This example shows how to connect MindSalt to an Okta OpenID Connect web application. Okta labels can change, so use the matching setting in the current Admin Console when the wording differs.

Open Security settings #

Browse to Admin System Preferences Settings Security.

Copy the redirect URL from MindSalt #

1. In MindSalt, open Admin, System, then Security.
2. Find the Single Sign-On section.
3. Copy the Login / Redirect URL exactly.
4. Keep the MindSalt page open for the client and issuer values you will enter later.

Create the Okta application #

1. In the Okta Admin Console, open Applications, then Applications.
2. Select Create App Integration.
3. Choose OIDC – OpenID Connect as the sign-in method.
4. Choose Web Application as the application type.
5. Continue to the application settings.
6. Enter a clear application name, such as MindSalt.
7. Add the MindSalt Login / Redirect URL to Sign-in redirect URIs.
8. Choose the users or groups allowed to access the application.
9. Save the application.

Copy the Okta values #

From the saved Okta application, copy:

• Client ID,
• Client Secret,
• and the issuer URL for the authorization server used by the application.

For an Okta organization authorization server, the issuer is typically the organization's Okta URL. A custom authorization server can use a URL that includes its authorization-server identifier. Use the issuer supplied by the Okta administrator for this application.

Store the client secret securely. Do not place it in a ticket, screenshot, or public document.

Enter the Okta values in MindSalt #

1. In MindSalt, turn on Use SSO for logins.
2. Paste the Okta issuer into Base IdP (Issuer) URL.
3. Paste the Okta Client ID.
4. Paste the Okta Client Secret.
5. Save without enforcing SSO.

Assign and test a user #

1. In Okta, assign a non-administrator test user or a test group to the MindSalt application.
2. Confirm that the user's MindSalt account is active and uses the expected identifying email or username.
3. Open a private browser window.
4. Start the MindSalt SSO sign-in flow.
5. Complete Okta authentication.
6. Confirm that the correct user reaches MindSalt with the expected access.

If sign-in fails, compare the redirect URI character for character, verify the issuer, confirm the client secret, and check the Okta assignment before changing MindSalt enforcement.

Enforce SSO after testing #

Return to Configure single sign-on and follow the enforcement steps only after the test user can sign in.

Related articles #

• Configure single sign-on
• Configure sign-in security
• Manage employee access and invitations