[{"data":1,"prerenderedAt":838},["ShallowReactive",2],{"navigation_docs":3,"-organizations-okta-sso-setup":264,"-organizations-okta-sso-setup-surround":833},[4,24,44,170],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":23},"Quickstart","i-lucide-rocket","\u002Fgetting-started","01.getting-started",[10,14,18],{"title":11,"path":12,"stem":13},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction",{"title":15,"path":16,"stem":17},"Quick Start","\u002Fgetting-started\u002Fquick-start","01.getting-started\u002F02.quick-start",{"title":19,"path":20,"stem":21,"icon":22},"Local-Only Setup","\u002Fgetting-started\u002Flocal-only-setup","01.getting-started\u002F03.local-only-setup","i-lucide-laptop",false,{"title":25,"icon":26,"path":27,"stem":28,"children":29,"page":23},"Organizations","i-lucide-building","\u002Forganizations","02.organizations",[30,34,39],{"title":31,"path":32,"stem":33,"icon":26},"Overview","\u002Forganizations\u002Foverview","02.organizations\u002F01.overview",{"title":35,"path":36,"stem":37,"icon":38},"Auth Providers","\u002Forganizations\u002Fauthentication-providers","02.organizations\u002F02.authentication-providers","i-lucide-key-round",{"title":40,"path":41,"stem":42,"icon":43},"Okta SSO Setup","\u002Forganizations\u002Fokta-sso-setup","02.organizations\u002F03.okta-sso-setup","i-lucide-shield-check",{"title":45,"icon":46,"path":47,"stem":48,"children":49,"page":23},"Apps","i-lucide-app-window","\u002Fapps","03.apps",[50,67,88,121,130,150,155],{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":23},"Structure","i-lucide-folder-tree","\u002Fapps\u002Fapplication-structure","03.apps\u002F03.application-structure",[56,59,63],{"title":31,"path":57,"stem":58},"\u002Fapps\u002Fapplication-structure\u002Foverview","03.apps\u002F03.application-structure\u002F01.overview",{"title":60,"path":61,"stem":62},"Applications and Projects","\u002Fapps\u002Fapplication-structure\u002Fapplications-and-projects","03.apps\u002F03.application-structure\u002F02.applications-and-projects",{"title":64,"path":65,"stem":66},"Artifact Types","\u002Fapps\u002Fapplication-structure\u002Fartifact-types","03.apps\u002F03.application-structure\u002F03.artifact-types",{"title":68,"icon":69,"path":70,"stem":71,"children":72,"page":23},"Services","i-lucide-network","\u002Fapps\u002Fservices","03.apps\u002F04.services",[73,76,80,84],{"title":31,"path":74,"stem":75},"\u002Fapps\u002Fservices\u002Foverview","03.apps\u002F04.services\u002F01.overview",{"title":77,"path":78,"stem":79},"Publishing Services","\u002Fapps\u002Fservices\u002Fpublishing-services","03.apps\u002F04.services\u002F02.publishing-services",{"title":81,"path":82,"stem":83},"Service Proxies","\u002Fapps\u002Fservices\u002Fservice-proxies","03.apps\u002F04.services\u002F03.service-proxies",{"title":85,"path":86,"stem":87},"Streaming","\u002Fapps\u002Fservices\u002Fstreaming","03.apps\u002F04.services\u002F04.streaming",{"title":89,"icon":90,"path":91,"stem":92,"children":93,"page":23},"Persistence","i-lucide-database","\u002Fapps\u002Fpersistence","03.apps\u002F05.persistence",[94,97,101,105,109,113,117],{"title":31,"path":95,"stem":96},"\u002Fapps\u002Fpersistence\u002Foverview","03.apps\u002F05.persistence\u002F01.overview",{"title":98,"path":99,"stem":100},"Defining