Okta
Connect Okta to nano with OIDC using a Web Application integration.
Okta (OIDC)
Okta is an OIDC provider out of the box. You create a Web Application integration, assign users, and point nano at your Okta issuer.
Prerequisites
- Access to the Okta Admin Console with permission to create app integrations.
- Your nano host and a chosen provider slug (this guide uses
okta).
Steps
Create the app integration. In the Okta Admin Console go to Applications → Applications → Create App Integration. Choose OIDC - OpenID Connect, then Web Application, and click Next.
Configure sign-in. Name it (e.g. nano SIEM). Under Grant type, keep Authorization Code. Set Sign-in redirect URIs to:
https://<your-nano-host>/auth/callback/oktaAssign access. Under Assignments, assign the users or groups who should be able to sign in, then save.
Copy the credentials. On the app's General tab, copy the Client ID and Client secret.
Find your issuer. Use your Okta org URL https://<your-org>.okta.com, or — if you use a custom authorization server — its issuer https://<your-org>.okta.com/oauth2/<auth-server-id> (find it under Security → API).
(Optional) Emit groups. To map Okta groups, open the app's Sign On tab → OpenID Connect ID Token, set Groups claim type to Filter and Groups claim filter to groups matches regex .* (or a tighter filter). This adds a groups claim.
Add the provider in nano. Go to Settings → Single Sign-On → Add provider and enter:
| Field | Value |
|---|---|
| Name | Okta |
| Slug | okta |
| Issuer URL | (from step 5) |
| Client ID | (from Okta) |
| Client Secret | (from Okta) |
| Scopes | openid email profile (add groups if using group mapping) |
| Group claim | groups (only if configured in step 6) |
Save.
Test it. Sign out and use the Okta option on the login page.
Troubleshooting
redirect_urierror — the Sign-in redirect URI must be exactlyhttps://<your-nano-host>/auth/callback/okta.- Issuer mismatch — if you use a custom authorization server, the Issuer URL in nano must be that server's issuer (
.../oauth2/<auth-server-id>), not the bare org URL. - User can't sign in — confirm the user (or their group) is assigned to the app in Assignments.