Skip to main content
For the complete documentation index for agents and LLMs, see llms.txt.

Set Up SSO for Okta

Connect Okta as an SSO identity provider so your team signs in to Haystack Enterprise Platform with their Okta accounts.

About This Task​

Okta connects through OIDC. For the email-claim, discovery-document, and client-secret requirements, see Set Up OIDC.

Prerequisites​

Before you start, review the requirements and preconditions in Enable Single Sign-On (SSO).

Set Up the Connection​

  1. In Haystack Enterprise Platform, go to Settings > Organization > SSO and click Add SSO connection.
  2. Select Okta.
  3. Type a display name for the connection, for example Okta. The display name must be unique in your organization.
  4. Enter your Okta domain in the Okta domain field. This is your Okta organization URL without the https:// prefix, for example your-org.okta.com.
  5. Paste the client ID and client secret from your Okta application into the Client ID and Client secret fields. The secret is stored encrypted and never shown again.

Once you've filled in the provider-specific fields, finish and test the connection:

  1. Add your corporate domains to the Email domains field. At least one domain is required.
  2. Click the toggle to enable the connection.
  3. Click Test connection to check that your provider's endpoint exists and responds. A successful connection means the address is reachable, not that sign-in works. It doesn't verify credentials, certificates, or claim mappings.
  4. Click Save.

Verify the Connection​

To confirm your SSO connection works end to end, check the following:

  • You have invited the pilot user to Haystack Enterprise Platform, and their email matches what your provider sends.
  • The pilot user is assigned to the application in your provider.
  • When you open Haystack Enterprise Platform in a private browsing window and enter the pilot user's email address, you're redirected to your provider, and after authenticating, you land back in Haystack Enterprise Platform, signed in.
  • You repeated the process with a different browser to confirm.

What To Do Next​