Okta
Create an OpenID Connect web application in Okta, send the groups claim, and connect it for single sign-on.
Costfluent signs your people in through Okta over OpenID Connect. You create one app integration in your Okta organization, and Costfluent trusts the addresses at the domains you verify.
Before you start
- You need the Owner organization role in Costfluent, and an Okta administrator who can create app integrations.
- Your people's addresses are at a domain you can publish a DNS TXT record for.
Available on the Core, Optimize and Scale plans. Compare plans
Register the application
- In the Okta Admin Console, create an app integration with OIDC as the sign-in method and web application as the type.
- Allow the authorization code grant and add the sign-in redirect URI
https://app.costfluent.com/api/auth/sso/callback. - Use a client secret for client authentication. Costfluent sends it in the body of the token request (
client_secret_post), so choose that method where Okta asks. - Assign the people or groups who should sign in, then copy the client ID and the client secret.
Your discovery URL is that of your Okta organization's own authorization server, https://<your-org>.okta.com/.well-known/openid-configuration.
Send groups
- On the app integration's sign-on settings, set a groups claim named
groups. - Filter it to the groups you want to map, for example those whose name starts with a common prefix.
Okta sends each group by its name, so the Identity provider group you map in Costfluent is the name as Okta shows it.
The organization authorization server puts groups in the ID token. A custom authorization server, such as default, needs a groups claim of its own, added to the ID token; without it Costfluent sees no groups.
Connect in Costfluent
- Open Settings, then Single sign-on, and connect your provider with the discovery URL, the client ID and the client secret.
- Add your email domains to the connection and verify each with its DNS TXT record.
- Map the group names to teams, then enable the connection.
Sign-in and security covers each of these steps, enforcement and break-glass Owners.
How it behaves
Costfluent reads these claims from the ID token, and from the userinfo endpoint where the ID token leaves one out:
iss, which must equal the issuer your discovery document named when you connected it,https://<your-org>.okta.com.sub, the Okta user ID, as the identity Costfluent keeps.email, which must be at one of the connection's verified domains. An address outside every verified domain is refused, and so is a sign-in without an address.name, for the name of an account Costfluent creates.groups, or another claim name you set on the connection.
Costfluent also refuses a token whose signature, audience, nonce or lifetime does not check out, and a discovery document that starts naming another issuer.