Entities","\u002Fapps\u002Fpersistence\u002Fdefining-entities","03.apps\u002F05.persistence\u002F02.defining-entities",{"title":102,"path":103,"stem":104},"Entity Decorators","\u002Fapps\u002Fpersistence\u002Fentity-decorators","03.apps\u002F05.persistence\u002F03.entity-decorators",{"title":106,"path":107,"stem":108},"CRUD Operations","\u002Fapps\u002Fpersistence\u002Fcrud-operations","03.apps\u002F05.persistence\u002F04.crud-operations",{"title":110,"path":111,"stem":112},"Named Queries","\u002Fapps\u002Fpersistence\u002Fnamed-queries","03.apps\u002F05.persistence\u002F05.named-queries",{"title":114,"path":115,"stem":116},"Multi-Tenancy","\u002Fapps\u002Fpersistence\u002Fmulti-tenancy","03.apps\u002F05.persistence\u002F06.multi-tenancy",{"title":118,"path":119,"stem":120},"Migrations","\u002Fapps\u002Fpersistence\u002Fmigrations","03.apps\u002F05.persistence\u002F07.migrations",{"title":122,"icon":43,"path":123,"stem":124,"children":125,"page":23},"Security","\u002Fapps\u002Fsecurity","03.apps\u002F06.security",[126],{"title":127,"path":128,"stem":129,"icon":38},"Authentication","\u002Fapps\u002Fsecurity\u002Fauthentication","03.apps\u002F06.security\u002F01.authentication",{"title":131,"icon":132,"path":133,"stem":134,"children":135,"page":23},"Deployment","i-lucide-cloud-upload","\u002Fapps\u002Fdeployment","03.apps\u002F07.deployment",[136,141,146],{"title":137,"path":138,"stem":139,"icon":140},"Deployment Workflow","\u002Fapps\u002Fdeployment\u002Fworkflow","03.apps\u002F07.deployment\u002F01.workflow","i-lucide-git-branch",{"title":142,"path":143,"stem":144,"icon":145},"Environments","\u002Fapps\u002Fdeployment\u002Fenvironments","03.apps\u002F07.deployment\u002F02.environments","i-lucide-server",{"title":147,"path":148,"stem":149,"icon":6},"Push to Deploy","\u002Fapps\u002Fdeployment\u002Fpush-to-deploy","03.apps\u002F07.deployment\u002F03.push-to-deploy",{"title":151,"path":152,"stem":153,"icon":154},"CLI Reference","\u002Fapps\u002Fcli-reference","03.apps\u002F08.cli-reference","i-lucide-terminal",{"title":156,"icon":157,"path":158,"stem":159,"children":160,"page":23},"Reference","i-lucide-book-open","\u002Fapps\u002Freference","03.apps\u002F09.reference",[161,166],{"title":162,"path":163,"stem":164,"icon":165},"Decorators Reference","\u002Fapps\u002Freference\u002Fdecorators","03.apps\u002F09.reference\u002F01.decorators","i-lucide-at-sign",{"title":167,"path":168,"stem":169,"icon":90},"Migration SQL Grammar","\u002Fapps\u002Freference\u002Fmigration-sql-grammar","03.apps\u002F09.reference\u002F02.migration-sql-grammar",{"title":171,"icon":145,"path":172,"stem":173,"children":174,"page":23},"Kinotic OS","\u002Fplatform","04.platform",[175,180,184,189,193,198,202,207,212,217,222,227,249,254,259],{"title":176,"path":177,"stem":178,"icon":179},"System Architecture","\u002Fplatform\u002Farchitecture","04.platform\u002F01.architecture","i-lucide-boxes",{"title":181,"path":182,"stem":183,"icon":6},"Deployment Guide","\u002Fplatform\u002Fdeployment-guide","04.platform\u002F02.deployment-guide",{"title":185,"path":186,"stem":187,"icon":188},"Configuration","\u002Fplatform\u002Fconfiguration","04.platform\u002F03.configuration","i-lucide-settings",{"title":190,"path":191,"stem":192,"icon":26},"Organization Management","\u002Fplatform\u002Forganization-management","04.platform\u002F04.organization-management",{"title":194,"path":195,"stem":196,"icon":197},"System