> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta OIDC

> Configure Okta as an OIDC single sign-on provider for Bronto so users authenticate through your existing identity provider with centralised access.

## Overview

OpenID Connect (OIDC) Single Sign-On allows your organization to manage authentication through your existing identity provider. This integration streamlines user access, enhances security, and simplifies user management across your organization. This page covers configuring Okta as an OIDC provider; for other providers see the [SSO Overview](/Account-Management/SSO/SSO-Overview).

### Step 1: Create an OIDC Application in Okta

See Okta's [Create OIDC app integrations](https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_oidc.htm) for full details.

1. Sign in to your Okta Admin Dashboard
2. Navigate to **Applications** > **Applications**
3. Click **Create App Integration**
4. Select **OIDC - OpenID Connect** as the Sign-in method
5. Choose **Web Application** as the Application type
6. Click **Next**
7. Enter an Application name (e.g., "Bronto")
8. Add the following Redirect URI which will depend on your Bronto accounts region:
   * **EU:** `https://auth.eu.bronto.io/oauth2/idpresponse`
   * **US:** `https://auth.us.bronto.io/oauth2/idpresponse`
9. Under "Allowed grant types," ensure "Authorization Code" is selected
10. Under "Assignments," select which users or groups should have access
11. Click **Save**
12. Note the **Client ID** and **Client Secret** from the application details

### Step 2: Configure the provider in Bronto

Navigate to **Settings** > **Authentication** > **Login Methods** and click **Add Provider** in the **SSO** section. Set **Choose protocol** to **OIDC**, then work through the wizard:

1. **Name** — Pick a unique provider name within your organisation (e.g. "Okta").
2. **Provide** — Enter the **Client ID** and **Client Secret** from Step 1, and the **Issuer URL** (`https://your-okta-domain.okta.com`). The **Paste these into your IdP** panel shows the **Redirect URI** (which matches the one you set in Step 1) and the **Start URL** — copy the Start URL for Step 3.
3. **Email** — Add the email domains to route to this provider (e.g. `your-company.io`).
4. **Map** — Map Okta's attributes to Bronto's required fields. Okta's defaults are `given_name` (First Name), `family_name` (Last Name), and `email` (Email). To use role mapping, click **+ Add role mapping** and map your group claim to **custom:member\_of**.
5. Click **Save** to create and enable the IdP.

### Step 3: Add the Start URL to Okta

1. Go to the Okta app created above and select **Edit** next to **General Settings**.
2. Paste the **Start URL** from Step 2 into the **Initiate login URI** field and save.
3. Ensure **Login initiated by** is set to **Either Okta or App**.
4. Ensure **Display application icon to users** is enabled.

### Troubleshooting

* **Authentication fails:** Verify the Client ID and Client Secret are correct
* **Redirect errors:** Ensure the redirect URI exactly matches what's configured in Okta
* **User cannot access the application:** Check group assignments in Okta
* **Missing user information:** Verify attribute mapping in both Okta and Bronto
* **App Missing from Okta panel:** Ensure "Login initiated by" setting is set to "Either Okta or App", is assigned to users and "Application visibility" is set to "Display application icon to users"