Administrators can connect Salesforce with Okta using OpenID Connect (OIDC) to enable Single Sign-On (SSO) for users. Configuring Okta as an OIDC Identity Provider (IdP) and configuring the authentication provider details in Salesforce establishes this connection.

• Okta Classic Engine
• Okta Identity Engine (OIE)
• Salesforce
• OpenID Connect

What are the prerequisites for the Salesforce integration?

Review the Salesforce environment to ensure it meets the necessary edition and permission requirements before configuring the integration.

1. Verify the Salesforce tenant has an Enterprise, Performance, Unlimited, or Developer edition.
2. Ensure the Salesforce account has permissions to view Setup and Configuration.
3. Ensure the Salesforce account has permissions to edit Customize Applications and Manage Auth. Providers.

Configure Okta as an OpenID Connect Identity Provider

Create the OpenID Connect application in the Okta Admin Console and gather the client credentials required for the Salesforce authentication provider.

1. Navigate to the Okta Admin Console.
2. Go to Applications > Applications and select Add Application, then Create New App.
3. Select Web for the Platform and OpenID Connect for the Sign on method.
4. Enter Salesforce OpenID Connect SSO in the Name field.
5. Enter http://placeholder in the Sign-in redirect URIs field.
6. Click Save.
7. Navigate to the Assignments tab and assign the application to the appropriate users or groups.
8. Navigate to the General tab, scroll to the Client Credentials section, and copy the Client ID and Client Secret.

What steps configure the authentication provider in Salesforce?

Configure the authentication provider in Salesforce using the Okta client credentials and endpoint URLs to establish the connection.

1. Log in to the Salesforce administrator interface.
2. Navigate to Identity > Auth. Provider and select New.
3. Select Open ID Connect for the Provider Type.
4. Enter Okta in the Name and URL Suffix fields.
5. Paste the copied Client ID into the Consumer Key field.
6. Paste the copied Client Secret into the Consumer Secret field.
7. Enter https://<oktaorg>.okta.com/oauth2/v1/authorize in the Authorize Endpoint URL field, replacing <oktaorg>.okta.com with the Okta organization URL (for example, <company>.okta.com).
8. Enter https://<oktaorg>.okta.com/oauth2/v1/token in the Token Endpoint URL field.
9. Enter https://<oktaorg>.okta.com/oauth2/v1/userinfo in the User Info Endpoint URL field.
10. Enter openid in the Default scopes field.
11. Select the Send access token in header checkbox.
12. Clear the Send client credentials in header checkbox.
13. Configure the Registration Handler and Execute Registration As fields to manage Just-In-Time (JIT) user creation.
14. Click Save.
15. Copy the Callback URL and OAuth-Only Initialization URL from the Salesforce Configuration page.

Finalize the Okta Application Configuration

Update the Okta application with the Salesforce callback URL and test the initialization to complete the integration.

1. In the Okta Admin Console, navigate to Applications > Applications and select the Salesforce OpenID Connect SSO application.
2. Navigate to the General tab and click Edit in the General Settings section.
3. Paste the copied Callback URL into the Login redirect URIs field.
4. Click Save.
5. Sign out of Salesforce and access the copied OAuth-Only Initialization URL to verify the configuration.

Related References

• Configure an Authentication Provider Using OpenID Connect