Okta SSO

In this guide, you’ll learn how to set up Okta SSO in Coalesce.

Okta Administrator

You must be a Okta Administrator to complete this process.

Before You Begin

Check Your Subdomain

Your subdomain is the subdomain of your Coalesce instance. For example, if you login at https://testapp.app.coalescesoftware.io/. Your subdomain is testapp.

To check if already have a subdomain, go your organizations single sign-on settings.

If you don't have a subdomain, you can add one to the subdomain box. Coalesce will automatically configure your subdomain based on the name entered. Check with your IT team before adding it to your organizations settings.

Create Okta App Integration

To use Okta as your Single Sign-On provider, you'll want to create a new App Integration in Okta.

1. Open the admin panel for your Okta organization

2. Click on Applications.

   

3. Click on Create App Integration.

4. Select OIDC - OpenID Connect as the Sign-in method and Single-Page Application as the Application Type and then create the new app integration.

   

5. On the settings page for this newly created integration, enter the following:

   1. App Integration Name - this is typically going to be Coalesce but any friendly name works
   2. Sign-in redirect URI - by default this is http://localhost:8080/login/callback which you'll want to change to https://mySubdomain.<app_domain>/login/callback. mySubdomain is typically the name of your organization.
   3. Controlled Access - select whichever setting is appropriate for your organization

6. Click Save. You'll now be at a window with all your App Integration settings. Keep this browser tab open as you'll need to enter some information from it into Coalesce.

Configure Coalesce Okta Settings

1. Open a new window.

2. Sign in to your Coalesce application using username and password.

3. Go to Organization Settings > Single Sign-On.

4. Enter in the following information:

   Field	Description
   Authority	The system being used for Single Sign On. Choose Okta.
   Subdomain	This will be the same as mySubdomain. Not the entire redirect URI.
   Authorization Server	Refer to the URL you use for your Okta account. Your Authorization Server will be the base URL. For example: https://<yourcompany>.okta.com
   OIDC clientID	This will be the same as the Client ID field in the settings of your Okta app integration.
   Server-Side Authorization (Optional)	Toggle on to add an authorization URL. Use this when the authorization server blocks access to the OpenID configuration or token endpoints.
   Authorization Endpoint (Available with Server-Side Authorization )	The authorization URL to redirect to.

   

5. Once you've filled out the SSO settings in Coalesce, click Save.

6. Log out of Coalesce.

7. Go to your SSO URL, which will be formatted like - https://mySubdomain.<app_domain> - and click on the Use Single Sign-On button to log in using SSO.

If instead of a button you see an error message, check to make sure you correctly entered all the fields in your Coalesce SSO settings. If the problem persists please reach out to our Support Team.

Duplicate Accounts After SSO Setup

Seperate SSO Account Creation

The creation of a separate SSO account is expected behavior and does not affect your existing basic auth account's permissions.

When you first authenticate using SSO in Coalesce, the system creates a new SSO account separate from your existing basic authentication account. This new SSO account is automatically assigned Org Member permissions by default.

If you previously had admin permissions through your basic auth account, you'll need to update the permissions for your new SSO account. To do this:

1. Log in using your basic authentication credentials.
2. Update the permissions for your SSO account.
3. If you don't have admin access, contact your organization's admin to update the permissions.