> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heygarth.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# SSO with Okta
> Create the Okta OIDC application for G360, collect its credentials, and set up SCIM provisioning.
This page covers **Step 4** (creating the application) and **SCIM setup** for Okta. Everything else — enabling SSO, entering credentials, access policy — is the same for all providers and is covered in [SSO Setup](/g360/sso-setup).
**Copy the callback URL from G360 first.** Go to **Settings → SSO Settings**, turn on **Enable single sign-on**, and copy the read-only **Callback URL** from the Identity Provider section. You paste it into Okta below.
## Create the OIDC application
Console: your Okta **admin** console — the address ending in `-admin`, not the end-user dashboard, which has no Applications menu.
**Applications → Applications → Create App Integration.**
| Field | Value |
| -------------------------- | ----------------------------------------------------------------------------- |
| **Sign-in method** | **OIDC – OpenID Connect** |
| **Application type** | **Web Application** |
| **Grant type** | Authorization Code (the default) |
| **Client authentication** | **Client Secret Post** |
| **Sign-in redirect URIs** | Paste the callback URL from G360 |
| **Sign-out redirect URIs** | Your G360 login page URL (optional) |
| **Controlled access** | **Allow everyone in your organization to access**, or assign a specific group |
Once saved, the app's **General** tab shows these settings back to you in two sections.
**Do not choose "Skip group assignment for now."** It leaves nobody assigned, and Okta then refuses every sign-in with *"You are not allowed to access this app. To request access, contact an admin."*
If you already created the app this way, fix it under the app's **Assignments** tab → **Assign → Assign to People or Groups**.
If you chose **Allow everyone in your organization to access**, the Assignments tab shows *"This app is implicitly assigned to users"* instead of an Assign menu. That is correct — access is already granted org-wide and is governed by your sign-on policies.
## Collect the credentials
From the app's **General** tab, under **Client Credentials**, copy the **Client ID** and **Client secret**.
Use the eye icon to reveal the secret, then the copy icon to take it.
**Treat the secret like a password the moment it is visible.** If a screenshot showing it in the clear is ever shared, generate a new secret and update G360.
## Issuer URL
Use Okta's **org** authorization server:
```text Issuer URL theme={null}
https://.okta.com/.well-known/openid-configuration
```
**Not** `https://.okta.com/oauth2/default/.well-known/openid-configuration`.
The `/oauth2/default` custom authorization server adds an access-policy layer on top of app assignment, and a newly created app is not included in that policy by default. It fails **after a successful login** with *"Policy evaluation failed for this request, please check the policy configurations."* The org authorization server needs no such policy and is all G360 requires.
Paste the URL into a browser and confirm it returns JSON before continuing.
## Next: enter the details in G360
You now have the **Client ID**, **Client Secret** and **Issuer URL**. Return to [Step 5 of the setup guide](/g360/sso-setup#step-5-enter-the-details-in-g360) to enter them, test the connection, and save.
***
## SCIM provisioning
**The application you created for SSO has no Provisioning tab.** Okta does not offer SCIM provisioning on OIDC application integrations at all. SCIM needs a **second, separate application**.
First, [generate a SCIM token in G360](/g360/sso-scim#step-1-generate-a-token-in-g360).
### Add the catalog application
**Applications → Browse App Catalog** → search for **"SCIM 2.0 Test App (OAuth Bearer Token)"** and add it as a second application.
### Configure it
1. Configure its provisioning settings with your **G360 SCIM endpoint** (shown alongside the token in G360's SCIM Provisioning section) and the **raw bearer token** from G360 — no `Bearer` prefix.
2. Confirm the attribute mapped to `userName` is the user's **email address**, not a directory username.
3. Assign the users who need to be provisioned to **this** application, in addition to your SSO application.
This is a generic Okta test connector rather than one purpose-built for G360. Test create, update and deactivate carefully with a real account before relying on it for your rollout.
**Assign every user to both applications.** Someone assigned to the SSO app but not the SCIM app can sign in normally but **will never be deprovisioned when they leave**.
***
## Provider-specific errors
If Okta's own screen shows an error before you're redirected back to G360, the problem is on its side.
| Message | Meaning |
| --------------------------------------------- | ---------------------------------------------------------------------------------------- |
| "You are not allowed to access this app" | The user isn't assigned — or "Skip group assignment" was chosen when the app was created |
| "Policy evaluation failed for this request" | The issuer URL points at `/oauth2/default` instead of the org authorization server |
| "The redirect URI included is not registered" | The callback URL doesn't match exactly, including the trailing slash |
For errors that appear **after** you're back in G360, see [Troubleshooting](/g360/sso-setup#troubleshooting).