Security","\u002Fplatform\u002Fsystem-security","04.platform\u002F05.system-security","i-lucide-shield",{"title":199,"path":200,"stem":201,"icon":43},"Defense in Depth","\u002Fplatform\u002Fdefense-in-depth","04.platform\u002F06.defense-in-depth",{"title":203,"path":204,"stem":205,"icon":206},"MCP Tools","\u002Fplatform\u002Fmcp-tools","04.platform\u002F07.mcp-tools","i-lucide-bot",{"title":208,"path":209,"stem":210,"icon":211},"Observability","\u002Fplatform\u002Fobservability","04.platform\u002F08.observability","i-lucide-activity",{"title":213,"path":214,"stem":215,"icon":216},"Contributing","\u002Fplatform\u002Fcontributing","04.platform\u002F09.contributing","i-lucide-git-pull-request",{"title":218,"path":219,"stem":220,"icon":221},"System Migrations","\u002Fplatform\u002Fsystem-migrations","04.platform\u002F10.system-migrations","i-lucide-database-zap",{"title":223,"path":224,"stem":225,"icon":226},"Service Call Liveness","\u002Fplatform\u002Fservice-call-liveness","04.platform\u002F11.service-call-liveness","i-lucide-heart-pulse",{"title":156,"icon":157,"path":228,"stem":229,"children":230,"page":23},"\u002Fplatform\u002Freference","04.platform\u002F12.reference",[231,236,241,245],{"title":232,"path":233,"stem":234,"icon":235},"CRI Format","\u002Fplatform\u002Freference\u002Fcri-format","04.platform\u002F12.reference\u002F01.cri-format","i-lucide-link",{"title":237,"path":238,"stem":239,"icon":240},"Grind Jobs","\u002Fplatform\u002Freference\u002Fgrind-jobs","04.platform\u002F12.reference\u002F02.grind-jobs","i-lucide-workflow",{"title":242,"path":243,"stem":244,"icon":179},"Project Publishing Design","\u002Fplatform\u002Freference\u002Fproject-publishing-design","04.platform\u002F12.reference\u002F03.project-publishing-design",{"title":246,"path":247,"stem":248,"icon":38},"Sign-In Design","\u002Fplatform\u002Freference\u002Fsign-in-design","04.platform\u002F12.reference\u002F04.sign-in-design",{"title":250,"path":251,"stem":252,"icon":253},"Development Server","\u002Fplatform\u002Fdevelopment-server","04.platform\u002F13.development-server","i-lucide-server-cog",{"title":255,"path":256,"stem":257,"icon":258},"Supply Chain Security","\u002Fplatform\u002Fsupply-chain-security","04.platform\u002F14.supply-chain-security","i-lucide-package-check",{"title":260,"path":261,"stem":262,"icon":263},"Enterprise License","\u002Fplatform\u002Fenterprise-license","04.platform\u002F15.enterprise-license","i-lucide-badge-check",{"id":265,"title":40,"body":266,"description":826,"extension":827,"links":828,"meta":829,"navigation":830,"path":41,"seo":831,"stem":42,"__hash__":832},"docs\u002F02.organizations\u002F03.okta-sso-setup.md",{"type":267,"value":268,"toc":816},"minimark",[269,278,281,286,307,311,342,349,355,376,381,406,412,432,437,441,452,466,472,477,481,497,503,509,624,630,636,643,646,666,670,676,682,686,714,720,723,729,735,739,754,761,765],[270,271,272,273,277],"p",{},"This guide connects an Okta org to your Kinotic organization so members can sign in to the Kinotic portal with ",[274,275,276],"strong",{},"Sign in with Okta",".",[270,279,280],{},"The setup goes back and forth once: you create the app in Okta, add the provider in Kinotic, then copy Kinotic's callback URL back into