Setting up single sign-on (SSO) with Okta (Plus Only)

Configuring Single Sign-on in Okta

To configure the Single sign-on in Okta.

1. Go to the Profile section of Okta.

2.  Go to Assign Applications
   

3. Under Assign Applications, Click Add Application
   
4. Click on Create New App
   
   
5. Select OpenID Connect and click Create.
   
   
6. Name the application Forecast and upload the picture located here: https://app.forecast.it/forecast_logo_okta.png
7. Set Login redirec URIs to graphql.forecast.it/okta/oauth
   
8. Click Save.
9. Edit General Settings and fill in the details as listed below.
   
   
10. Click Save.
11. Copy the “Client ID” and “Client secret”. These are required in Forecast.
    

This will finalize the process in Okta and you can now move on with configuring the SSO in Forecast.

Configuring Single Sign-on in Forecast

Once everything is configured in Okta you will then be able to proceed with configuring the SSO in Forecast. 

To configure the SSO in Forecast

1. Click on your profile icon in the top right corner of the screen from anywhere on the platform.
2. Click on Admin. This will take you to the Admin panel.
3. While on the Admin panel click on the Integrations tab.
4. Scroll to the SSO section of the page and click on Okta.
5. Fill in your “Okta account URL”, “Application client-id” and “Application client secret”.
6. Click Save to finalize the process.

The SSO is now set up on both platforms.

Assign users to single sign-on with Okta

Once the configuration is done you can begin assigning users to the single sign-on in Okta. 

To assign users to single sign-on in Okta

1. In the Admin Console, go to Directory>People.
2. Click Add Person.
3. Select a user type in the User type list or accept the default.
4. Complete these fields:
   • First name— Enter the user's first name.
   • Last name— Enter the user's last name.
   • Username— Enter the user's user name in email format.
   • Primary email— Enter the user's primary email if it's different from their username.
   • Secondary email— Optional. Enter a secondary email to allow the user to access information when their primary email is unavailable.
   • Groups— Optional. Enter the groups to which the user belongs.
   • Password— Select Set by user to allow the user to set their password, or select Set by admin and enter a password.
   • Send user activation now- Optional. This check box is available when Set by user is selected as the password option. Select this check box to send a user activation email to the user.
   • User must change password on first login— Optional. This check box is selected by default when you select Set by admin as the password option. Clear this check box if you do not want the user to change their password when they first sign in.

5. Click Saveor click Save and Add Another to add another user.

Once this is done and the emails of the users match on both platforms, the users will have to log into Forecast by using the Okta option on the Forecast log-in page.

Switching authentication types

If a user is not included in the Okta single sign-on they will still be able to log into Forecast with their regular email and password. 

Another thing to keep in mind is that if you decide to switch to a different SSO, it is necessary to contact Forecast support as we must first disable the integration to the previous SSO integration that you were using.