Setting up Single Sign-On with Okta

⏱️ 5 minute read

Forecast's integration with Okta simplifies the login process for your users by allowing them to access Forecast with the same set of credentials they are using for other software at your organization. Enabling Single Sign-On (SSO) enhances the security of your Forecast account by adding an additional layer of authentication. The following steps will guide you through the process of setting up Okta for seamless access to Forecast.

If you are looking to set-up user provisioning with Okta, check out:

• Okta Integration: User Provisioning Setup

This article includes:

• Configuring SSO in Okta
• Configuring SSO in Forecast
• Assign Users to SSO in Okta
• Managing Authentication Types

Configuring SSO in Okta

Sign into Okta as an Administrator and then follow the steps below.

To configure the single sign-on integration within Okta

1. Go to the Applications > Applications section.
2.  Click Create App Integration
3. Select OIDC - OpenID Connect as the Sign-in method.
4. Select Web Application as the Application type. Click Next.
5. In App integration name enter "Forecast".
6. Set the Sign-in redirect URI to https://graphql.forecast.it/okta/oauth
7. Set Controlled access to "Skip group assignment for now". Click Save.
8. In the General tab, edit the General Settings section and fill in the details as below.
   1. Application type: Ensure it is set to "Web"
   2. Grant type:  Expand the "Advanced" section and ensure the following options are selected:
      • Authorization Code
      • Implicit (Hybrid)
        • Allow ID Token with implicit grant type
        • Allow Access Token with implicit grant type
   3. Sign-in redirect URI: https://graphql.forecast.it/okta/oauth
   4. Login initiated by: Select "Either Okta or App"
   5. Application visibility: Select "Display application icon to users"
   6. Login Flow: Select "Redirect to app to initiate login (OIDC Compliant)"
   7. Initiate login URI: https://app.forecast.it/okta-login
   8. Click Save.
9. In the General tab, In the Client Credentials section, Copy and save the “Client ID” and “Client secret” provided by Okta. These will be required in the setup within Forecast later on.

Configuring SSO in Forecast

Once the Forecast app is set up in Okta, sign in to your Forecast account as an administrator and configure the Okta integration. To complete the setup, you’ll need the following information from Okta:

• Okta account URL
• Application Client ID
• Application Client Secret

You can also enforce single sign-on during authentication, which will prevent users from logging in with their Forecast email and password.

To configure Okta single sign-on in Forecast

1. Click Admin in the navigation ribbon. 
2. Select Integrations from the dropdown.
3. Scroll to the Security & single sign-on (SSO) section of the page and select Okta.
4. Under Require SSO, enable the toggle to make single-sign on mandatory, in order to require login via Okta and disable logging in via email and password. We recommend selecting at least one Admin user in case any issue arises with the single sign-on provider, so that the exempted user can access and disable the Single Sign on requirement for the rest of the users.
5. Fill in your “Okta account URL”, “Application client-id” and “Application client secret”.
6. Click Save to finalize the process.

The Okta for Forecast SSO setup is now completed.

Assign Users to Forecast SSO with Okta

Once configured, you can start assigning users to the Forecast app to sign in via single sign-on through Okta. To ensure successful login, make sure each user’s email address in Forecast matches their registered email address in Okta.

Create People in Okta

1. In the Okta Admin panel, head to Directory > People.
2. Click Add person.
3. Select a user type in the User type list or accept the default.
4. Complete these fields:
   • First name: Enter the user's first name.
   • Last name:  Enter the user's last name.
   • Username: Enter the user's username in email address format.
   • Primary email (optional): Enter the user's primary email if it's different from their username.
   • Secondary email (optional): Enter a secondary email to allow the user to access information when their primary email is unavailable.
   • Groups (optional): Enter the groups to which the user belongs if any.
   • Activation: Select "Activate Now".
   • I will set password: Select the preferred option
5. Click Save or click Save and Add Another to add another user.

Once the users have been created in Okta, you can start assigning them to the Forecast app.

Assign Users to the Forecast App in Okta

1. Go to Applications > Applications.
2. Click the Forecast app.
3. In the Assignements tab, click Assign > Assign to People. (if you don't use groups)
4. Click Assign and Save for each person that will use Okta SSO. Click Done.

They can also click the "Forecast" tile in Okta:

Managing Authentication Types

If a user is not included in the Okta database to login via Single Sign-On and single sign-on isn't required in Forecast, the user will still be able to log into Forecast with their regular Forecast email and password. 

Related Articles

• Okta Integration: User Provisioning Setup
• Supported SCIM fields for User Provisioning