Okta configuration

For Okta, we strongly recommend that you use the Okta PKCE authorization flow.

Setting up the application in Okta

To enable Okta as your SSO provider for Tonic Textual, you first complete the following configuration steps within Okta:

1. Create a new application. Choose the OIDC - OpenId Connect method with the Single-Page Application option.

Create a new app integration

1. Click Next, then fill out the fields with the values below:

   • App integration name: The name to use for the Textual application. For example, Textual, Textual-Prod, Textual-Dev.

   • Grant type: To use the recommended Okta PKCE authorization flow, under Core Grants, check Authorization Code and Refresh Token. To instead use the legacy implicit authorization flow, expand Advanced, then under Other grants, check Implicit (Hybrid).

   • Sign-in redirect URIs: For self-hosted instances, <base-url>/sso/callback/okta. For Textual Cloud, on the Permission Settings page, the sign-in redirect URL is displayed on the Single Sign-On tab. Copy the value from there and paste it into the field.

   • Base URIs: The URL to your Textual instance.

   • Controlled access: Configure as needed to limit Textual access to the appropriate users.

App integration settings

1. After saving the above, navigate to the General Settings page for the application and make the following changes:

   • Grant type: If you are using the recommended Okta PKCE authorization flow, check Authorization Code and Refresh Token. To instead use the implicit authorization flow, check Implicit (Hybrid) and Allow ID Token with implicit grant type.

   • Login initiated by: Either Okta or App

   • Application visibility: Check Display application icon to users

   • Initiate login URI: <base-url>

Application settings

Login settings

Getting the required values for the Textual configuration

When you enable SSO in Textual, you must provide values from the configuration in Okta.

In Okta, make a note of the following values that must be provided to Textual:

• Application client ID:

  

• Your Okta domain (for example, tonic.okta.com). How to get your Okta domain.

• Server ID (If you created a custom authorization server for Textual):

  

• IdP ID (If you use an outside identity provider):