Skip to main content

Connect Okta

note

SSO connectors are available on the enterprise plan and use OpenID Connect (OIDC).

This guide walks through creating an app integration in Okta and adding it to your workspace as an SSO provider. Once connected, the provider can be used to restrict access to your Channels.

How a viewer signs in via Okta once the connector is set up
note

Authorization for Channel SSO happens entirely in Okta. Assign the users or groups who should have access under Assignments, and they'll be automatically authorized to view the Channel as soon as they can sign in — Viostream doesn't apply any further access controls on top of this.

Please note that Okta's admin console changes from time to time — if any of the following steps don't match what you see, consult Okta's documentation or contact Customer Success via the Live Chat for assistance.

Step 1: Create an app integration​

  1. Sign in to your Okta admin console.
  2. Navigate to Applications > Applications.
  3. Click Create App Integration.
  4. Select OIDC - OpenID Connect as the sign-in method and Web Application as the application type, then click Next.
  5. Give the application a name (e.g. Viostream).
  6. Under Sign-in redirect URIs, enter https://id.app.viostream.com/oauth2/callback.
  7. Under Assignments, choose which users or groups should have access.
  8. Click Save.

Step 2: Confirm the required scopes​

Okta includes the openid, profile and email scopes by default for OIDC web applications, so no additional configuration is usually required. You can confirm this under the app's Okta API Scopes or Sign On tab.

Step 3: Collect your credentials​

  1. From the app's General tab, copy the Client ID and Client Secret.
  2. Your Issuer URL is your Okta domain, shown at the top of the admin console (e.g. https://your-org.okta.com). If you're using a custom Authorization Server rather than the Org Authorization Server, use the Issuer shown on that Authorization Server's page under Security > API.

Step 4: Add the provider in Viostream​

  1. Navigate to Connectors in the  Settings page.
  2. Click Connect on the Okta card under Single Sign-On.
  3. Enter your Issuer URL, Client ID, Client Secret and the Email Domain you wish to associate with this provider (e.g. viostream.com).
  4. Click Save.

Your Okta provider is now available to use with your Channels and other features as they become available.

Rotate your Client Secret​

Client secrets should be rotated periodically, or immediately if you suspect a secret has been exposed.

  1. In the Okta admin console, open your app integration and go to the General tab.
  2. Under Client Credentials, click the options menu next to your secret and select Add secret to generate a new one, then copy it.
  3. In Viostream, navigate to Connectors in the  Settings page, open the connected Okta card, and update the Client Secret field with the new value, then click Save.
  4. Once you've confirmed sign-in still works with the new secret, return to Okta and remove the old one.

See also​