Configure Single Sign-on (SSO) with Okta

To set up SSO with Okta for Candor, ensure you have:

• An active Okta account.
• A Candor user account.
• Membership in a Candor team.

Supported features

• SP-initiated SSO (Single Sign-On): sign in from Candor's sign in page
• IdP-initiated SSO: sign in from Okta's dashboard

Configuration steps

Integrating Okta SSO with Candor involves two main steps: adding the Candor application to your Okta account and configuring the Candor settings to connect with Okta.

Note: Even after connecting your Candor team to Okta, users can still sign in using Candor's one-off magic link.

Step 1: Add Candor Application to Okta

1. Navigate to the "Applications" page in your Okta account, click on "Browse App Catalog", and search for Candor.

2. In the search results, find Candor and click "Add Integration" to add the Candor application to your account.

3. You will be prompted to provide an Application label (name it "Candor") and decide whether the application should be visible to users or if it should auto-submit credentials with the browser plugin. Choose according to your preference and click "Done". You can modify these settings later if needed.

4. After adding the application, go to "Assignments" to assign the Candor app to your team members or groups, so they'll have permissions to access it.

Step 2: Configure Okta SSO in Candor

1. In a new browser window, log in to your Candor account and navigate to your team space.

2. Access the settings by clicking on the cog icon, and at the bottom of the settings modal, find and click "Link your company Okta account".

3. In the configuration form, input the following details:

• ‍Okta Organization URL: Find this in your Okta dashboard header. It typically follows the format "https://[companyname].okta.com".

• ‍Okta Client ID and Secret: Return to your Okta window and locate the Client ID and Client Secret under the "Sign On" tab of the Candor application settings.

4. Click "Connect to Okta" to establish the connection and enable SSO.

5. Once the connection is established, SSO is enabled for your team. Any Okta user with Candor access can now log in to Candor through SSO.

SP-initiated SSO

Once the configurations steps have been followed, the users of your Okta organization with access to the Candor integration will be able to sign in with Okta from Candor's sign in page too — not just from their Okta dashboard. For doing so, a user should:

1. Visit Candor sign in page.
2. Click the "Sign in with Okta" button
3. Fill in the "Organization url" field with your Okta organization, for example: "https://example.okta.com"
4. Click on "Sign in"
5. Now you'll be redirected to Okta to sign in with your user and password. Enter your Okta credentials and click "Sign in with Okta". If your credentials are valid, you are redirected to the Candor dashboard.

‍