Okta Auth Module
The Okta authentication module is a pre-configured OAuth 2.0 auth module that lets users log in to Hub and any connected service with their Okta credentials.
Okta supports two protocols for handling federated single sign-on, both of which are supported for authentication with Hub.
The Okta authentication module supports the OpenID Connect (OIDC) protocol. The settings for this module are preconfigured to support direct connections with the Okta service. With this module, you need to register Hub as a client application in Okta, but everything else relatively easy to set up.
The SAML 2.0 Auth Module supports the SAML protocol. The settings for this module are preconfigured for generic connections with various SAML providers. Additional configuration for SAML authentication with Okta is required.
Your choice of protocol depends mainly on your use case, but OIDC is generally recommended for new integrations.
Enable Okta Authentication
To let users with existing Okta accounts to log in to Hub, enable the authentication module.
This procedure takes place in three steps:
Generate a Redirect URI in Hub. When you create an authentication module, Hub generates a redirect URI to use with the authorization service. This URI identifies the source of each login request.
Generate a Client ID and Secret in Okta. Every login request sent from Hub includes a unique identifier. The ID and secret you store in the authentication module tell the Okta authorization service that each login request is authorized.
Enable the Auth Module in Hub. When you have generated the information Hub uses to authenticate with the Okta authorization service, copy the values into Hub and enable the module.
Generate a Redirect URI in Hub
First, create the Okta authentication module. When you perform this action, Hub generates a redirect URI to use with the authorization service.
To generate a redirect URI in Hub:
In the Access Management section of the Administration menu, select .
From the New Module drop-down list, select Okta.
The Auth Modules page displays the settings for a new Okta authentication module.
Hub generates a redirect URI for you to use in the authorization service.
If the feature is supported by your browser, use the Copy button to copy the redirect URI to your clipboard.
Make sure to update the Redirect URI in the authorization service when you change the base URL of your Hub instance. For example, after migrating data to another Hub service or changing proxy settings.
Generate a Client ID and Secret
The next step is to register the authorized redirect URI for Hub in Okta.
Sign in to your Okta organization with your administrator account.
In the Admin Console go to > .
Click the Create App Integration button.
The Create a new app integration settings are displayed.
For the Sign-in method, select OIDC - OpenID Connect.
For the Application type, select Web Application.
Enter a name for your new web app integration.
Paste the redirect URI from Hub into the Sign-in redirect URIs input field.
If you want to allow access to everyone in your organization or limit access to members of specific groups, select the corresponding option in the Assignments section. You can also choose the option to skip group assignment for now and set it up later.
Click the Save button.
Switch to the General tab
Use the values that are stored as the Client ID and Client secret to enable the authentication module in Hub.
For additional information, please refer to the Okta Help Center.
Enable the Auth Module in Hub
To complete the setup, store the client ID and secret from the authorization service in the Okta auth module.
Copy the Client ID from Okta and paste it into the Client ID input field in Hub.
Copy the Client secret from Okta and paste it into the Client secret input field in Hub.
Configure the optional settings for the authentication module. For more information, see Additional Settings.
Click the Save button to apply the settings.
Click the Enable module button.
The Okta authentication module is enabled.
The icon stored in the Button image setting is added to the login dialog window. Users can click this icon to log in to Hub with their Okta credentials.
The first section of the settings page displays the general settings for the authentication module. Here, you also find the redirect URI that you use to register Hub in the authorization service and the input fields that store the Client ID and Client Secret that are generated in the authorization service.
Displays the type of authorization service that is enabled for third-party authentication in Hub.
Stores the name of the authentication module. Use this setting to distinguish this module from other authentication modules in the Auth Modules list.
Displays the image used for the button that a user clicks to log in to Hub with a their account in the connected authorization service. You can upload a JPG, GIF or PNG file. The image is resized to 48 x 48 pixels automatically.
Displays the authorized redirect URI that is used to register the connection to Hub in the authorization service.
Stores the identifier that the authorization service uses to validate a login request. You generate this value in the authorization service when you configure the authorization settings for a web application and enter an authorized redirect URI.
Stores the secret or password used to validate the client ID. You generate this value in the authorization service together with the client ID.
Saves the value that is used to identify the authentication module when used for extension grants. If a value is provided, Hub will process requests to exchange access tokens that are issued by the authorization service for tokens that grant access to Hub.
To exchange access tokens successfully, the authentication module must be authorized in the third-party authentication service and enabled in Hub.
To learn how to exchange access tokens using the Hub REST API, see Extension Grants.
