Okta user provisioning and single sign-on

This document shows you how to set up user provisioning and single sign-on between an Okta organization and your HowToo account.

The document assumes that you already use Okta in your organization and want to use Okta to allow users to authenticate with HowToo.

Table of contents

• Before you begin
• Create a new app integration
• Configure Okta in HowToo

Before you begin

• Signup for a HowToo account if you don't already have an account.
• If you are using Teams or Basic account, request to upgrade to Pro account, as Okta SSO is only available on our Pro plan.

Create a new app integration

1. Navigate to your Okta admin portal
2. Create a new app integration

Note: You will need to create two new app integrations. One for Learners and one for Creator, Admin and Primary admin user types.

Configure your new app integration (Okta)

1. The sign-in method will need to be OIDC - OpenID Connect
2. The application type will need to be Web Application
3. The grant type will be client credentials and authorization code
4. The Login flow should be set to redirect to app to initiate login
5. The sign-in redirect URLs and sign-out redirect URLs can be found in HowToo when configuring your Okta setup. They should look something like https://yourcompany.howtoo.co/sso/okta/creator....
6. The group assignment should be set to skip
7. Continue to follow the instructions to complete your new application setup
8. Repeat this process to create another application for Learner single sign-on

Configure Okta in HowToo

1. Navigate to your admin dashboard and select 'Integrations'
2. Select 'Configure' to begin setting up your Okta integration
3. You will observe sign-in and sign-out endpoints for both Creator type users and Learner type users.
4. Copy these endpoints as sign-in and sign-out redirect URIs in your Okta account.
   • Sign-in redirect URIs --> Sign-in callback endpoint
   • Sign-out redirect URIs --> Sign-out endpoint
   • Initiate login URI  --> Sign-in initial endpoint
5. Configure your Okta domain, client ID and client secret. These can be found in your Okta app details.
6. Save these changes in both Okta app settings and HowToo configuration.

The difference between Okta for Creators and Okta for Learners

Okta for Creators

• Users assigned as Creators, will need to first be invited to the HowToo platform as Creators. This is because there are limited seats available and therefore auto-provisioning has been disabled. 

Okta for Learners

• Users assigned as Learners will automatically be provisioned in HowToo, meaning you don't have to add them to HowToo.

Adding new users

1. Ensure users are assigned the HowToo application relevant to their role. This will determine if they can create training (Creator users), and/ or launch training (Learners). Note: Creators are also learners, but learners are not creators.

Launching HowToo from Okta

1. If you have followed the above steps, users will be able to view a new application in their 'My Apps' page.
2. When selecting this app they will then be redirected to HowToo