> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fiddler.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Okta OIDC
> Learn how to configure Fiddler with Okta for Single Sign-On (SSO) using the OpenID Connect (OIDC) protocol.
## Overview
This integration allows your users to sign in to Fiddler using their existing Okta account, without needing a separate Fiddler password. Users are automatically provisioned on their first successful login — no manual invitations required.
## Prerequisites
Before starting, ensure you have:
* **Okta Administrator Access**: Permissions to create and configure applications in your Okta organization.
* **Fiddler AuthN Administrator Access**: Org Owner role in Fiddler's AuthN management console.
* **Deployment Information**: The hostname of your Fiddler deployment, e.g. `idpexample.dev.fiddler.ai`.
## Configuring Okta
Fiddler requires two redirect URIs on the Okta application. You will add both when creating the Okta application below:
* `https://authn-{base_url}/ui/login/login/externalidp/callback`
* `https://authn-{base_url}/idps/callback`
Replace `{base_url}` with your Fiddler deployment host (e.g. `idpexample.dev.fiddler.ai`).
1. In the Okta admin console, navigate to *Applications* and select the *Create App Integration* button. Select *OIDC - OpenID Connect* for the *Sign-in method* and *Web Application* for the *Application type*, then select *Next*.
2. Assign a name for your application integration in the *App integration name* text box, then configure the redirect URIs:
1. Enter both redirect URIs into the *Sign-in redirect URIs* field using the *+ Add URI* button:
* `https://authn-idpexample.dev.fiddler.ai/ui/login/login/externalidp/callback`
* `https://authn-idpexample.dev.fiddler.ai/idps/callback`
2. Enter your Fiddler deployment URL (without the `authn-` prefix) into the *Sign-out redirect URIs* text box, e.g. `https://idpexample.dev.fiddler.ai`.
3. Select the *Save* button to create the application.
4. Copy the following values — you will need them when configuring Fiddler:
1. On the *General* tab, copy the *Client ID* and *Client Secret* values.
2. On the *Sign On* tab, copy the *Issuer* URL.
## Configuring Fiddler
The URL to the Fiddler AuthN management console is your Fiddler instance base URL prepended with `authn-`. For example, if your Fiddler base URL is `https://idpexample.dev.fiddler.ai` then you will access the AuthN management console at `https://authn-idpexample.dev.fiddler.ai`.
Sign in using the AuthN console Org Owner user account credentials provided by your Fiddler representative.
Ensure your organization is selected in the dropdown. You may see the *fiddler* organization, but this is reserved for system use and should not be edited. Here we are using the *idpexample* organization.
Select *Settings* tab from the top menu and then select *Identity Providers* from the left navigation menu.
1. Select the *Generic OIDC* option in the *Add provider* section, which brings up the OIDC Provider form.
2. Note the callback URL shown in the form — it corresponds to the redirect URIs you registered in Okta earlier, so no further changes are needed in Okta.
1. In the OIDC Provider form, enter the following values:
1. Enter a name in the *Name* text box. This name is displayed on the SSO login button on the Fiddler sign-in page, so choose one your users will recognize.
2. In the *Issuer* text box, paste the Issuer URL copied from the Okta admin console.
3. In the *Client ID* and *Client Secret* text boxes, paste those values copied from the Okta admin console.
1. Expand the *optional* section.
2. Add the text `groups` to the *Scopes List* text box and ensure it is listed along with `openid`, `profile`, and `email`.
3. Ensure the *Automatic create* and *Automatic update* checkboxes are selected.
4. Set the *Determines whether an identity will be prompted to be linked to an existing account* dropdown to *Check for existing Username*.
Select the *Create* button and then select the *Save* button. You will be returned to the Organization Settings page.
1. Select your IdP from the list and select the *Activate* button on the identity provider page.
2. Close the settings and then select *Login Behavior and Security* from the left nav menu and ensure the *External login allowed* checkbox is selected.
3. Select the *Save* button.
Select the *Actions* tab from the top menu.
1. Select the *New* button in the *Scripts* section to create a new action script.
2. Copy the *Okta OIDC Action Script* below and paste it into the script text area.
3. Enter `setAttributesOnOktaOIDCAuth` in the *Name* text box.
4. Select the *Add* button.
**File:** `Okta OIDC Action Script`
```javascript theme={null}
function setAttributesOnOktaOIDCAuth(ctx, api) {
let firstName = ctx.v1.providerInfo.getFirstName();
let lastName = ctx.v1.providerInfo.getLastName();
let email = ctx.v1.providerInfo.getEmail();
let groups = ctx.getClaim('groups');
let nameParts = [firstName, lastName];
let filteredParts = nameParts.filter(part => part);
let displayName = filteredParts.join(' ');
if (firstName != undefined) {
api.setFirstName(firstName);
}
if (lastName != undefined) {
api.setLastName(lastName);
}
if (email != undefined) {
email = email.toLowerCase();
api.setEmail(email);
api.setEmailVerified(true);
api.setPreferredUsername(email);
}
if (displayName) {
api.setDisplayName(displayName);
}
api.v1.user.appendMetadata('fiddler_authentication_type', 'SSO:OKTA:OIDC');
if (groups === null || groups === undefined){
groups = []
}
api.v1.user.appendMetadata('fiddler_groups', groups);
}
```
Scroll down to the *Flows* section.
1. Select the *External Authentication* option for the *Flow Type* dropdown.
2. Select the *+ Add trigger* button.
3. Select the *Post Authentication* option for the *Trigger Type* dropdown.
4. Select the *setAttributesOnOktaOIDCAuth* option for the *Actions* dropdown.
5. Select the *Save* button.
Add an organization metadata key so Fiddler can correctly identify and process this SSO connection. Set this once during setup.
1. Go to the *Metadata* section and select *Edit*.
2. Select the *Add* button, then enter the key `fiddler_sso_authentication_type` with the value `SSO:OKTA:OIDC`.
3. Select the *Save* button next to the new entry.
Before validating, ensure your Okta user account is assigned to the new Okta application you created.
1. Open your Fiddler URL (e.g. `https://idpexample.dev.fiddler.ai`).
2. Ensure you see the Fiddler sign-in page and that it displays an SSO login button labeled with the name you configured (e.g. *Okta OIDC*).
3. Select the button and confirm that the Fiddler application loads.
The first user to sign in to the Fiddler application is automatically assigned the Fiddler Org Admin role; subsequent members are Org Members by default.
## Getting Help
If sign-in fails, check the **Okta System Log** (*Reports → System Log*) for the failed attempt and its reason. For Fiddler-side issues, see the [SSO Authentication Guide](/reference/access-control/sso-authentication-guide). If the issue persists, contact your Fiddler representative with the specific error message.
## Important Notes
* **Data Storage**: Fiddler stores the following profile attributes from Okta: first name, last name, display name, email address, and group memberships (used to map users to Fiddler teams).
* **API Access**: For programmatic API access, users create an API key from the *Credentials* tab in Fiddler's *Settings* page.
* **Single Authentication Method**: Users can only authenticate via either SSO or email authentication, not both.
## Next Steps
After successful integration:
* **Train Users**: Provide guidance on accessing Fiddler through Okta SSO.
* **Configure Teams**: Map your identity provider groups to Fiddler teams — see [Mapping AD Groups to Fiddler Teams](/reference/access-control/mapping-ad-groups-to-fiddler-teams).
* **Test Group Sync**: Verify automatic group synchronization is working as expected.
* **Monitor Usage**: Review authentication logs and user access patterns.