Skip to main content

Okta Integration Guide

Okta is a cloud identity platform. This guide connects Mixpost to Okta for single sign-on using the Generic OIDC provider — no special setup is required on the Mixpost side.

1. Create an OIDC app integration​

  1. Sign in to the Okta Admin Console and go to Applications → Applications → Create App Integration.
  2. Sign-in method: OIDC - OpenID Connect. Application type: Web Application. Click Next.
  3. Name the app (for example Mixpost) and keep Authorization Code checked under Grant type.
  4. Sign-in redirect URIs: the Redirect URI shown on Mixpost's Single Sign-On settings page, e.g. https://mixpost.example.com/mixpost/auth/sso/callback.
  5. Under Assignments, choose who can use the app — everyone in your organization or selected groups only. Okta refuses sign-ins from users the app is not assigned to.
  6. Save, then copy the Client ID and Client Secret from the app's General tab.

2. Configure the connection in Mixpost​

In Admin Console → Settings → Single Sign-On:

  1. Identity provider: Generic OIDC.
  2. Issuer URL: https://<your-org>.okta.com — the Okta org authorization server, which is the right choice for signing in to applications. If you deliberately use a custom authorization server instead, its issuer looks like https://<your-org>.okta.com/oauth2/default.
  3. Paste the Client ID and Client Secret.
  4. Button label: Okta — otherwise the login button reads "Generic OIDC".
  5. Enable single sign-on, Save, then click Test connection — Mixpost should list the discovered endpoints.

Your login page now shows the Sign in with Okta button.

3. Send groups to Mixpost (optional)​

Okta does not include the user's groups in the ID token by default. To use role mapping:

  1. Go to Applications → your app → Sign On tab.
  2. In the OpenID Connect ID Token section, click Edit.
  3. Set Groups claim type to Filter, and the Groups claim filter to groups Matches regex .* — or use Starts with and a prefix (for example mixpost-) to send only the relevant groups.
  4. Save.

The claim name groups matches Mixpost's default Groups claim setting. In Mixpost, add group mapping rows using the Okta group names exactly as they appear (for example Everyone, Marketing Team).

note

If you use a custom authorization server, define the groups claim there instead: Security → API → your authorization server → Claims → Add Claim (name groups, include in ID token, value type Groups).

4. Done​

Sign in with an Okta user assigned to the app to verify the flow end to end. If something fails, the login page shows the reason, and the troubleshooting section covers the common causes.

Client authentication failed?

Mixpost sends the client credentials in the token request body (client_secret_post). Okta apps accept this by default, but if your organization has restricted the app's token endpoint authentication method, set it back to a client-secret method (Okta Apps API, token_endpoint_auth_method).

On this page