# Adding Okta identity provider via OpenID Connect

**URL:** <https://community.easymorph.com/t/adding-okta-identity-provider-via-openid-connect/6819>\
**Category:** Articles\
**Created:** [October 13, 2026, 2:55am UTC](https://community.easymorph.com/t/adding-okta-identity-provider-via-openid-connect/6819 "2026-10-13T02:55:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![oleksii.bespalov](https://community.easymorph.com/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@oleksii.bespalov](https://community.easymorph.com/u/oleksii.bespalov)\
**Post date:** [October 13, 2026, 2:55am UTC](https://community.easymorph.com/t/adding-okta-identity-provider-via-openid-connect/6819/1 "2026-10-13T02:55:57Z")

</div>

# Adding Okta identity provider via OpenID Connect

This article shows how to let users sign in to EasyMorph Hub with their Okta accounts, using an OpenID identity provider. This feature is available starting from version `6.1.0`.

## Prerequisites

You will need:

- administrator access to EasyMorph Hub;
- administrator access to your Okta organization.

The examples below assume the following addresses:

| Service | Example address |
| --- | --- |
| EasyMorph Hub | `http://localhost:6330` |
| Okta organization | `https://<your-org>.okta.com` |
| Okta Admin Console | `https://<your-org>-admin.okta.com` |

## Adding an OpenID identity provider

1. Sign in to the EasyMorph Hub web console as an administrator and go to **Hub administration**.  

2. Go to **Settings** → **Identity providers** and click **Add new**. In the **Add external IDP** dialog, enter a unique **Name** (for example `Okta OpenID`), select **OpenID** as the **Type** , and click **Add**.  

3. In the **Return URL** section, check the address that users open EasyMorph Hub with:

## Creating an app integration in Okta

1. Sign in to the Okta Admin Console. Go to **Applications** → **Applications** and click **Create App Integration**.  

2. Select **OIDC - OpenID Connect** as the **Sign-in method** and **Web Application** as the **Application type**. Click **Next**.  

3. On the **New Web App Integration** page:

4. Okta creates the app and opens its **General** tab. Copy the **Client ID** and the client **Secret**.  

## Finishing the setup in EasyMorph Hub

1. Go back to the identity provider page in EM and fill in the **Authentication via OpenID** section:

2. _(Optional)_ Click **Test** - this verifies that the OpenID configuration is available from the given **Authority URL**.  

3. Turn the provider toggle to **Enabled**.  

Users can now select the new provider on the EasyMorph Hub sign-in page and sign in with their Okta accounts.

## _(Optional)_ Using Okta groups

**Note:** Okta groups are supported starting from EasyMorph Hub version `6.2.0`.

With **Support external groups** set to **Okta groups** , EM treats the user's Okta groups as its user groups. You can then give access to a whole group instead of single users.

EasyMorph Hub reads group names from the `em_groups` claim of the ID token. Okta doesn't add this claim by default. To add it:

1. In the Okta app, go to the **Sign On** tab and click **Add expression** under **Token claims**.  
 ![Sign On tab in Okta](https://community.easymorph.com/uploads/default/original/2X/f/ffca3d4d4530ef3cf8c1180bb868c366e826bd38.png)
2. Next, you can use one of the 2 options:
  1. Enter `em_groups` as the **Name** and the following **Expression** , then click **Save** :

  2. Instead of the expression, you can also use the legacy groups claim. Click **Show legacy configuration** , then **Edit** in **Group Claims**. Keep **Filter** as the **Groups claim type** , enter `em_groups` as the claim name, select **Matches regex** , enter `.*`, and click **Save**. You can also change filter type or regex depending on your setup.  

3. In EasyMorph Hub, check **Support external groups** in the identity provider settings, select **Okta groups** , and click **Save changes**.  
 ![Okta groups in EasyMorph Hub](https://community.easymorph.com/uploads/default/original/2X/b/be814ea2f92debaa7913db6052aa7da9afb35eaf.png)

To give an Okta group access to a space in EasyMorph Hub:

1. Go to **Spaces** , open the space, and go to the **Users & Permissions** tab.
2. Click **Add new user/group** , select **External user group** , select the Okta identity provider, enter the **Okta group name** (for example `Everyone`), and click **Create**. Click **Create** again in the **New group** dialog.  
 ![Adding an Okta group to a space](https://community.easymorph.com/uploads/default/original/2X/7/723e9d1ce9baa37010c7ac4f82719e9fbc0fbe54.png)
3. Assign roles to the new group in the **Access control list** , the same way as for users.

**Note:** groups are matched by name, not by ID. Enter the group name exactly as it is in Okta. Renaming a group will break existing bindings to EasyMorph Hub groups.