head over to SELECT and navigate to **Settings** → **Authentication**. In the Custom Enterprise SSO section, click Add SSO and select Okta from the dropdown.

![Add Okta SSO Flow](https://cdn.sanity.io/images/wn0ylp2c/production/a8f356b07aeb0a88b31b8c01d8c43446c23d2604-3024x1963.png)

Next, fill out the Add Okta SSO form. Details about where to find the domain, client ID, and client secret on the Okta console are listed below:

- Client ID and secret for the newly created application integration

![SELECT Okta integration setup step #6](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/c342d15f-1f55-4534-03cc-7208308a0700/width=1534,quality=75)

- The Okta domain. This is usually the domain found by clicking your email address in the top right, as shown in the below screenshot. If you've configured the app to use a custom domain, however, please specify that instead.

![SELECT Okta integration setup step #7](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/docs/okta7.png/width=592,quality=75)

Click Add SSO to complete. You should then see your newly created SSO connection under Authentication Methods.

![Add Okta SSO form](https://cdn.sanity.io/images/wn0ylp2c/production/791d57b061c46d8f3a94398215e7a981b61b000f-3024x1963.png)

![Created Okta SSO connection](https://cdn.sanity.io/images/wn0ylp2c/production/ef51dfdf2ba23adfaa073f9972d049350f442686-3024x1963.png)

> [!NOTE]
> Creating an SSO connection will automatically disable manual user invitations. 

## Mapping SSO Groups to Roles in SELECT

Through the User Roles & Permissions in SELECT, users can enable fine-grained access control in SELECT.

Rather than manually [assigning each user a role](https://select.dev/docs/reference/using-select/access-management/role-based-access-control#direct-assignment) in SELECT, you can configure roles to be automatically assigned based on the user's Okta SSO group.

To do this, the SELECT integration you set up in Okta needs to be configured to pass your employee's Okta groups to SELECT. Follow the steps below to add the necessary group claims.

1. In Okta, click **Applications** in the sidebar
2. Click the SELECT app

![](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/sso-group-mappings-2-5f3cb51d7bcaedbe1b261625d064aad40ef92322a802907a0535b827e85b29ca/width=2626,quality=75)

3\.  Click the **Sign On** tab

![](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/sso-group-mappings-4-a94c684018cc38af3d0c3fe51eebdbeb9314072a894b2f309fadd52554b119e1/width=2624,quality=75)

4\. Scroll down to **OpenID Connect ID Token** section and click **Edit**.

![](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/sso-group-mappings-0-d8ecb062c24e703a588e24f7a24e7d1ccb20363c27ad6cd9af433fb419d57952/width=2626,quality=75)

5\. Set the **Group claims type** to `Filter`

6\. Set **Groups claim filter** to `groups` (which is pre-filled) and for pattern pick matches regex and enter `.*` if you want to send along all the groups. If you want to restrict the groups that are made available to select choose another option. You can learn more about the [Groups Claim here](https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/).

7\. Click Save

![](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/sso-group-mappings-1-b7c9ccfbf4dc872e550b688a753197b22207af4ab3efb373d6da8a7a71cbf32c/width=2624,quality=75)

8\. Log in / out of SELECT, and validate that the SSO groups are being exposed to SELECT by checking the user's roles

![SELECT User Sidebar Roles](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/230dc412-57fc-4fd5-91b1-1357ec3ddc00/width=1008,quality=75)

9\. Head back to our [Roles documentation](https://select.dev/docs/reference/using-select/access-management/role-based-access-control#sso-group-mapped-roles) and add the group mappings in SELECT.