Authorization Service Endpoints
The settings in this section of the page store the OAuth 2.0 endpoints used by Okta.
For pre-configured OAuth 2.0 modules, the values that are used by the selected authorization service are set automatically.
Stores the endpoint that Hub uses to obtain authorization from the resource owner via user-agent redirection.
Stores the endpoint that Hub uses to exchange an authorization grant for an access token.
Stores the endpoint used to locate profile data for the authenticated user.
The endpoint used to locate the email address of the authenticated user. Use only when the email address is not stored in the user profile.
The endpoint used to locate the binary file that is used as the avatar for the authenticated user. Use only when the avatar isn’t stored directly in the user profile.
When a user profile response object is returned by Okta, values from the specified field paths are copied to the user profile in Hub. Use the following settings to define the endpoint that locates profile data for the authenticated user and map fields that are stored in the authorization service to user accounts in Hub.
For the predefined Okta module, the User ID, Email, Email verification state, Full name, and Groups are set automatically. If you need to modify these values to suit your needs, you can overwrite them.
To specify paths to fields inside nested objects, enter a sequence of segments separated by the slash character (
To reference values that may be stored in more than one location, use the "Elvis operator" (
?:) as a delimiter for multiple paths. With this option, Hub uses the first non-empty value it encounters in the specified field.
Maps to the field that stores the value to copy to the User ID property in Hub.
Maps to the field that stores the value to copy to the Username field in the Hub profile.
This option is available in Hub versions 2023.1.15453 and later.
Maps to the field that stores the value to copy to the Full name field in the Hub profile.
Maps to the field that stores the value to copy to the Email field in the Hub profile.
Email verification state
Maps to the field that stores the value to copy to the verified email property in Hub.
Maps to the field that stores the image to use as the Avatar in the Hub profile.
Image URL pattern
Generates an image URL for avatars that are referenced by an ID. Use the <picture-id> placeholder to reference the field that stores the avatar.
Maps to the attribute that stores group membership assignments in the connected authorization service.
When this value is specified, you can map and sync group memberships in the authorization service with corresponding groups in Hub. For details, see Group Mappings.
The following options are located at the bottom of the page. These settings let you define the request scope and choose how to authenticate with the service.
For the predefined Okta module, the Scope is set automatically. If you need to modify this value to suit your needs, you can overwrite it.
Other options in this section let you manage Hub account creation and group membership and reduce the loss of processing resources consumed by idle connections.
Sets the scope for the access request. Enter a list of scopes, separated by spaces.
Determines how credentials are passed to the authorization service.
Enables creation of Hub accounts for unregistered users who log in with an account that is stored in the connected authorization service. Hub uses the email address to determine whether the user has an existing account.
Determines how Hub sets the verification status of an email address when the authentication service does not return a value for this attribute.
Adds users to a group when they log in with an account that is stored in the connected authorization service. You can select one or more groups. New users that auto-join a group inherit all the permissions assigned to this group.
We recommend that you add users to at least one group. Otherwise, a new user is only granted the permissions that are currently assigned to the All Users group.
Sets the period of time to wait to establish a connection to the authorization service. The default setting is 5000 milliseconds (5 seconds).
Sets the period of time to wait to read and retrieve user profile data from the authorization service. The default setting is 5000 milliseconds (5 seconds).
Links to the Audit Events page in Hub. There, you can view a list of changes that were applied to this authentication module.
On the Group Mappings tab, you can map existing groups in the authorization service to the groups in Hub.
If you want to map groups in Okta to groups in Hub, you need to specify the Groups attribute that stores Okta group memberships in the Field Mapping section of the settings for this auth module. For the predefined Okta module, the Groups attribute and Scope are set automatically.
When group mappings are configured, Hub checks for Okta group memberships when users log in with accounts that are managed in the directory service. Hub performs the following operations for each Okta group that is mapped to a Hub group:
Users who are members of a mapped Okta group and are not members of the mapped Hub group are added to the group in Hub.
Users who are not members of a mapped Okta group and are members of the mapped Hub group are removed from the group in Hub.
Changes to group memberships in the authorization service are only applied in Hub when users log in using their Okta accounts.
You can map multiple Okta groups to a single target group in Hub. You can't map Okta groups to more than one Hub group.
To map group from Okta to a group in Hub:
Open your Okta auth module.
Select the Group Mappings tab.
Click the Add mapping button.
The Add Mapping dialog opens.
Enter the name of the Okta group in the OAuth group name field.
Select a group from the Target group list.
Click the Add button.
The mapping is added to the list.