Skip to main content
Endor Labs integrates with Okta to use SSO through OpenID Connect (OIDC) protocol.
Endor Labs honors the session duration set in OIDC, after which the user needs to reauthenticate. The token expiration claims (exp) control the session duration in OIDC. If you do not have token expiration claims, the default session duration is four hours. Session duration cannot be more than four hours. If you set a session duration for more than four hours in the token expiration claim, the session duration defaults to four hours.
Complete the following tasks to configure Okta for SSO through OIDC.

​
Create and configure an OIDC application in Okta

In Okta, create an OIDC application for Endor Labs and get the client credentials that Endor Labs uses to connect.
You must be an Okta administrator to configure the application end-to-end in Okta.
  1. Sign in to the Okta admin account.
  2. Go to Applications and Resources > Applications.
  3. Click Create App Integration and select Classic experience.
  4. Select OIDC - OpenID Connect as the Sign-in method.
  5. Select Web Application as the app type and click Next.
  6. Enter the following details in General Settings.
    • App integration name: Enter Endor Labs.
    • Client definition: Select Use Okta-generated client ID.
    • Sign-in redirect URIs: Enter https://api.endorlabs.com/v1/auth/oidc/callback
    • Sign-out redirect URIs: Enter https://api.endorlabs.com/v1/auth/oidc/logout
    If you’re using a EU tenant:
    • Sign-in redirect URIs: https://api.eu.endorlabs.com/v1/auth/oidc/callback
    • Sign-out redirect URIs: https://api.eu.endorlabs.com/v1/auth/oidc/logout
    • Assignments: Select Limit access to selected groups and choose the groups that need access to Endor Labs. To give access to everyone in your Okta organization, select Allow everyone in your organization to access. To add people or groups later, refer to Assign app integrations.
  7. Click Save.
  8. Go to the Sign On tab in the application.
  9. In the Token claims section, click Add expression.
    A groups claim you created earlier is listed under Show legacy configuration and continues to work. To learn more, refer to Configure custom claims for app integrations.
  10. Enter the following details and click Save.
    • Name: Enter a name for the claim, such as endor_groups.
    • Expression: Enter an expression that returns the names of the groups you use for Endor Labs access. The following expression returns the groups whose names start with endor-.
      To filter groups another way, refer to Group functions.
    Ensure to match only the groups this app needs. A filter expression that matches every group, such as user.getGroups({'group.type': {'OKTA_GROUP'}}), can make the groups claim large enough to break sign-in for users who belong to many groups.
  11. Click Save.

​
Get the client credentials from Okta

After you create the application and assign users, copy the details that Endor Labs needs to connect to Okta.
  1. Open the General tab in the application.
  2. In the Client Credentials section, copy the Client ID and Client secret.
  3. Note your Okta domain, such as https://endorlabs.okta.com. You use it to build the discovery URL.

​
Configure Okta OIDC SSO in Endor Labs

Provide the Identity Provider SSO details to configure Okta SSO in Endor Labs and allow users to seamlessly and securely sign in to Endor Labs.
You must be an Endor Labs administrator to configure custom identity providers and authorization policies.
  1. Select User menu > Settings from the left sidebar.
  2. Select Access Control > Custom Identity Provider.
  3. Select the TYPE OF IDENTITY PROVIDER as OIDC.
  4. Enter the IDENTITY PROVIDER NAME as Okta OIDC.
  5. Under DISCOVERY URL enter your discovery URL. In most cases, this is your Okta domain followed by /.well-known/openid-configuration. For example, https://endorlabs.okta.com/.well-known/openid-configuration.
  6. Enter your Client ID and Client Secret from Okta.
  7. Under Advanced Configuration enter the following scopes in the scopes section: email, groups, profile. Press enter after every entry to add each attribute successfully.
  8. If you are configuring group-based authentication, add the claim name you created in Okta, such as endor_groups, in the Claim Names section.
  9. Click Save Configuration.
Based on your Okta configuration you may need additional claim names or scopes. Consult your Okta administrator for additional guidance.

​
Configure your Authorization Policy

Once you’ve configured your custom identity provider in Endor Labs you must configure an authorization policy for your users and groups. To set up an authorization policy:
  1. Select User menu > Settings from the left sidebar.
  2. Select Access Control > Auth Policy.
  3. Select Add Auth Policy.
  4. Enter Okta OIDC as your identity provider.
  5. Select the permissions you’d like to assign your user or group.
  6. Under claims update your Key. Use email to assign individual users, or the claim name you created in Okta, such as endor_groups, to assign users by group.
  7. Assign the value to the key as the email of the user or group you would like to authorize. This value is case-sensitive.
  8. Repeat as needed for any additional users or groups.