SSO Authentication with Okta
To provide easy and secure access to Action1 console, Action1 enables users to log in using single sign-on (SSO) instead of maintaining Action1-specific user credentials. This section explains how to configure SSO with Okta as an identity provider.
NOTE: Make sure that user accounts in Okta are already created.
Stage 1: Configure App Integration in Okta
- Sign in to Okta console as administrator.
- Navigate to Applications and select Create App Integration.
- Set the sign-in method to OIDC – Open ID Connect and the application type to Web Application.
- Then, in the app integration’s General settings, configure the following:
- In the App integration name, provide a meaningful name, e.g., Action1 Okta App.
- In the Grant type, select Refresh Token. Leave Authorization Code enabled by default.
- Set the Sign-in redirect URIs according to your Action1 region:
- For North America, enter: https://app.action1.com/sso/login
- For Europe, enter: https://app.eu.action1.com/sso/login
- For Australia, enter: https://app.au.action1.com/sso/login
- In the Assignments, set Controlled access to Skip group assignment for now.
- Click Save.
- In Okta console, navigate to the app integration you created to open its properties.
- On the General tab, go to Client Credentials > Proof Key for Code Exchange (PKCE) and select Require PKCE as additional verification.
- Copy Client ID and Secret – you will need them later in Action1 settings.
- Open the Assignments tab, click Assign, and specify users who will use this integration to log in to Action1.
NOTE: These users must already exist in Okta.
- Obtain the Issuer URI.
The Issuer URI uses the base URL of your Okta organization and has the following format:https://{yourOktaDomain}
For example:https://trial-1234567.okta.com
NOTE: Action1 SSO uses your Okta built-in org authorization server, which is provided for every Okta organization at no additional cost. You do not need to create a custom authorization server (Okta API Access Management) for SSO.
To get Issuer URI for built-in org authorization server:
Open your Okta admin console and locate the base URL of your Okta organization in the browser address bar, for example: https://trial-1234567.okta.com
Alternatively, open https://{yourOktaDomain}/.well-known/openid-configuration and copy the value of the "issuer" field as https://{yourOktaDomain} (without /oauth2/...)
NOTE: For more information on authorization settings, see Authorization Servers in Okta documentation.
Stage 2: Enable SSO with Okta in Action1 Console
When you sign up for Action1, you have to create the initial Action1 credentials (without SSO). By default, this initial account has an Enterprise Admin role in Action1. Then you can use this privileged account to invite the existing accounts from your organization’s Okta.
After creating the initial Action1 credentials while signing up, follow these steps to enable Okta SSO:
- Log in to Action1 using your initial Action1 credentials.
Important! Do not click Okta during this login.
- Navigate to the Advanced page and select Identity Provider.
- Select Okta from the list of identity providers.
- Enter Client ID, Client Secret, and Issuer URI of your Okta application (see steps 7-9 from Stage 1 above).
- Keep the scope set to Enterprise.
- Click Save.
With these settings changed, all new Action1 users will use Okta to sign in. To learn how to switch the existing Action1 users to SSO with Okta, see “Switching existing Action1 users to SSO with Okta” section below.
Important! Keep the initial non-SSO Action1 credentials for emergency recovery purposes, in case you lose access to Okta. Store these credentials securely, as they have Enterprise Admin access by default.
Stage 3: Invite Okta Users to Action1
Now you can invite your Okta users to work with Action1, accessing it with their Okta credentials and SSO.
- Open the Action1 console.
- Navigate to the Users & API Credentials page and click +Invite User.
- In the Invite New User dialog, provide the user settings in the dialog displayed, then click Invite.
Switching Existing Action1 Users to SSO with Okta
This procedure explains how to switch your existing Action1 users to SSO with their Okta accounts.
Important! To perform the required steps, an account with the Enterprise admin role in Action1 is required. Make sure you have at least one Enterprise admin present; otherwise, admin account access will be lost. You can also create a secondary Enterprise admin or elevate another user to the Enterprise admin role.
Before you start, make sure these users already exist in Okta. Otherwise, proceed to Okta to create user accounts.
Important! To migrate to SSO with Okta, the Action1 user accounts need first to be deleted. The users will be unable to access Action1 until the process is completed.
- Navigate to the Users & API Credential page in the Action1 console.
- Locate the user account you want to switch to SSO with Okta. If this user has an Action1 role assigned, make sure to revoke this role.
- Select Delete. Alternatively, set the user’s email to non-existent, such as “[email protected]”.
- Invite the user again into Action1 by sending an invite link, as described in the “Stage 3: Invite Okta Users to Action1” section above.
NOTE: After you configure SSO with Okta, users will be logging in to Action1 console with SSO at Okta Login URL shown in the Identity Provider properties:https://app.<region>.action1.com/sso/login/okta/<Action1_OrganizationID>
Using a custom authorization server
Important! The instructions below are applicable only if your organization already uses Okta API Access Management and you specifically require custom scopes, claims, or access policies.
If your organization uses Okta API Access Management, then you will need to obtain the URI of the authorization server you want Action1 to use.
NOTE: A custom authorization server is provided within Okta API Access Management and is available for the Enterprise subscription plan. Typically, it is not required for setting up a standard Action1 SSO.
To get Issuer URI for custom authorization server:
- Open your Okta console and in the navigation sidebar, go to Security | API.
- On the Authorization Servers tab, select your authorization server and copy its Issuer URI.
-
Select this authorization server and navigate to its Access Policies tab.
-
Click Add New Access Policy. Provide its name and description, select to assign it to All clients, and click Create Policy.
- Then select the newly created policy from the list, click Edit, and click Add rule. Provide the rule name and proceed with the default settings to allow access for the assigned users:
Note: You can configure other rule settings (e.g., refresh token time) according to the IT policies implemented in your infrastructure.