Before you start
- Confirm with Pyn that single sign-on is enabled for your workspace: it's a per-workspace switch we turn on for you, and nothing below appears until it is
- You need to be an Admin or Owner in Pyn
- You need an Okta administrator to create an app integration
Required Okta configuration
You'll need an Okta administrator to perform the following steps:
1. Create the app in Okta
Navigate to Applications -> Applications -> Create app Integration in the Okta Admin Console.
Choose OIDC - OpenID Connect, then Web Application. Press Continue.
Name the application Pyn. You can download our logo at https://www.pynhq.com/logo.png.
Set the following values:
Grant type: Authorisation Code. This shall be the only option ticked.
Sign-in redirect URIs: https://pyn.ai/api/okta/callback
Sign-out redirect URIs: leave blank
Assignments: assign the people or groups that should have log in access to Pyn
Save the form, then copy down the Client ID and Client secret from the General tab.
2. Enable groups on the app
Pyn requires the following scopes: openid, profile, email, groups.
In the app's Sign On tab, configure the Groups claim (filter or expression) so Okta emits
groupsin the ID tokenConfirm your Okta org allows the
groupsscope for this app: without it every sign on to Pyn will fail
3. Get the issuer URL
Normally this is your Okta org url: https://<your-org>.okta.com. If you use a custom authorisation server, use that issuer instead, for example: https://<your-org>.okta.com/oauth2/default.
Add your Okta configuration
Navigate to Settings -> Integrations -> Available. Tap the Okta tile.
As prompted, provide the following:
Okta issuer URL (from step 3)
Okta client ID (from step 1)
Okta client secret (from step 1)
Callback URL (accept the default value, ensure it matches what was registered in Okta)
Upon completion the the Okta integration panel will open. Inside it, your sign-in link is available to be copied. Provide that link to your Pyn users to log in.