Okta.",[282,283,285],"h2",{"id":284},"prerequisites","Prerequisites",[287,288,289,302],"ul",{},[290,291,292,293,296,297,301],"li",{},"Administrator access to your ",[274,294,295],{},"Okta Admin Console"," (for example ",[298,299,300],"code",{},"https:\u002F\u002Fyourorg-admin.okta.com",").",[290,303,292,304,277],{},[274,305,306],{},"Kinotic organization",[282,308,310],{"id":309},"_1-create-the-app-integration-in-okta","1. Create the app integration in Okta",[312,313,314,324],"ol",{},[290,315,316,317,320,321,277],{},"In the Okta Admin Console, go to ",[274,318,319],{},"Applications > Applications"," and click ",[274,322,323],{},"Create App Integration",[290,325,326,327,330,331,334,335,338,339,277],{},"Select the ",[274,328,329],{},"Classic experience"," tab, choose ",[274,332,333],{},"OIDC - OpenID Connect"," as the sign-in method, and ",[274,336,337],{},"Web Application"," as the application type. Click ",[274,340,341],{},"Next",[270,343,344],{},[345,346],"img",{"alt":347,"src":348},"Create app integration dialog","\u002Fimages\u002Fdocs\u002Fokta\u002F01-create-app-integration.png",[270,350,351],{},[345,352],{"alt":353,"src":354},"OIDC - OpenID Connect and Web Application selected","\u002Fimages\u002Fdocs\u002Fokta\u002F02-oidc-web-application.png",[312,356,358],{"start":357},3,[290,359,360,361,364,365,368,369,372,373,277],{},"Enter an ",[274,362,363],{},"App integration name",", for example ",[298,366,367],{},"Kinotic",", and under ",[274,370,371],{},"Client definition"," choose ",[274,374,375],{},"Use Okta-generated client ID",[270,377,378],{},[345,379],{"alt":363,"src":380},"\u002Fimages\u002Fdocs\u002Fokta\u002F03-app-name.png",[312,382,384,395],{"start":383},4,[290,385,386,387,390,391,394],{},"Under ",[274,388,389],{},"Grant type",", keep ",[274,392,393],{},"Authorization Code"," checked.",[290,396,397,398,401,402,405],{},"Leave ",[274,399,400],{},"Sign-in redirect URIs"," as Okta's placeholder (",[298,403,404],{},"http:\u002F\u002Flocalhost:8080\u002Fauthorization-code\u002Fcallback",") for now. You will replace it with Kinotic's callback URL in step 4.",[270,407,408],{},[345,409],{"alt":410,"src":411},"Grant type and redirect URIs","\u002Fimages\u002Fdocs\u002Fokta\u002F04-grant-type-redirect-uris.png",[312,413,415],{"start":414},6,[290,416,386,417,420,421,424,425,428,429,277],{},[274,418,419],{},"Assignments",", choose ",[274,422,423],{},"Allow everyone in your organization to access",", or ",[274,426,427],{},"Limit access to selected groups"," to restrict who can sign in. Click ",[274,430,431],{},"Save",[270,433,434],{},[345,435],{"alt":419,"src":436},"\u002Fimages\u002Fdocs\u002Fokta\u002F05-assignments.png",[282,438,440],{"id":439},"_2-copy-the-client-credentials","2. Copy the client credentials",[270,442,443,444,447,448,451],{},"On the saved app's ",[274,445,446],{},"General"," tab, find ",[274,449,450],{},"Client Credentials",":",[287,453,454,460],{},[290,455,456,457,277],{},"Copy the ",[274,458,459],{},"Client ID",[290,461,386,462,465],{},[274,463,464],{},"Client Secrets",", use the copy button to copy the secret.",[270,467,468],{},[345,469],{"alt":470,"src":471},"Client credentials","\u002Fimages\u002Fdocs\u002Fokta\u002F06-client-credentials.png",[473,474,476],"alert",{"type":475},"warning","Treat the client secret like a password. Paste it directly into Kinotic; don't share it in