Skip to content

Authentication — Okta

Let users sign in to Forra via your Okta tenant.

Prerequisites

  • Administrator access to your Okta tenant.
  • Your organization's Forra domain (e.g., scout.mirego.com).

1. Create the application in Okta

In the Okta admin console, create a new application:

  • Type: OIDC — OpenID Connect
  • Application type: Single-Page Application (SPA)
  • Sign-in redirect URI: https://{your-scout-domain}/okta/login/callback
  • Sign-out redirect URI: https://{your-scout-domain} — optional on Okta's side, but recommended. Without this URI, a signed-out user lands on the Okta sign-in page instead of Forra.
  • Grant types: Authorization Code with PKCE
  • Assignments: assign the groups or users allowed to use Forra

Once the application is created, take note of:

  • Client ID
  • Okta domain (e.g., yourorg.okta.com or yourorg.oktapreview.com)

2. Configure Forra

In Tenant Admin → External Services tab → Authentication Providers section, open the Okta card and enter:

  • Base URL: https://{Okta domain} (e.g., https://yourorg.okta.com)
  • Client ID: {Client ID}

Save.

3. Test and clean up

Sign out and test the connection via Okta. Once validated, remove any other configuration (Auth0, Microsoft, Google) that is no longer used.

Notes

  • No client secret is required: Forra uses the SPA flow with PKCE.
  • For configuration details specific to your Okta tenant (allowed origin domain, scopes), contact the Forra team if needed.