Okta Integration

Prerequisites

Step 1: Create an Okta API Token

1. Log into Okta Admin Console and go to Security → API → Tokens → Create Token
2. Name it StackFlow Integration
3. Copy the token value — it is shown only once
4. Note your Okta domain (e.g., your-org.okta.com)

Step 2: Configure SCIM Provisioning

1. In Okta, go to Applications → Browse App Catalog, search for StackFlow and add the app
2. If StackFlow is not in the catalog, create a custom SCIM app:

SCIM Connector Base URL: https://your-instance.stackflow-tech.com/prod/api/scim/v2
Unique identifier field: userName (email)
Supported provisioning actions: Push New Users, Push Profile Updates, Push Groups, Deactivate Users
Authentication Mode: HTTP Header (Authorization: Bearer <stackflow-scim-token>)

3. In Provisioning → To App, enable: Create Users, Update User Attributes, Deactivate Users

Step 3: Set Up Group Sync

1. In Okta, go to the StackFlow app → Push Groups
2. Add the Okta groups that correspond to StackFlow roles:

Step 4: SSO Bridge Configuration

StackFlow's SSO bridge allows Okta-authenticated users to receive a Cognito JWT without re-entering credentials. The bridge exchanges the Okta OIDC token for a Cognito token:

1. In Okta, create an OIDC app with grant type authorization_code
2. Set the redirect URI to: https://your-instance.stackflow-tech.com/auth/okta/callback
3. Note the Client ID, Client Secret, and Okta domain
4. StackFlow exchanges the Okta token for a Cognito token via the OBO bridge endpoint

Step 5: Connect in StackFlow

1. Navigate to Admin → Integration Hub → Okta → Configure
2. Enter Okta domain, API token, OIDC client ID and secret
3. Configure group-to-role mapping
4. Enable SCIM provisioning toggle
5. Click Save & Test

Field Reference

Testing the Integration

1. In Okta, assign a test user to the StackFlow app and verify the user is created in StackFlow via SCIM
2. Update the user's group in Okta and verify the StackFlow role changes
3. Log into StackFlow using Okta SSO and verify the role claims are correct
4. Unassign the user from the Okta app and verify the StackFlow account is deactivated

Troubleshooting