Okta SSO Configuration
for VeriKnox

Configure Okta single sign-on

Let your team sign in to VeriKnox Hub using their organization’s Okta credentials. Okta authenticates the user; VeriKnox applies the user’s existing tenant membership, role, and site access.

• Sign-in initiated from VeriKnox Hub.
• Authentication through your organization’s Okta account.
• Access governed by existing VeriKnox permissions.

Prerequisites

• An Okta administrator account with permission to add applications and assign users.
• A VeriKnox Tenant Admin account for your organization.
• A VeriKnox subscription with SSO enabled.
• Matching email addresses for each user in Okta and VeriKnox.

Supported Features

• SP-initiated Single Sign-On (SSO) using OpenID Connect (OIDC): users start at VeriKnox Hub and authenticate through their organization’s Okta account.

Limitations

• Just-in-Time (JIT) provisioning is not supported. Create or invite users in VeriKnox before they sign in through Okta.
• IdP-initiated sign-in is not supported by this integration. Start sign-in from VeriKnox Hub rather than an Okta dashboard tile.
• This guide covers OIDC SSO only. SCIM provisioning, group-to-role synchronization, and Single Logout are not included in this integration.
• VeriKnox roles, tenant membership, and site access are managed in VeriKnox.

Configuration Steps

Complete the following steps to connect your Okta application instance to your VeriKnox tenant. Each customer uses their own Okta organization URL, Client ID, and client secret.

Add VeriKnox in Okta

1. In the Okta Admin Console, open Applications → Applications.
2. Select Browse App Catalog and search for VeriKnox.
3. Select the VeriKnox integration, then click Add Integration and follow the prompts.
4. Open the application’s Sign On tab. Copy the Client ID and Client secret for the next step.

These catalog installation steps apply once the VeriKnox integration is published in the Okta Integration Network. If it is not available in your catalog, contact your VeriKnox administrator for assisted setup.

Configure SSO in VeriKnox

Sign in to VeriKnox Hub as a Tenant Admin. Open Settings, locate the SSO configuration, and enable SSO.

Use the Okta organization URL without -admin. This integration uses the org authorization server; do not append /oauth2/default.

Save the configuration. Each VeriKnox tenant must use the issuer and credentials for its own organization’s Okta application instance.

Set up user access

1. In Okta, open the VeriKnox application’s Assignments tab and assign the people or groups that should have access.
2. In VeriKnox, create or invite each user into the appropriate tenant.
3. Set the user’s authentication source to SSO or Local + SSO.
4. Assign the appropriate VeriKnox role and site access.

Assigning an Okta group grants access to the Okta application. It does not automatically create VeriKnox accounts or assign VeriKnox roles.

SP-Initiated SSO

Service Provider (SP)-initiated SSO starts from the VeriKnox login page. Follow these steps to sign in and verify the configuration.

1. Open hub.veriknox.ai in a private browser window.
2. Enter the email associated with your VeriKnox account and select the SSO sign-in option.
3. Authenticate with the matching Okta account.
4. Confirm that you return to the correct VeriKnox tenant with the expected access.

If you have multiple Okta accounts, make sure the account you authenticate with matches the email you entered in VeriKnox.

Troubleshooting

Access denied after Okta sign-in

Check which Okta account you used. Its profile email must match the VeriKnox account in the tenant where you started SSO. Confirm that the user’s role allows access to VeriKnox Hub.

SSO login is not enabled for this account

In VeriKnox, set the user’s authentication source to SSO or Local + SSO and save the changes.

User is not assigned to the application

Assign the user to the VeriKnox application in Okta, either directly or through an assigned group.

Redirect URI error

The allowed sign-in redirect URI must exactly match https://hub.veriknox.ai/v1/auth/sso/callback.

Client authentication error

Verify the issuer, Client ID, and client secret. All must belong to the correct Okta organization and application instance. If the error persists, ask your VeriKnox administrator to verify the token endpoint authentication method.

Workspace cannot be determined

Enter the email of an existing VeriKnox account when starting SSO. Confirm that the account belongs to the intended tenant.