Okta

Follow this step-by-step guide to configure the integration between Port and Okta.

Port-Okta integration benefits

• Connect to the Port application via an Okta app.
• Your Okta teams will be synced with Port, automatically upon user sign-in.
• Set granular permissions on Port according to your Okta groups.

Create a new Okta application

1. In the Admin Console, go to Applications -> Applications.

2. Click Create App Integration.

   

3. Create an OIDC app integration. Select OIDC - OpenID Connect in the Wizard.

   

4. Choose Single-Page application as your application type.

   

   Click Next.

Configure your Okta application

Under General Settings:

1. Choose an app integration name (a specific name that will appear on your Okta apps).

2. Under Grant type mark all options.

3. Under Sign-in redirect URIs, choose the value that matches your Port region:

   • EU organizations: https://auth.getport.io/login/callback

   • US organizations: https://auth.us.getport.io/login/callback

     Redirect URI must match your region

     Using the EU callback for a US-hosted org (or vice versa) causes a 400 error during the Okta sign-in flow. Double-check the value before saving.

   • The Sign-in redirect URI is where Okta sends the authentication response and ID token for the sign-in request.

4. Remove the sign-out redirect URIs.

5. Under Assignments: Set Allow everyone in your organization to access.

   

Configure OIDC settings

Get your Okta Domain by clicking on your user mail at the top-right corner of the Okta management interface, hovering on the okta domain (will be in the format {YOUR_COMPANY_NAME}.okta.com) and clicking on Copy to clipboard:

Under General tab:

1. Copy the Client ID and add it in the Configure Connection section of the self-serve SSO setup flow, along with the Okta Domain from the previous step.

   

2. Click on the Edit button on the General Settings tab.

   • Set the Login initiated by option to Either Okta or App:

     

   • Check all the options in Application visibility:

     

   • Check Login flow to be Redirect to app to initiate login (OIDC Compliant)

   • Under initiate login URI paste the following URI:

     Set authorization endpoint based on account region

     Port exposes two API instances, one for the EU region and one for the US region. Use the correct endpoint based on your account region, replacing company-<companyID>-SSO with your actual connection name.

     To find your connection name: open the Credentials modal, go to the Organization tab, and copy the Company ID. Use only the ID portion. For example, if your Company ID is company_123456789, your connection name is company-123456789-SSO.

     EU

     https://auth.getport.io/authorize?response_type=token&client_id=96IeqL36Q0UIBxIfV1oqOkDWU6UslfDj&connection=company-<companyID>-SSO&redirect_uri=https%3A%2F%2Fapp.port.io

     US

     https://auth.us.getport.io/authorize?response_type=token&client_id=4lHUry3Gkds317lQ3JcgABh0JPbT3rWx&connection=company-<companyID>-SSO&redirect_uri=https%3A%2F%2Fapp.us.port.io

     

   • Click Save and you’re done! now you’ll have the Port app on your Okta dashboard.

     

Direct access via URL

After configuring the SSO connection, you can initiate the login flow directly via URL. Use the following URL based on your account region, replacing company-<companyID>-SSO with your actual connection name. You can find your connection name in the Single Sign-On URL shown during the self-serve SSO setup flow - look for the connection parameter in the URL.

EU

https://auth.getport.io/authorize?response_type=token&client_id=96IeqL36Q0UIBxIfV1oqOkDWU6UslfDj&connection=company-<companyID>-SSO&redirect_uri=https%3A%2F%2Fapp.port.io

US

https://auth.us.getport.io/authorize?response_type=token&client_id=4lHUry3Gkds317lQ3JcgABh0JPbT3rWx&connection=company-<companyID>-SSO&redirect_uri=https%3A%2F%2Fapp.us.port.io

Pull Okta groups into Port

Optional step

This stage is OPTIONAL and is required only if you wish to pull all of your Okta groups into Port inherently.

Benefit: managing permissions and user access on Port.
Outcome: for every user that logs in, we will automatically get their associated Okta groups, according to your definition in the settings below.

To allow automatic Okta group support in Port, you need to add a groups claim to the OpenID Connect ID Token for your Port application in Okta.

Follow the steps in Okta's official guide: Add a groups claim for the org authorization server

When configuring the claim, use these values:

Setting	Value
Groups claim type	Filter
Groups claim filter name	groups
Filter	Matches regex with value .* (to import all groups), or a more specific filter to match only the groups you need