How do I set up SSO with Okta?

Connect Okta so your team signs in to Squeezle through it, with either OIDC (simplest) or SAML. Do this as a Squeezle owner or admin under Admin → Authentication; in Okta you need to create app integrations.

Option A: OIDC (recommended)

1. In Squeezle, set Provider to OpenID Connect and copy the read-only Redirect / callback URL: https://api.squeezle.app/auth/sso/<org-slug>/oidc/callback. Self-hosted: use your own API host.
2. In the Okta Admin Console, go to Applications → Applications → Create App Integration. Choose OIDC - OpenID Connect and Web Application. Continue.
3. Under Sign-in redirect URIs, add the Squeezle callback URL from step 1. Under Grant type, keep Authorization Code. Assign access to the right users or groups, then save.
4. On the app's General tab, copy the Client ID and Client secret.
5. Back in Squeezle, enter:
   • Issuer: your Okta org URL, https://<your-okta-domain> (for example https://acme.okta.com).
   • Client ID and Client secret from step 4.
   • Leave Discovery URL (optional) empty. Squeezle reads https://<your-okta-domain>/.well-known/openid-configuration.
   • Scopes: keep openid email profile.
6. Add your domains under Verified email domains, turn on Enable SSO sign-in, and click Save configuration.

Attribute / claim mapping

• email → Okta's email claim. Okta sends email_verified, which Squeezle requires.
• Identity keyed on the sub claim; name and groups are not used.

Verify it works

From the Squeezle sign-in page, start SSO for your organization; Okta authenticates you and returns you signed in. On failure, check that the user is invited to the org and their domain is in Verified email domains.

Option B: SAML

1. In Squeezle, set Provider to SAML 2.0 and copy the read-only URLs:
   • ACS (Assertion Consumer Service) URL: https://api.squeezle.app/auth/sso/<org-slug>/saml/acs
   • SP metadata URL: https://api.squeezle.app/auth/sso/<org-slug>/saml/metadata
   • Self-hosted: use your own API host.
2. In the Okta Admin Console, go to Applications → Create App Integration → SAML 2.0. Name it "Squeezle" and continue.
3. On Configure SAML, set:
   • Single sign-on URL: the Squeezle ACS URL.
   • Audience URI (SP Entity ID): the Squeezle SP metadata URL. Paste this same value into Squeezle's SP entity ID.
   • Name ID format: EmailAddress.
   • Application username: Email.
   • Under Attribute Statements, add name email, value user.email.
4. Finish the wizard. On the app's Sign On tab, open View SAML setup instructions and copy the Identity Provider Single Sign-On URL and the X.509 Certificate.
5. Back in Squeezle, enter:
   • IdP SSO URL: the Identity Provider Single Sign-On URL.
   • IdP signing certificate (PEM or base64): the X.509 Certificate.
   • SP entity ID: the same SP metadata URL used as the Audience URI. Set it explicitly; do not leave it blank.
6. Add your domains under Verified email domains, turn on Enable SSO sign-in, and click Save configuration. In Okta, assign the app to your users.

Attribute / claim mapping

• email → the SAML NameID (EmailAddress) and an attribute named email.
• name, groups → not used by Squeezle.

Verify it works

On the Squeezle sign-in screen, enter your organization under Sign in with SSO. Clicking the Squeezle tile on your Okta end-user dashboard also works, but Squeezle shows a confirmation screen first. On failure, confirm invited membership, verified domains, and that Okta's Audience URI matches Squeezle's SP entity ID.

Then roll out and enforce as in Set up SSO.