SSO with Okta

Diagnosly supports OIDC SSO with Okta, Azure AD / Entra ID, Google Workspace, and Auth0. SAML 2.0 is on the roadmap.

Configure Okta

1. In Okta, create a new Web Application in the Admin Console.
2. Set Sign-in redirect URIs to https://api.diagnosly.app/api/v1/auth/sso/{provider_id}/callback.
3. Set Sign-out redirect URIs to https://console.diagnosly.app/login.
4. Note the Client ID and Client Secret, you'll need them in step 6.
5. Note the Issuer URL, usually https://<your-domain>.okta.com/oauth2/default.
6. In Diagnosly: Admin → Identity Providers → Add provider:
   • Name: what users see on the login page
   • Provider type: oidc
   • Client ID + Client Secret + Issuer URL, from Okta
   • Allowed domains (optional), restrict to @yourcompany.com to prevent random Okta accounts logging in

JIT provisioning

When a user signs in via SSO for the first time, Diagnosly auto-creates a user record in your tenant. Default role is viewer, promote in Admin → Users as needed.

Domain allowlist

Set allowed_domains to one or more email domains. Users whose Okta email claim doesn't match are rejected at the callback, no JIT user created.

See also

• Azure AD SSO
• RBAC