> ## Documentation Index
> Fetch the complete documentation index at: https://wundergraphinc-brendan-add-external-directive.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Setting up SSO with Okta

### Steps to set Okta as an OIDC identity provider

<Steps>
  <Step>
    Navigate to the Applications view within your Okta Administrator Dashboard.
  </Step>

  <Step>
    Click on **Create App Integration**.
  </Step>

  <Step>
    A dialog appears, select **OIDC - OpenID Connect** as the sign-in method.
  </Step>

  <Step>
    For the application type, select **Web Application** and click on **Next**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/create-app-integration.png" />
    </Frame>
  </Step>

  <Step>
    Now give the app a name.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/integration-name.png" />
    </Frame>
  </Step>

  <Step>
    For **Grant Type,** keep the defaults.
  </Step>

  <Step>
    Scroll down to the **Assignments** section and select one of the options based on your choice and then click on **Save.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/integration-assignments.png" />
    </Frame>
  </Step>

  <Step>
    Copy the **Client ID** and **Client Secret.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/copy-client-credentials.png" />
    </Frame>
  </Step>

  <Step>
    Navigate to **Security** -> **API**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/api-menu.png" />
    </Frame>
  </Step>

  <Step>
    Select the **default** authorization server.
  </Step>

  <Step>
    Copy the **Metadata URI.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/metadata-uri.png" />
    </Frame>
  </Step>

  <Step>
    Navigate to the settings page on Cosmo.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/connect_oidc.png" />
    </Frame>
  </Step>

  <Step>
    Give the connection a name, paste the **Metadata URI** copied before, into the  **Discovery Endpoint,**and paste the **Client ID** and  **Client secret**copied before into the **Client ID** and  **Client Secret fields respectively,**and then click on **Connect.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/connect-oidc-dialog.png" />
    </Frame>
  </Step>

  <Step>
    Configure the mapping between the roles in Cosmo and the user groups in Okta. The field **Group in the provider** can be populated with the name of the group or a regex to match the user groups. Once all the mappers are configured, click on **Save**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/map-oidc-groups.png" />
    </Frame>
  </Step>

  <Step>
    Copy the sign-in and sign-out redirect URIs displayed in the dialog.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/connect-oidc-success.png" />
    </Frame>
  </Step>

  <Step>
    Navigate back to the application created on Okta and populate the Sign-in and Sign-out redirect URIs with the above-copied values. Click on **Save**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-11.png" />
    </Frame>
  </Step>

  <Step>
    Navigate to Security-> API, and click on the **default** auth server. Navigate to the **claims** tab and then click on **Add Claim.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/add-claims-tab.png" />
    </Frame>
  </Step>

  <Step>
    Name the claim "ssoGroups", and include it in the **ID Token,** for the value type select **Groups,** and  for the filter select **Matches regex** and populate the field with  **".\*".**Click on **Create.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-13.png" />
    </Frame>
  </Step>

  <Step>
    Now you can assign users/groups to the application, and those users will be able to log into Cosmo using the URL provided on setting up the provider.
  </Step>
</Steps>

<Info>
  Please make sure that the users added to the application have a username.
</Info>