chat or screenshots.",[282,478,480],{"id":479},"_3-add-the-provider-in-kinotic","3. Add the provider in Kinotic",[312,482,483],{},[290,484,485,486,489,490,493,494,277],{},"In the Kinotic portal, open ",[274,487,488],{},"Organization settings"," and select the ",[274,491,492],{},"Authentication providers"," tab. Click ",[274,495,496],{},"Add provider",[270,498,499],{},[345,500],{"alt":501,"src":502},"Authentication providers tab","\u002Fimages\u002Fdocs\u002Fokta\u002F07-kinotic-providers-empty.png",[312,504,506],{"start":505},2,[290,507,508],{},"Fill in the form:",[510,511,512,525],"table",{},[513,514,515],"thead",{},[516,517,518,522],"tr",{},[519,520,521],"th",{},"Field",[519,523,524],{},"Value",[526,527,528,541,553,571,580,590,600,610],"tbody",{},[516,529,530,536],{},[531,532,533],"td",{},[274,534,535],{},"Provider",[531,537,538],{},[298,539,540],{},"Okta",[516,542,543,548],{},[531,544,545],{},[274,546,547],{},"Display name",[531,549,550,551],{},"The text on the login button, for example ",[298,552,540],{},[516,554,555,560],{},[531,556,557],{},[274,558,559],{},"Okta domain",[531,561,562,563,566,567,570],{},"Your Okta org domain, for example ",[298,564,565],{},"yourorg.okta.com"," -- no ",[298,568,569],{},"https:\u002F\u002F"," and no path",[516,572,573,577],{},[531,574,575],{},[274,576,459],{},[531,578,579],{},"The client ID from Okta",[516,581,582,587],{},[531,583,584],{},[274,585,586],{},"Client secret",[531,588,589],{},"The client secret from Okta",[516,591,592,597],{},[531,593,594],{},[274,595,596],{},"Public client (no secret)",[531,598,599],{},"Leave unchecked. Check it only for a public client that has no secret",[516,601,602,607],{},[531,603,604],{},[274,605,606],{},"Enabled",[531,608,609],{},"On, so the login page offers this provider",[516,611,612,617],{},[531,613,614],{},[274,615,616],{},"Advanced > Audience",[531,618,619,620,623],{},"Optional. Set it only when the ",[298,621,622],{},"aud"," claim of Okta's tokens is not the client ID",[270,625,626],{},[345,627],{"alt":628,"src":629},"Add provider form","\u002Fimages\u002Fdocs\u002Fokta\u002F08-kinotic-add-provider.png",[270,631,632],{},[345,633],{"alt":634,"src":635},"Advanced section with Audience","\u002Fimages\u002Fdocs\u002Fokta\u002F09-kinotic-add-provider-advanced.png",[312,637,638],{"start":357},[290,639,640,641,277],{},"Click ",[274,642,496],{},[270,644,645],{},"Kinotic creates the configuration and the drawer shows two URLs, each with a copy button:",[287,647,648,657],{},[290,649,650,653,654],{},[274,651,652],{},"Callback URL"," -- ",[298,655,656],{},"https:\u002F\u002F\u003Capi-host>\u002Fapi\u002Fauth\u002Forg\u002Flogin\u002Fsso\u002Fcallback\u002F\u003Cconfig-id>",[290,658,659,653,662,665],{},[274,660,661],{},"Direct sign-in link",[298,663,664],{},"https:\u002F\u002F\u003Capi-host>\u002Fapi\u002Fauth\u002Forg\u002Flogin\u002F\u003Corg>\u002Fstart\u002F\u003Cconfig-id>",", useful for a tile in Okta's app launcher.",[270,667,456,668,277],{},[274,669,652],{},[270,671,672],{},[345,673],{"alt":674,"src":675},"Provider added with callback URL","\u002Fimages\u002Fdocs\u002Fokta\u002F10-kinotic-callback-url.png",[473,677,679,680,277],{"type":678},"info","The configuration id at the end of the callback URL is created on the first save, so the callback URL only exists after you click ",[274,681,496],{},[282,683,685],{"id":684},"_4-register-the-callback-url-in-okta","4. Register the callback URL in Okta",[312,687,688,701,710],{},[290,689,690,691,693,694,697,698,277],{},"Back in Okta, open the app's ",[274,692,446],{}," tab, and click ",[274,695,696],{},"Edit"," on ",[274,699,700],{},"General Settings",[290,702,386,703,706,707,709],{},[274,704,705],{},"LOGIN",", replace the ",[274,708,400],{}," placeholder with the callback URL you copied from Kinotic.",[290,711,640,712,277],{},[274,713,431],{},[270,715,716],{},[345,717],{"alt":718,"src":719},"Sign-in redirect URI saved","\u002Fimages\u002Fdocs\u002Fokta\u002F11-okta-redirect-uri-saved.png",[473,721,722],{"type":475},"Okta matches redirect URIs exactly. Paste the whole callback URL, including the configuration id at the end.",[270,724,725,726,728],{},"The provider now appears as ",[274,727,606],{}," in Kinotic:",[270,730,731],{},[345,732],{"alt":733,"src":734},"Okta provider enabled","\u002Fimages\u002Fdocs\u002Fokta\u002F12-kinotic-provider-enabled.png",[282,736,738],{"id":737},"_5-test-sign-in","5. Test sign-in",[312,740,741,751],{},[290,742,743,744,747,748,750],{},"Open your organization's login page, ",[298,745,746],{},"https:\u002F\u002F\u003Cportal-host>\u002Flogin\u002F\u003Corg>",". It now shows ",[274,749,276],{}," (using your display name).",[290,752,753],{},"Sign in with a user who is assigned to the Okta app.",[270,755,756,757,760],{},"To add more users, create or assign them in Okta (",[274,758,759],{},"Directory > People",", or through the groups assigned to the app).",[282,762,764],{"id":763},"troubleshooting","Troubleshooting",[510,766,767,777],{},[513,768,769],{},[516,770,771,774],{},[519,772,773],{},"Symptom",[519,775,776],{},"Cause and fix",[526,778,779,791,802],{},[516,780,781,788],{},[531,782,783,784,787],{},"Okta shows a ",[298,785,786],{},"redirect_uri"," error",[531,789,790],{},"The sign-in redirect URI in Okta doesn't exactly match Kinotic's callback URL. Copy it again from the provider in Kinotic and replace it in Okta",[516,792,793,796],{},[531,794,795],{},"Okta says the user isn't assigned to the app",[531,797,798,799,801],{},"Assign the user, or a group they belong to, under the app's ",[274,800,419],{}," tab",[516,803,804,807],{},[531,805,806],{},"The login page doesn't show the Okta button",[531,808,809,810,812,813],{},"Check that the provider is ",[274,811,606],{}," under ",[274,814,815],{},"Organization settings > Authentication providers",{"title":817,"searchDepth":505,"depth":505,"links":818},"",[819,820,821,822,823,824,825],{"id":284,"depth":505,"text":285},{"id":309,"depth":505,"text":310},{"id":439,"depth":505,"text":440},{"id":479,"depth":505,"text":480},{"id":684,"depth":505,"text":685},{"id":737,"depth":505,"text":738},{"id":763,"depth":505,"text":764},"Configure Okta as a single sign-on provider for your Kinotic organization.","md",null,{},{"icon":43},{"title":40,"description":826},"XF0Q6xi2IKTyrNavTmPw73mGuxbFsdg87KGmbCYlrIo",[834,836],{"title":35,"path":36,"stem":37,"description":835,"icon":38,"children":-1},"Let your organization's members sign in to the Kinotic portal with your own identity provider.",{"title":31,"path":57,"stem":58,"description":837,"children":-1},"Understand how Kinotic apps are organized -- from organizations down to individual artifacts.",1792934223830]