Okta

1. Create the app integration.

   Applications → Create App Integration → OIDC, application type Single-Page Application. Set the sign-in redirect URI to the portal’s origin.

2. Add the groups claim — it is not present by default.

   Security → API → Authorization Servers → your server → Claims → Add claim:

   Field	Value
   Name	groups
   Include in token type	ID token
   Value type	Groups
   Filter	Matches regex .*, or a tighter filter

   Skipping this step is the single most common Okta problem: sign-in succeeds and nobody has any permissions.

3. Register the provider in Seylo.

   Preset Okta, identifier = your org domain, for example acme.okta.com.

4. Check which issuer actually mints your tokens.

   Authorization server	Issuer
   Custom	https://<org>/oauth2/<id>
   Org	https://<org>

   Use the discovery URL of whichever one mints the tokens your app receives. Registering the wrong one produces unknown-issuer.

5. Set the role claim to groups and map your Okta group names onto Seylo’s four roles. No discriminator is needed — Okta gives one issuer per org.

6. Run test login.

Tip

A regex filter of .* sends every group the user belongs to. In a large directory that can make tokens noticeably larger. Once you know which groups you map, tighten the filter to match just those — for example ^seylo-.

Common problems

Symptom	Cause	Fix
Signs in, no permissions	The groups claim was never added	Add it as in step 2 — and confirm ID token is ticked
unknown-issuer	Org vs custom authorization server mismatch	Compare iss in the test-login report against the registration
Some users map, some do not	Group names differ from the mapped values	The report shows, per value, whether it mapped