---
title: "Set up SSO authentication with Okta"
description: "Are you using Okta for your identity and user management and want to use it to login to your Data Platform apps"
url: https://docs.ovhcloud.com/it/guides/public-cloud/data-platform/iam-auth-providers-okta
lang: it
lastUpdated: 2026-09-14
---
> For AI agents: the complete documentation index is available at https://docs.ovhcloud.com/it/llms.txt, the full documentation bundle is available at https://docs.ovhcloud.com/it/llms-full.txt.

# Set up SSO authentication with Okta

## Objective

This guide explains how to use [Okta](https://www.okta.com/) to log in to your Data Platform applications.

Open the IAM and click on **Auth. Provider**.

![Auth provider](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/auth_provider.png)
If you haven't done so already, [add a new](https://docs.ovhcloud.com/it/guides/public-cloud/data-platform/iam-auth-providers.md#add-an-authentication-provider) _Okta_ authentication provider on Data Platform. Else, just edit it.

The configuration is done in two parts. First you need to [configure the rights on Okta](#configuration-on-okta) and then [configure the authentication provider in the Data Platform Identity Access Manager](#configuration-on-the-data-platform-identity-access-manager).

## Configuration on Okta

You need to register Data Platform as an application on your Okta environment. Open your Okta environment.

### Step 1. Register the Identity Access Manager on Okta

:::info
Note that the interface of Okta may change over time, and screenshots could be outdated. Please refer to the [Okta documentation portal](https://help.okta.com/en/prod/Content/index.htm) if you are unable to find some of the features listed below.
:::

You need to register an application inside of Okta. This works with any app you would like to connect to Okta but in this case, you are going to register the Data Platform IAM directly.

In the sidebar, select **Applications**. Then click on _Create App Integration_.

![App registration](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-app-registration.png)
Select _OIDC (OpenID Connect)_ as the method and _Web Application_ as the application type.

![App registration](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-app-registration2.png)
Press **Next**.

#### _Callback URL_

Give the name of your choice to this new application and make sure that the Grant Type is _Authorization Code_.

![App registration](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-app-settings.png)
Scroll down to the **Sign-in Redirect URIs** section.

![App registration](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-callback.png)
In the URL field, copy and paste the **Reply URL** field in the new authentication provider you added on Data Platform (it is the same for the entire Data Platform IAM).

![App registration](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-callback2.png)
Save the new application integration.

### Step 2. Retrieve the Domain

The Domain is the equivalent of your tenant id on Okta. You can find it in the General Settings of the application: look for the **Okta domain** section.

![App registration](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-app-domain.png)
:::info
Note that this Domain will be required later on during the IAM configuration.
:::

### Step 3. Retrieve the Client ID

The Client ID is specific to your application. You can find it in the Client Credentials of the application: look for the **Client ID** section.

![App registration](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-app-client.png)
:::info
Note that this Client ID will be required later on during the IAM configuration.
:::

### Step 4. Retrieve the Client Secret

The Client Secret is specific to your application. You can find it in the Client Credentials of the application: look for the **Client secret** section.

![App registration](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-app-secret.png)
:::info
Note that this Client Secret will be required later on during the IAM configuration.
:::

### Summary

If you have properly followed all the previous steps, you should have this list of information.

```
Okta domain (Step 2): xxxxxxxxxx.okta.com
Client ID (Step 3): XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Client secret (Step 4): XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
```

:::info
If you want to further customize the configuration of your new application from the Okta portal, we recommend you check out [Okta's documentation](https://developer.okta.com/).
:::

## Configuration on the Data Platform Identity Access Manager

You now have to configure your new authentication provider in your Data Platform Identity Access Manager.

![Configuration on the Data Platform Identity Access Manager — Okta Identity Access Manager](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-iam.png)
### Fill in the basic information

- **Name / Description**: This is the internal name and description for your new authentication method
- **Directory**: This is a unified tag for all accounts that will be created from this directory. For example, you can input _Okta_
- **Tags**: This offers more tagging options. They are completely optional
- **Reply URL**: This is the Data Platform URL where your authentication provider redirects to
- **Active**: This specifies whether this authentication provider can be used to login or not

![Fill in the basic information — Okta config1](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-config1.png)
### Fill in Okta configuration

Now locate the **Okta Configuration** panel.

