Set up SSO with Okta or another OpenID Connect provider

Pilot

Company single sign-on is currently enabled only for pilot organizations. It is not generally available yet. You create the connection in Focus in Settings → Security → Single sign-on, which is part of the new version of the dashboard and is shown to the owner of the organization.

This guide sets up Workify360 Focus in Okta, and at the end lists what any other OpenID Connect provider needs. You need an Okta administrator account and a verified domain in Focus (domain verification). Read single sign-on first for how testing, activation and sign-in work.

What to register in Okta

Setting	Value
Sign-in method and application type	OIDC - OpenID Connect, Web Application
Grant types	Authorization Code and Refresh Token
Sign-in redirect URI	https://auth.focus.workify360.com/sso/oidc/callback
Client authentication	Client secret
Assignments	The people or groups who may use Focus

Step by step

1. In the Okta Admin Console, open Applications → Applications and choose Create App Integration.

2. Choose the sign-in method OIDC - OpenID Connect and the application type Web Application.

3. Name the app, for example “Workify360 Focus”. Under Grant type, keep Authorization Code and also select Refresh Token; the desktop app needs the refresh token to check the account regularly.

4. Under Sign-in redirect URIs, enter:

   https://auth.focus.workify360.com/sso/oidc/callback

   Focus does not use a sign-out redirect URI, so you can remove the default one.

5. Under Assignments, limit access to the groups who should use Focus, or assign people later on the Assignments tab. Only assigned people can sign in.

6. Save, then copy the Client ID and the Client secret from the General tab. Focus always uses PKCE, so Require PKCE can stay on.

Create the connection in Focus

1. Open Settings → Security → Single sign-on and choose Add connection.
2. Choose the provider Okta.
3. Enter the name shown on the sign-in page and, as “Issuer URL”, the issuer of your Okta organization, for example https://acme.okta.com. Copy it exactly as the issuer value of https://acme.okta.com/.well-known/openid-configuration shows it; Focus compares it character by character. If you use a custom authorization server such as https://acme.okta.com/oauth2/default, enter its issuer instead and make sure its access policy allows this app, both grant types and the scopes openid, email, profile and offline_access.
4. Enter the client ID and the client secret.
5. Check the Redirect URI step against what you registered in Okta, choose who is added on their first sign-in, and save.
6. Choose Test connection, sign in with an assigned account of your verified domain in the new tab and check the results on the card.
7. Choose Activate (a passed test from the last 24 hours is needed, sso_test_required).

Okta sends email_verified with the address. With requireIdpMfa on the connection, Focus accepts a sign-in when Okta reports multi-factor authentication in amr (for example mfa, otp or hwk), which it does when your sign-on policy asks for a second factor.

Other OpenID Connect providers

Choose the provider Other OIDC (Generic OpenID Connect) for any other provider, for example Keycloak, Auth0, JumpCloud or OneLogin. The provider must support:

• OpenID Connect discovery at <issuer>/.well-known/openid-configuration, with an https issuer that matches the issuer in its tokens exactly (otherwise sso_issuer_invalid or a failed issuer check),
• the authorization code flow with PKCE (S256),
• ID tokens signed with RS256, ES256 or PS256 and a key id (kid); unsigned tokens and HS256 are not accepted,
• the email and email_verified claims; an address without email_verified counts as not verified and cannot sign in,
• client authentication with a client secret (client_secret_post or client_secret_basic),
• refresh tokens with the offline_access scope, recommended for the desktop app’s regular check.

Register the redirect URI https://auth.focus.workify360.com/sso/oidc/callback at the provider, enter the issuer URL, client ID and client secret in the wizard, then choose Test connection and Activate as above. For requireIdpMfa, the provider must report mfa, otp or hwk in amr.