Okta Workforce
Instructions for setting up Okta as your Identity Provider
In Okta Admin: Create an Okta OIDC Application
An administrator for your company's Okta Workforce needs to log in to the Admin portal and follow the steps below to create an OIDC Application.
Select Applications > Applications, and Create App Integration.
Select Create New App
Choose OIDC as the Sign-in method. Choose Web Application as your Application Type.
Click the Next button
Enter "Pushly" for for the App integration name
Under Sign-in redirect URIs enter the following value:
Under Sign-out redirect URIs enter the following value:
If you are asked for an Initiate Login URI you may enter the following value:
For Controlled access choose the appropriate option for your organization.
The Controlled Access setting controls which Okta users are permitted to authenticate against the Pushly application. If you scope access to a specific group, every user who needs to log in to Pushly must be a member of that group or assigned to this application in Okta. Users who are not assigned will be blocked by Okta during login and will see a failed sign-in, even if they already exist in the Pushly platform.
Click the Save button
On the next page copy both the Client ID and the Client Secret. The user creating the integration in the Pushly platform will need both of these values.
In addition to the Client ID and Client Secret you will also need to provide the Okta Domain. The Okta Domain is located in the top right of the Admin console or you can follow these instructions to retrieve the Okta domain.
Pushly: Create the Okta Identity Provider
Now that you have your Okta Domain, Client ID, and Client Secret you can log into the platform and navigate to your Organization Settings page.
Next, click the Security tab, and click the Add Provider button.
Choose Okta Workforce from the Provider Type dropdown.
The Okta domain should be entered including the .okta.com portion. For example: yourdomain.okta.com
Fill in the Client ID and Client Secret that was generated in the first step of this documentation.
Within the Associated Domains text area enter each domain name that your organization will be using to to log in via Okta on a separate line. For example, if your email address is example@yourdomain.com then you would enter yourdomain.com
Once the provider has been successfully created you can begin inviting users to the platform. Any user invited that has an email address that matches one of the emails provided in Email Domains will be sent through Okta for authentication.
Troubleshooting
Users see a 403 error or "access denied" when logging in
If users are blocked during login and you see an Auth0 error containing access_denied and the description "User is not assigned to the client application," the affected users have not been assigned to the Pushly application in Okta.
This error comes from Okta, not Pushly. Okta declines to authenticate the user before the login flow returns to Pushly, so it is unrelated to the user's Pushly roles or permissions.
To resolve: In the Okta Admin console, go to Applications → the Pushly application → the Assignments tab, and assign the affected users (or the group they belong to) to the application. Affected users can then retry logging in.
A user is assigned in Okta but still cannot log in
Okta application assignment and Pushly user provisioning are separate requirements. Assigning a user to the Pushly app in Okta — or setting Okta access to "allow everyone" — does not create that user in Pushly. The user must also be invited to the Pushly platform. If a user can authenticate through Okta but cannot access Pushly, confirm they have been created in the platform.
Last updated