Okta Single Sign-On (SSO)

Overview

Okta SSO allows your users to sign into Learn Amp using their existing Okta credentials. This eliminates the need for a separate Learn Amp password and provides a seamless, secure authentication experience as part of your broader identity strategy.

With Okta SSO enabled, users simply click "Sign in with Okta" and are authenticated using your organisation's identity provider.

Functionality Breakdown

Learn Amp authenticates users against your Okta organisation using OIDC / OAuth2.

Key Benefits

• Simplified access – one set of credentials for all your applications.

• Enhanced security – make the most of Okta's security features, including multi-factor authentication.

• Centralised control – manage access from your Okta admin console.

• Real-time reporting – monitor authentication events through Okta's security dashboard.

How It Works

1. The user clicks "Sign in with Okta" on the Learn Amp login page.

2. They're redirected to Okta to enter their credentials.

3. Okta validates the user and returns an authentication token.

4. Learn Amp creates or updates the user session.

5. The user is signed into Learn Amp.

💡 Tip: SSO can be used independently of user provisioning. You can enable SSO without automatic user creation — users would need to exist in Learn Amp first.

Note: Okta SSO is for authentication only, and does not support automatic sign-up of new accounts. For automatic user provisioning, see Okta User Provisioning, which now recommends SCIM 2.0.

Pre-requisites

Before setting up Okta SSO, ensure you have:

• Administrator access to your Okta account.

• Administrator access to your Learn Amp account.

• The Okta integration enabled for your account (contact us to request this if you haven't already).

Role Requirements

The following Learn Amp roles can configure Okta SSO:

• Owner – full access to all integration settings.

• Admin – full administrative access to integration settings.

Okta SSO is a self-serve integration — an Owner or Admin can configure it directly in Learn Amp once the Okta app is created.

Quick Start Guide

Step 1: Create the Okta App

1. Sign in to your Okta admin account at okta.com.

2. Navigate to Applications → Applications.

3. Select Create App Integration.

4. Select OIDC – OpenID Connect.

5. Select Web Application, then Next.

Step 2: Configure the App

1. Enter an App Integration Name (e.g. "Learn Amp").

2. Under Client acting on behalf of a user, enable:

   • Authorization Code

   • Refresh Token

   • Implicit (hybrid)

Step 3: Set Redirect URIs

Add the following Sign-in redirect URIs (replace <subdomain> with your Learn Amp subdomain):

Step 4: Configure Assignments

Choose who can access Learn Amp:

• Allow everyone in your organization — all Okta users can sign in.

• Limit access to selected groups — restrict to specific Okta groups.

• Skip for now — configure access later.

Select Save.

Step 5: Connect Learn Amp

1. Sign in to Learn Amp as an Owner or Admin.

2. From the sidebar, select Settings → Integrations → Okta.

3. Copy the Client ID and Client Secret from your Okta app.

4. Enter your Okta domain as the API URL.

5. Select Save, then Connect to Okta.

6. Follow the prompts to authorise the connection.

Note: Okta automatically creates its Learn Amp SSO provider record once the Okta integration is connected — there's no separate provider setup step needed.

Testing SSO

1. Sign out of Learn Amp completely.

2. Navigate to your Learn Amp subdomain URL.

3. Select Sign in with Okta.

4. Enter your Okta credentials.

5. Verify you're signed into Learn Amp successfully.

💡 Tip: test with a non-admin account first to make sure regular users can authenticate correctly.

Optional: Add Learn Amp to Your Okta App Catalog

For the best user experience, add Learn Amp to your Okta dashboard so users can launch it directly:

1. Log into your Okta Admin Console.

2. Navigate to Applications → Applications.

3. Find your Learn Amp app (or add a custom application).

4. Configure it to point to your Learn Amp subdomain login URL.

Configuration Options

Forced SSO

You can configure Learn Amp to require SSO for all users, disabling password-based login. Contact Learn Amp Support to enable this option.

SSO + Password Login

By default, both SSO and password login are available. Users can choose their preferred method.

FAQs

Q: Can users still log in with email and password?
Yes, by default both methods are available. If you want to enforce SSO-only login, contact Learn Amp Support.

Q: What happens if a user doesn't exist in Learn Amp?
They'll see an error. Okta SSO doesn't support automatic sign-up. To automatically create users, enable Okta User Provisioning (SCIM recommended) alongside SSO.

Q: Can I use SSO without user provisioning?
Yes. SSO and User Provisioning are independent features. You can enable SSO alone — users just need to exist in Learn Amp beforehand.

Q: What authentication details do I need from Okta?
You need the Client ID, Client Secret, and your Okta domain (API URL).

Q: Why am I redirected back to Okta in a loop?
This usually indicates a redirect URI mismatch. Verify your URIs in Okta match exactly, including the protocol (https) and subdomain.

Q: Can users access Learn Amp from their Okta dashboard?
Yes. Once you add Learn Amp as an application in Okta, users can click it from their Okta dashboard to be automatically signed in.

Q: Can I customise the Okta login button label?
Yes. Contact Support to set a custom label (e.g. "Login with Company SSO" instead of "Okta").

Troubleshooting