Security and Team Management
SSO with Okta
Configure Okta as an OIDC (or SAML) SSO provider for dFlow.
Use this walkthrough to fill out Account → Single Sign-On → Add OIDC for Okta.
1. Create an OIDC app in Okta
- Open the Okta Admin Console.
- Go to Applications → Applications → Create App Integration.
- Choose OIDC - OpenID Connect, then Web Application.
- Fill in:
| Field | Value |
|---|---|
| App integration name | For example dFlow SSO |
| Grant type | Authorization Code (PKCE is recommended) |
| Sign-in redirect URIs | {your-dflow-url}/api/auth/sso/callback/<provider-id> — pick the Provider ID in dFlow first so the URI matches (for example acme-okta) |
| Controlled access | Assign the groups or users who should reach dFlow |
- Save, then copy the Client ID and Client secret.
2. Confirm the issuer
For Okta's default authorisation server:
https://<your-org>.okta.com/oauth2/defaultIf you use a custom authorisation server, use that server's issuer URL instead (from Security → API → Authorization Servers). Custom servers may publish discovery on a different host; add that host under Trusted origins in dFlow if it differs from the issuer origin.
3. Fill in the dFlow modal
| Field | Value |
|---|---|
| Provider ID | Same suffix as the Okta redirect URI (for example acme-okta) |
| Email domains | Domains your Okta users sign in with (for example acme.com) |
| Issuer URL | https://<your-org>.okta.com/oauth2/default (or your custom server issuer) |
| Client ID | from Okta |
| Client secret | from Okta |
| Scopes | openid email profile |
| Token auth method | client_secret_basic (or client_secret_post if your Okta app requires it) |
| Use PKCE | On |
| Skip discovery | Off |
Leave optional endpoint fields blank unless discovery fails.
4. Save and test
- Click Add provider.
- Sign out of dFlow.
- Enter an Okta user email on a registered domain.
- Complete Okta sign-in and confirm you return to dFlow signed in.
SAML option
Okta also supports SAML 2.0 apps. Use Add SAML with the Okta SSO URL, IdP certificate, and optional metadata. See SSO with any OIDC or SAML provider.