Okta OIDC SSO Configuration

Last updated: May 6, 2026

This guide walks through the information you'll need to provide to TeamOhana to configure Single Sign-On (SSO) between your organization's Okta instance and TeamOhana. Once configured, your users will be able to authenticate to TeamOhana using their existing Okta credentials.

Prerequisites

  • Okta access: Administrator privileges in your Okta instance, with permission to create and configure applications

Setup Steps

1. Create the TeamOhana application in Okta

In your Okta admin console, create a new OpenID Connect (OIDC) application for TeamOhana. When prompted for a sign-in redirect URI, use the following login callback URL:

Login Callback URL: https://login.teamohana.us/login/callback

2. Gather the configuration details TeamOhana needs

Once the Okta application is created, collect the following four items and send them to your TeamOhana Implementation Manager. TeamOhana uses these to complete the integration on our side.

  1. Client ID — Found in the general settings of your TeamOhana application in Okta.
    Reference: Find your app credentials

  2. Client Secret — Located alongside the Client ID in your Okta application settings.
    Reference: Find your app credentials

  3. Okta Domain or OpenID Connect (OIDC) Metadata File — Your organization's unique Okta domain (for example, your-company.okta.com) or the OIDC metadata configuration file from your tenant.
    Reference: Find your Okta domain

  4. Email domain(s) to be used for login — The email domain(s) your users will authenticate with (for example, @yourcompany.com). If your team uses multiple domains, please list all of them.

Important: The Client Secret is sensitive credential information. Share it through a secure channel agreed upon with your TeamOhana Implementation Manager — not via standard email or chat. If your organization has a preferred secure transfer method, let your Implementation Manager know.

What Happens Next

Once TeamOhana receives the four items above, our team will complete the SSO configuration on our side. We'll coordinate a brief testing window with you to validate that authentication works end-to-end before enabling SSO for your full user base.

Note: Until SSO is fully tested and enabled, your users can continue to access TeamOhana using their existing login method. SSO is enabled in a controlled rollout to avoid disruption.

Troubleshooting

Users see an error when logging in via Okta

The most common cause is a mismatch between the email domain configured in TeamOhana and the email associated with the user's Okta profile. Confirm the user's Okta email uses one of the domains you provided in step 4 above. If your organization has added a new email domain since the original setup, contact your TeamOhana Implementation Manager to add it.

The Client Secret has been rotated in Okta

If you rotate the Client Secret in Okta for any reason, the existing TeamOhana integration will stop working until the new secret is provided to TeamOhana. Send the updated Client Secret to your Implementation Manager through a secure channel and we'll update the configuration.

Users from a new email domain need access

If your organization adds a new email domain (for example, after an acquisition or rebrand), share the new domain with your TeamOhana Implementation Manager so it can be added to the SSO configuration.