SSO Setup for Okta

This article provides instructions on configuring GAS SSO with Okta. The instructions are broken down into three main steps:

1. Create a new app integration for Grand Avenue in Okta

2. Configure the necessary settings for the Grand Avenue integration in Okta

3. Enable and configure SSO in Grand Avenue

After enabling SSO in Grande Avenue, you can use the Administrative Update of Authentication Information for User to update the authentication method for multiple users at once. This update is available from Manage Users → Administrative Update of Authentication Information for Users.

 Instructions

1. First register your Grand Avenue instance in your external identity provider and authorize it for the operations it needs for SSO.

   1. Log into Okta admin console

   2. Select APPLICATIONS

   3. Create a new App Integration with the following selections:

      Open

      

       

   4. Complete the fields to register Grand Avenue.

      Open

      

      Set the App integration name to your preferred name.

      The sign-in redirect URI can be found in Grand Avenue from Configure Authentication Management → Configure Single Sign On

      
      You should register the Redirect URIs for all Grand Avenue instances with users that will need to authenticate against your SSO provider. For hosted Grand Avenue customers, this will include each of your sites:

      1. Production - https://<customername>/GrandAvenue/Authentication/authorization-code/callback

      2. Training - https://<customername>/Training/Authentication/authorization-code/callback

      3. Upgrade - https://<customername>/Upgrade/Authentication/authorization-code/callback

      4. Evaluation - https://eval.grandavenue.com/<customername>/Authentication/authorization-code/callback

2. Configure the necessary settings for the Grand Avenue registration in Okta

   1. Under General ensure “Client authentication” is set to “Public key / Private key” and “Proof Key for Code Exchange (PKCE)” is set to “Require PKCE as additional verification”.

       

   2. Select Save for “Existing client secrets will no longer be used”

       

       

   3. Add a public key

       

3. Add information to Grand Avenue. Navigate to the “Configure Single Sign On” via Configure Authentication Management → Configure Single Sign On

   1. Change the Single Sign On Enabled? dropdown to “Yes”

   2. Complete the required fields and click Save.

      1. The Provider Name entered here will be displayed to users on the Sign In page as "Sign in with <provider name>" (e.g., "Sign in with Okta")

      2. The other fields must be populated with information from the Grand Avenue registration you created above.