![Fill in Okta configuration — Okta config2](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-config2.png)
Fill in the information collected on Okta in the previous section, as such:

- **Domain**: _Okta domain_ (retrieved in [step 2](#step-2-retrieve-the-domain) of the configuration on Okta)
- **Client ID**: _Client ID_ (retrieved in [step 3](#step-3-retrieve-the-client-id) of the configuration on Okta)
- **Client Secret**: _Client secret_ (retrieved in [step 4](#step-4-retrieve-the-client-secret) of the configuration on Okta)
- **Scope**: This represents how much information Data Platform will be able to access from your Okta. This field is optional: the default value is `openid email profile`

### Fill in the bindings rules

The **Bindings** panel allows you to customize the mapping of the fields between Okta and Data Platform.

Email, login, first and last name are mapped by default.

![Fill in the bindings rules — Okta bindings](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-bindings.png)
Bindings can be overriden if you need to save additional information from Okta into your Data Platform Identity Access Manager, like the job title.

The easiest way to configure bindings is to retrieve a response from a login of an user by following these steps:

_1_ - Do a sample login to any Data Platform application using your newly configured Okta authentication provider.\
_2_ - Open the **Log History** page of the IAM authentication provider (here Okta).

![Fill in the bindings rules — Okta logs](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-logs.png)
_3_ - Open the latest log: the original response from Okta will look like this:

```json

{
  "sub": "00u4au2tpeFfNw3uR696",
  "name": "John Smith",
  "email": "jsmith@example.com",
  "ver": 1,
  "iss": "https://example.okta.com",
  "aud": "4j63bjk34b6jk3b",
  "iat": 1634310728,
  "exp": 1634314328,
  "jti": "ID.TRhY73q_LejPMKVxrt936nLTLaayJJgPMni78ww0ouQ",
  "amr": [
    "mfa",
    "pwd",
    "otp"
  ],
  "idp": "00o4au2o4QD29JO5Q696",
  "preferred_username": "jsmith@example.com",
  "auth_time": 1634310281,
  "at_hash": "OExX1fo9d8vq-z2-vZtkIg",
  "user": {
    "sub": "00u4au2tpeEfNw3uR696",
    "name": "John Smith",
    "locale": "en-US",
    "email": "jsmith@example.com",
    "preferred_username": "jsmith@example.com",
    "given_name": "John",
    "family_name": "Smith",
    "zoneinfo": "America/Los_Angeles",
    "updated_at": 1634310506,
    "email_verified": true
  }
}

```

_4_ - On top of the default email, login, first and last name, any additional property from Okta can be saved as a custom `configuration.XXX` field on Data Platform by using the "JSON" mode.

![Fill in the bindings rules — Okta bindings2](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-bindings2.png)
For example, you can add a _fullname_ property on Data Platform from the `name` field from Okta:

```json
{
  "login": "email",
  "email": "email",
  "pronoun": "",
  "firstname": "user.given_name",
  "lastname": "user.family_name",
  "configuration.fullname": "name"
}
```

:::info
Test the result of your bindings by checking the logs of further test connections in Log History: the _Computed Result_ section of each login will show what properties have been saved in Data Platform.
:::

### Custom mappings

The **Custom mappings** panel allows you to automatically assign all users logged in through this authentication provider to a role or a group.

![Custom mappings — Okta custom mapping](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-custom-mapping.png)
[Learn how to set up custom mappings.](https://docs.ovhcloud.com/it/guides/public-cloud/data-platform/iam-auth-providers-custom-mapping.md)

### Set live

You are all set configuring your Okta connector! If you haven't done it already, click on **Create** - else make sure to **Save**.

In the Authentication Providers list, you now see your new method. Make sure you set it as _active_.

![Set live — Auth active okta](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/auth-active-okta.png)
Make sure this new authentication method [is visible](https://docs.ovhcloud.com/it/guides/public-cloud/data-platform/iam-application-authentication.md#display-an-authentication-provider-on-an-application-login-page) for the applications of your choice. You should now see an Okta option on your application's login page. By clicking on it, you will be redirected to the Okta login screen, or directly into the app if you are already logged into your account.

![Set live — Okta final](/images/public-cloud/data-platform/product/iam/project-iam/auth-provider/picts/okta-final.png)
[Make Okta visible on your apps' login page](https://docs.ovhcloud.com/it/guides/public-cloud/data-platform/iam-application-authentication.md#display-an-authentication-provider-on-an-application-login-page)

## Go further

If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://www.ovhcloud.com/it/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project.

Ask questions, give your feedback and interact directly with the team building the Data Platform on the dedicated [Discord channel](https://discord.gg/ovhcloud).

If you need support with your OVHcloud services, create a request in our [Help Centre](https://help.ovhcloud.com/csm?id=csm_get_help).

Join our [community of users](https://community.ovhcloud.com/).