LogoLogo
HomepageCase studiesBook a demo
Technical Guide
Technical Guide
  • Introduction
  • Getting Started Guide
    • Authentication
    • Member Registration Configuration
    • Add Webhook
    • Add Member
    • Create Campaign
    • Add Transaction
    • Add Custom Event Schema
    • Create Achievement
    • Add Custom Event
  • Terms Reference
  • Backward Compatibility Policy
  • API Reference
  • Postman Collection
  • User Guide
  • Integration
    • Introduction
    • Overview of Integration Methods
    • Tools and Technologies
    • Integration Examples
      • Lambda
      • Zapier
      • AWS EventBridge
      • Kafka
  • API Fundamentals
    • Overview
    • Environments Capabilities
    • How to Query
    • Limits
    • Best Practices
  • Authentication
    • Admin Token
    • Access Token (API Key)
    • Enabling SSO Login
      • Okta
      • Microsoft Entra ID
  • Webhooks
    • Overview
    • Best Practices
  • S3 Bucket Data exports
    • Overview
    • Set Up S3 Bucket Integration
    • Data Structure and Types
      • Achievements
      • Achievement Usage
      • Campaigns
      • Campaign Calculated Effect Result
      • Campaign Execution
      • Custom Events
      • Members
      • Rewards
      • Rewards Redemption
      • Tiers
      • Transactions
      • Tenants
      • Unit Transfers
Powered by GitBook
On this page
  • Prerequisites
  • Step-by-Step Configuration
  • Verify Settings in Open Loyalty
  • Configure OKTA
  • Share Details with Open Loyalty
  • Notes
  • Troubleshooting

Was this helpful?

  1. Authentication
  2. Enabling SSO Login

Okta

This guide explains how to enable Single Sign-On (SSO) login via Okta in Open Loyalty.

Last updated 27 days ago

Was this helpful?

Prerequisites

Ensure you have the access to the following:

  • An active Open Loyalty instance.

  • Administrator access to your Okta tenant.

  • Basic understanding of OIDC and SSO concepts.

Step-by-Step Configuration

Verify Settings in Open Loyalty

1

Verify Admin Email Addresses

Ensure that the email address you want to use for SSO login does not already exist in the Open Loyalty portal.

If an email address for the admin already exists in Open Loyalty, the SSO login will not function for that account. To enable SSO for a user, ensure there are no conflicts.

For instance, you could deactivate admin users logging in with email and password, update their email addresses by adding a suffix (e.g., "-old"), and then ask the admin users to log in via SSO.

2

Configure the Default Role

  1. Log in to the Open Loyalty admin panel.

  2. Go to Settings > Roles.

  3. Choose the role you want to set as a default role. Click on Edit.

  4. Set a Default Role for new users logging in through SSO. This role will be assigned to newly created users and can be changed later if needed.

Configure OKTA

1

Sign in to Okta Admin Console

Navigate to https://your-domain.okta.com and log in with an administrator account.

2

Create a New Application Integration

  • In the Admin Console, go to Applications > Applications.

  • Click Create App Integration.

  • Choose:

    • Sign-in method: OIDC - OpenID Connect

    • Application type: Single-Page Application

  • Click Next.

3

Configure the Application

  • App integration name: (e.g. Open Loyalty)

  • Sign-in redirect URIs:

    • (or your production redirect URI)

  • Sign-out redirect URIs (optional):

    • https://your-production-domain.com

  • Assign Users to the Application

    • In the Assignments tab of the application, click Assign.

    • Choose Assign to People or Assign to Groups.

    • Select the users or groups who should have access to the application.

  • Click Save.

Share Details with Open Loyalty

1

Share SSO Details with Open Loyalty

  • Provide the Open Loyalty team with the following details:

    • Client ID

    • Sign-in redirect URIs

    • Sign-out redirect URIs

  • The Open Loyalty team will enable SSO using the provided details.

2

Test the Integration

  1. Use the Continue with OIDC button on the login page.

  2. Authenticate with OIDC using a user account.

  3. Verify that the user is successfully logged in and has been assigned the default role.

Notes

  • Ensure that the Default Role is configured appropriately to avoid granting unintended permissions to new users.

  • If an email address already exists in Open Loyalty, the SSO login will not work for that account. Ensure there are no conflicts before enabling SSO for a user.

Troubleshooting

  • If login fails, double-check the URL and Client ID configuration.

  • Ensure the callback URL is correctly set in Okta.

  • Verify that the Okta application has been configured to allow the Open Loyalty URL.

https://your-production-domain.com/login/callback