Okta single sign-on

Plans and permissions:

• Set up Okta sign-in for your company: Admin role
• Add people who sign in with Okta: Admin or Manager role, or a custom role with Manage team set to Create, edit, or delete any person or Create, edit, or delete certain people
• Sign in with Okta: Any role
• You also need administrator access to your Okta organization.

Use Okta single sign-on (SSO) so your team signs in to Assembled with their Okta account. Okta is your identity provider (IdP): when someone signs in to Assembled without an active session, Assembled sends them to Okta to sign in. You set it up together with our team, using the Assembled app in the Okta app catalog.

This article covers the Okta app, which uses OpenID Connect (OIDC). To connect Okta with SAML instead, see Use SAML with Okta. To create and deactivate Assembled accounts from Okta, see SCIM provisioning.

Before you start

You need:

• Access to your company’s Okta organization, as an Okta administrator.
• An Assembled account for your company. If you don’t have one yet, contact our team to set up your first account.

Set up Okta sign-in

Add Assembled in Okta

1. Sign in to your Okta Admin Console.
2. Go to Applications > Applications > Browse App Catalog, search for Assembled, and add it.
3. Enter an Application label. This is the name the app has on your team’s Okta dashboard. Then select Done.
4. On the app’s Sign On tab, copy the Client ID and Client secret.
5. Find your Okta domain, the address you use to open your Okta organization, such as https://example.okta.com. Remove everything after okta.com.
6. Send the Client ID, Client secret, and Okta domain to our team securely. We’ll let you know when the integration is configured.
7. Check the app’s authentication policy, and make sure the right policy applies to the Assembled app.
8. Assign the people or groups who should use Assembled to the app.

Add a sign-in tile to the Okta dashboard

The Assembled app’s own tile in Okta doesn’t sign people in to Assembled. To let your team open Assembled from their Okta dashboard, create a bookmark app that points to:

https://app.assembledhq.com/api/okta/login?company_name=YOUR_COMPANY_NAME

Replace YOUR_COMPANY_NAME with your company name in Assembled, written in a URL-friendly format. For example, spaces become plus signs, so “My Company” becomes my+company. Some other special characters, such as apostrophes, need to be encoded too. For how to create a bookmark app, see Okta’s guide to bookmark apps.

Add people who sign in with Okta

Okta sign-in is on for everyone in your company once it’s configured, but each person needs an Assembled account before their first sign-in. Assigning someone to the Assembled app in Okta doesn’t create their account.

• Your first account: contact our team, with the name and email address of the person who’ll be your first admin.
• Everyone else: add them in Manage team > People management, one at a time, from a CSV file, or from a connected platform. See People management.

When you add people who sign in with Okta, leave Send this person an invitation email to sign up unselected, because they don’t need an Assembled password.

Their email address in Assembled must match the email address in their Okta account. Once they’re added, they can sign in with Okta.

Sign in with Okta

1. Go to the Assembled sign-in page, at https://app.assembledhq.com/login.
2. Select Sign in with Okta.
3. Enter your Company name, as our team gave it to you, and select Sign in.

Assembled remembers the company name on that browser for next time. People can also sign in from the tile on their Okta dashboard.

To require Okta sign-in for everyone, so people can’t sign in with a password or another method, contact our team.

Use SAML with Okta

You can also connect Okta to Assembled with SAML. Follow SAML single sign-on, and add Assembled to Okta as a SAML application. With SAML, people sign in from the Assembled sign-in page with Sign in with SAML SSO.

To let your team start from their Okta dashboard with SAML, create a bookmark app that points to https://app.assembledhq.com/login/saml. To sign in straight from the Assembled app in Okta instead, contact our team to turn on sign-in from your IdP.