How to configure Okta SSO with ISMSVision

This guide explains how to connect Okta as an OpenID Connect (OIDC) identity provider for ISMSVision. After setup, users can sign in with corporate credentials from the platform login page.

Prerequisites

• An Okta org (Integrator or production) with permission to create app integrations
• ISMSVision tenant admin access to Settings → Catalog → Okta
• Platform users already created in ISMSVision with matching email addresses

Integration URLs

Use the URLs for your environment when configuring the Okta application or Okta Integration Network (OIN) listing.

Production

Setting	URL
Sign-in redirect URI	https://api.ismsvision.com/authentication/oidc/callback
Initiate login URI	https://ismsvision.com/#/login
Post-logout redirect URI	https://ismsvision.com/#/login
Global token revocation endpoint	https://api.ismsvision.com/authentication/oidc/global-token-revocation

Staging (testing)

Setting	URL
Sign-in redirect URI	https://api.staging.ismsvision.com/authentication/oidc/callback
Initiate login URI	https://staging.ismsvision.com/#/login
Post-logout redirect URI	https://staging.ismsvision.com/#/login
Global token revocation endpoint	https://api.staging.ismsvision.com/authentication/oidc/global-token-revocation

Step 1 — Create the Okta OIDC application

1. In Okta Admin, go to Applications → Create App Integration.
2. Choose OIDC — OpenID Connect and Web Application.
3. Set the Sign-in redirect URI from the table above for your environment.
4. Set the Sign-out redirect URI (post-logout) from the table above.
5. Set the Initiate login URI if prompted (Okta dashboard launch).
6. Grant type: Authorization Code. Scopes: openid, profile, email.
7. Assign users or groups who should access ISMSVision.
8. Save and copy the Client ID, Client secret, and Okta domain (e.g. https://dev-12345678.okta.com).

Step 2 — Configure universal logout (OIN / enterprise)

If you are publishing an Okta Integration Network listing or enabling Universal Logout:

• Global token revocation endpoint: use the API URL from the table above.
• Authentication method: SIGNED_JWT
• Subject format: Email

When Okta sends a logout signal, ISMSVision invalidates the user’s platform session cookie by clearing the stored access token for that user.

Step 3 — Configure ISMSVision

1. Sign in as a tenant administrator with catalog access.
2. Open Settings → Catalog → Okta.
3. Enter your Okta org URL, Client ID, and Client secret.
4. Leave Authorization server as default unless you use a custom authorization server.
5. Enable Okta sign-in for this tenant and save.

Step 4 — Match users by email

OIDC sign-in links Okta identity to an existing ISMSVision user by email address. Users are not auto-provisioned on first login. Ensure each Okta user’s email matches a verified platform account in your tenant.

Step 5 — Test sign-in

1. Open your ISMSVision login page (staging or production — not localhost for cookie-based SSO).
2. Enter your platform email address. When OIDC is enabled, Sign in with Okta appears.
3. Complete authentication in Okta. You should return to ISMSVision signed in.

Troubleshooting

• Button does not appear: confirm OIDC is enabled in Catalog → Okta and the email belongs to a platform user.
• User not found after Okta login: email must match an existing ISMSVision user in the same tenant.
• Redirect URI mismatch: the Okta app redirect URI must exactly match the API callback URL for your environment.
• Universal logout: the GTR endpoint URL in Okta must match exactly (no trailing slash or query string).