✨ Software.com is now Antenna. Read more →
Skip to Content
Security and PrivacyOkta Single Sign-On

Okta Single Sign-On

Antenna supports OpenID Connect (OIDC) and SP-initiated SSO via Okta.

Prerequisites

  1. Make sure you are logged in to Okta as an administrator.
  2. Make sure you have an existing Antenna account and organization.
  3. If you used password-based authentication to sign up for Antenna and the email address you used matches your email address in Okta, please change your email address in Antenna (e.g. john.doe+email@company.com) to prevent any account verification errors.
  4. Your organization must be on the Business or Enterprise plan. Our Okta integration is not available on the free trial.

Supported Features

For more information on the listed features, visit the Okta Glossary .

Configuration Steps

  1. Go to the Antenna  integration in the Okta marketplace.
  2. Click Add this integration.
  3. Make sure that your user is assigned to the application in Okta.
  4. On the Okta admin page, click on the Antenna application and navigate to the Sign On tab.
  5. Copy the values of Issuer, Client ID, and Client Secret.
  6. On app.antenna.dev , go to Organization Settings > SSO.
  7. Click Configure next to Okta.
  8. Paste the Issuer, Client ID, and Client Secret (from step 5) and click Save.
  9. Click Activate.

Once you complete these steps, all organization members will be required to log in through Okta to access Antenna, including the administrator that set up Okta.

Important

If users previously used password-based authentication, they may not be able to log in via Okta. To avoid any errors, please delete any existing users in Organization Settings > App Users.

Roles and Permissions

Permissions are managed in Antenna, not in Okta. Okta controls who can sign in — anyone assigned the Antenna application in Okta can log in — but it does not pass roles or groups to Antenna. Unlike Entra SSO, Okta group-to-role mapping is not supported.

Accounts are created through Just-In-Time provisioning, so a user joins the first time they sign in with Okta rather than when you assign them the application. New members join as Contributor, except the administrator who sets up and verifies the Okta connection, who becomes an Admin.

To change a role, an Admin goes to Settings > App Users, opens the member, and selects Admin, Director, Manager, or Contributor. See Roles and Permissions for what each role can access.

To grant a role before someone’s first login, invite them from Settings > App Users and pick their role on the invite.

If your SSO connection is configured at the enterprise level, you can change the role new members receive with Default role for new members on the SSO settings page.

Setting a member to No Access revokes their access to Antenna without removing them, and signing in through Okta does not restore it. Reassign a role to give the member access again.

SP-initiated SSO

SP-initiated SSO will occur if a user has a pre-existing account for the organization and the organization admin then enables SSO. If a user logs in with a non-Okta SSO account, they will see a screen stating that they need to log in with Okta.

The sign-in process is initiated from the Antenna sign-in page .

  1. From your browser, navigate to the Antenna sign-in page.
  2. Enter your pre-existing sign-in credentials. After submitting, you will be asked to sign in with Okta.
  3. Enter your Okta credentials (your email and password) and click Sign in with Okta.
  4. If your credentials are valid, you will be redirected to the Antenna dashboard.

SP-initiated SSO also occurs when a user’s session expires. They will be shown a screen asking them to sign in with Okta to continue.

Troubleshooting

”This client cannot use a custom authorization server”

Verification fails and Okta returns unauthorized_client with the description This client cannot use a custom authorization server. This happens when the Issuer you pasted into Antenna points at an Okta custom authorization server (for example https://your-company.okta.com/oauth2/aus1a2b3c4d) that the Antenna application is not allowed to use.

You have two options:

  • Use your org authorization server. In SSO settings, change the Issuer to your Okta org URL without the /oauth2/... suffix (for example https://your-company.okta.com), then verify again. Antenna only requests the openid, email, and profile scopes, so a custom authorization server is not required.
  • Allow the Antenna app on the custom authorization server. In the Okta Admin Console, go to Security > API > Authorization Servers, open the authorization server in your issuer, and on the Access Policies tab add or edit a policy that is assigned to the Antenna application. The policy needs a rule that allows the authorization code grant with the openid, email, and profile scopes for the users who sign in to Antenna. This option requires Okta API Access Management.
Note

Security > API is only available in Okta orgs that license API Access Management. If you do not see it, use your org authorization server issuer.

”Verification error. Please double check your client secret and try again.”

The Client ID or Client Secret in Antenna does not match the Okta application, or the secret has been rotated in Okta. Copy both values again from the Sign On tab of the Antenna application in Okta and save them in SSO settings.

Removing Okta SSO

After activating Okta SSO, you will see the enabled connection and an option to remove it on the settings page for your organization on Antenna.

If you remove SSO from your organization, all SSO users will lose login access to Antenna. Any SSO users currently logged in will have their session expire within 8 hours.

You can add Okta SSO back at any time.

Last updated on
Entra Single Sign-OnCost per Contributor