--- title: Okta slug: okta docTags: createdAt: 2025-10-10T20:59:56.191Z --- # Overview [Okta](https://www.okta.com/) is a cloud-based identity and access management (IAM) platform that enables secure, single sign-on (SSO) access to applications and services using one set of credentials. # Integration Guide The goal of this is to provide a comprehensive guide allowing for a successful setup and integration of Okta as an identity provider to SHI One. If using Okta as an IdP is a requirement for your company to onboard with SHI One, please familiarize yourself with this documentation and confirm the requirements and permissions necessary and then reach out to your Account Executive or SHI representative to start the process. *** ## Prerequisites **Required Access & Permissions:** - Administrative access to their Okta tenant - Ability to create new applications in Okta - Ability to configure application settings and assignments To setup the Okta integration: 1. Login to the Okta console as an admin user. 2. Enter the admin console of Okta. ::Image[]{src="https://api.archbee.com/api/optimize/iNsEBjkrzpMV8hFLC23IM/lgoa_WkuZPYtBh7KkN0zE-20260427-174640.png" size="90" isUploading="false" position="flex-start" width="988" height="445" darkWidth="988" darkHeight="445" showCaption="false"} 3. Open the **Applications **menu and click **Create App Integration**. ::Image[]{src="https://api.archbee.com/api/optimize/iNsEBjkrzpMV8hFLC23IM/sEeoCqLtKF0v0KRpfgwJj-20251010-211139.jpg" size="80" isUploading="false" position="flex-start" width="1012" height="779" darkWidth="1012" darkHeight="779" showCaption="false"} 4. For the sign-in method select **OIDC**. 5. For the application type, select** Web Application**. ::Image[]{src="https://api.archbee.com/api/optimize/iNsEBjkrzpMV8hFLC23IM/J1poMuFgOUwITvBMElvsu-20251010-211233.jpg" size="80" isUploading="false" position="flex-start" width="945" height="819" darkWidth="945" darkHeight="819" showCaption="false"} 6. Once in the new application setup, most of the default settings will remain. The following will need to be changed: 1. Fill out the **App integration name**. We recommend "SHI One" especially if your company wants to leverage the application dashboard built into Okta for your users. 2. Enter `https://login.shi.com/login/callback` into the **Sign-in redirect URIs** field. 3. The **Sign-out redirect URIs **field can be blank. If you need to remove a default, click on the X. ::Image[]{src="https://api.archbee.com/api/optimize/iNsEBjkrzpMV8hFLC23IM/RITbYfavkVkdj0kwc2XSv_okta-update-new.jpg" size="80" isUploading="false" position="flex-start" width="948" height="883" darkWidth="948" darkHeight="883" showCaption="false"} 4. Under **Assignments**, select your desired option. You will have to determine this setting based on your Okta setup and who needs access to SHI One. It can allow everyone in your Okta IdP access or certain groups of users which you will have to setup and is outside the scope of this document. ::Image[]{src="https://api.archbee.com/api/optimize/iNsEBjkrzpMV8hFLC23IM/wJpcOC3LD-bitfqQ-pbff-20251010-211553.jpg" size="80" isUploading="false" position="flex-start" width="922" height="600" darkWidth="922" darkHeight="600" showCaption="false"} 5. Once, you're finished, click **Save**. 7. Once the application is saved, click **Edit **in **General Settings**. 8. Scroll down to the **LOGIN **section. 9. Update the **Login initiated by** option to **Either Okta or App**. 10. Update the **Initiate login URI** to: `https://one.shi.com/api/IdpAuthentication/idp-initiate?connection=COMPANYNAME-sso` - **Note**: You will need to provide what you put into the end of this URL to SHI. There can be no underscores, just your company name with "-sso" appended to it. For example, "acmeco-sso". After saving, the settings should look like the screenshot below (with "acmeco" replaced with your company name or identifier). ::Image[]{src="https://api.archbee.com/api/optimize/iNsEBjkrzpMV8hFLC23IM/QZL9bwXGFW1aQnZE5hUe3-20251013-125659.jpg" size="90" isUploading="false" position="flex-start" width="698" height="537" darkWidth="698" darkHeight="537" showCaption="false"} 11. Lastly, save your changes. *** ## Requesting from SHI :::hint{type="info"} We have a secure mailbox setup for the items you will need to provide to complete the integration. Please send an encrypted email with a `.txt` file attached containing the four items below. If you need help sending an encrypted email or have any questions, feel free to contact the same email address. **Email**: `shione-sso-onboarding@shi.com` ::: The information that you will need to provide SHI to complete the integration are: 1. The company name or identifier you entered for the **Initiate login URI** above. Providing the whole URI is preferred for validation. 2. The **Client ID** of the application. 3. The secret of the application. ::Image[]{src="https://api.archbee.com/api/optimize/iNsEBjkrzpMV8hFLC23IM/rtWh6tiG7cSSUJJ7AfEgA-20251013-125811.jpg" size="80" isUploading="false" position="flex-start" width="665" height="586" darkWidth="665" darkHeight="586" showCaption="false"} 4. The Okta domain from the admin console (see screenshot below). It will be in the mydomain.okta.com format. ::Image[]{src="https://api.archbee.com/api/optimize/iNsEBjkrzpMV8hFLC23IM/yP5HQPXEz15Zvkd37EsBy-20251013-130147.jpg" size="80" isUploading="false" position="flex-start" width="1347" height="298" darkWidth="1347" darkHeight="298" showCaption="false"} *** Post Submission Information That should be all that is needed to complete the integration. Once this information is provided to SHI, we will complete the integration on our side and ask users to test. At the current time SHI only supports IdP initiated login so if your organization is leveraging the Okta Apps dashboard, be sure to add this app to it for your users. If not, users will need to use the **Initiate login URI**. It may be preferable for your organization to map an internal DNS entry to the Initiate login URI but that is optional. We recommend having users log in via the Okta apps dashboard or having them bookmark the **Initiate login URI**.