> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.method.security/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.method.security/_mcp/server. # Use Okta for SSO > Use Okta to authenticate and authorize users into Method Platform Use this guide to create an app in Okta and integrate it into the Method Platform's authentication service for SSO. --- ## Setup Okta ### Navigate to Okta Admin Console Log into your Okta organization as an administrator and navigate to the Admin Console. ![](/_fern-files/_img/8fd1644ed5d5deba26a11190ad2d274a87f75004b9375175c2b6987f28ac0149.webp) ### Create a new App Integration In the Admin Console, navigate to `Applications` > `Applications` in the left sidebar. ![](/_fern-files/_img/b6f7225087c70c26f0229eff5a5abf0c52af6494b9a00704a003244a72d59e4c.webp) Click `Create App Integration`. ### Configure the App Integration On the `Create a new app integration` dialog, select `OIDC - OpenID Connect` as the Sign-in method. Select `Web Application` as the Application type. Click `Next`. ![](/_fern-files/_img/d3d4d795062e7d982cf14f5e8e8a4cdd8e75b57f013c4c52e22592245f4917e1.webp) ### Configure App Settings On the `New Web App Integration` page, enter `Method Platform` as the `App integration name`. In the `Sign-in redirect URIs` section, enter the Redirect URI which should be: `https://keycloak..method.delivery/realms/method/broker/okta/endpoint`. > **Instance name** > > Make sure to fill in the name of your Method instance in the URI above. For `Assignments`, select the appropriate option based on your organization's needs. You can choose to allow all users or limit to specific groups. Click `Save`. ![](/_fern-files/_img/611257df697c2b03e7a322e8ea9a2a2ec6c579beb74555407255bc066f191170.webp) ### Get Client Credentials After saving, you'll be redirected to the app's general settings page. Scroll down to the `Client Credentials` section. Copy the `Client ID` - you'll need this later. Copy the `Client secret` by clicking the copy icon - you'll need this later. ![](/_fern-files/_img/ba6e795505727d22c4be32b69c92ec86b3ff17e18668deb15b3e2e2231c2cacf.webp) > **Client Secret Security** > > The client secret should be treated as sensitive information. If you need to > retrieve it later, you can regenerate a new secret from this page. ## Share Information with your Method Mission Ops team There will be three pieces of information you need to share with your Method Mission Ops team: 1. The Client Secret copied in the previous step 2. Your Okta domain (Issuer URI) 3. Client ID ### Get Okta Domain (Issuer URI) Your Okta domain is typically in the format: `https://.okta.com` or `https://.oktapreview.com` for preview environments. You can find this in the top-right corner of the Admin Console, or in the app settings under `Okta domain`. The full Issuer URI that you'll share is: `https://.okta.com` ### Send three pieces of information to Method Mission Ops team Ensure that this information is sent securely: 1. Client Secret 2. Okta domain (Issuer URI) 3. Client ID ## Test login Once you are notified by your Method Mission Ops team, you should see a new `Okta` option when logging into Method Platform. --- ## Set up SCIM provisioning SCIM provisioning is an optional step which allows you to sync users and group membership from Okta to Method. This allows you to manage users' permissions within the platform from your IdP, since the IdP controls group membership, and group membership determines [permissions in Method](/platform/security-governance/security-administration-guide). ### Get the integration token from Method Platform #### Log in to Method Platform Log in to Method Platform using SSO. #### Navigate to SCIM Integrations In the left sidebar, expand **Admin** and click **Integrations**. ![](/_fern-files/_img/c7601b10504184b32873538e56fd4cdb1304677d415c6f838b4945b1b1bf7c3c.webp) #### Create a new integration Click the **+** button. In the dialog, select **Okta** as the identity provider and click **Create integration**. ![](/_fern-files/_img/ff679836972a98ea706ddcf8e1519619c9430c68f6b6cdfab6f4cdbcb361cbe6.webp) #### Generate a bearer token Click **Create token** and copy the bearer token. You will need this when configuring SCIM in Okta. > **Save your token** > > The token value will not be accessible after you close this dialog. If you lose it, you will need to generate a new one. ![](/_fern-files/_img/2cd9c081e9eb5112c42f9984efb43f2ef198c23d05c52fbaf2b0e48b28c6bc49.webp) ### Configure SCIM in Okta #### Add the SCIM app In the Okta Admin Console, navigate to **Applications** > **Browse Catalog**. Search for **SCIM 2.0 Test App (Header Auth)** and click **Add Integration**. ![](/_fern-files/_img/1aa59c7b9dc842a4988d922afa620924642508d25937303cba50221a43b726d8.webp) #### Configure general settings Set the **Application label** to `Method Security SCIM 2.0`. Leave **Application Visibility** and **Browser plugin auto-submit** unchecked. Click **Next**. ![](/_fern-files/_img/e75f43dc5e0c1feeba0907457fe2c81af8dbf80aff6406ceacf726d20b3dd513.webp) #### Configure sign-on options Select **Secure Web Authentication**, then select **Administrator sets username and password**. This is a placeholder setting and will not be used for sign-in. Authentication is handled through OIDC SSO configured earlier in this guide. Click **Done**. ![](/_fern-files/_img/814d7dffcf4c694d02fe679a45adc26328d9d5f4fb163f5cc890195137749693.webp) #### Enable provisioning Navigate to the **Method Security SCIM 2.0** app and select the **Provisioning** tab. Click **Configure API Integration**. ![](/_fern-files/_img/14df7f65ac15d850799454bc37297768bd95cd8dfd06332a26c9969bdabf2d68.webp) #### Configure API integration Check **Enable API integration** and fill in the following fields: * **Base URL**: `https://.method.delivery/bulwark/api/scim/v2/` * **API Token**: Paste the bearer token you copied from Method Platform > **Instance name** > > Make sure to fill in the name of your Method instance in the URI above. Check **Import Groups**, then click **Test API Credentials** to verify the connection. Once the test passes, click **Save**. ![](/_fern-files/_img/9bce3fa89a0978c7fe7bc6dc068902c144a476285eafe5ccfd124bd8ea721b00.webp) #### Enable provisioning to app Under the **Provisioning** tab, select **To App** in the left sidebar. Enable the following three options: * **Create Users**: Provisions users in Method Platform when assigned to the app in Okta * **Update User Attributes**: Syncs attribute changes from Okta to Method Platform * **Deactivate Users**: Deactivates users in Method Platform when unassigned or deactivated in Okta ![](/_fern-files/_img/c7a841a9e5acd1c1f25700a2388c7e966e25458d21390ed81bb497a445cec0e8.webp) ### Attribute mappings Under the **Provisioning** tab, select **To App** and scroll down to the attribute mappings. Method Platform supports the following SCIM user attributes: * `userName` * `active` * `displayName` * `title` * `emails` (work email value and primary flag) * `preferredLanguage` * `name` (givenName, familyName, formatted, middleName, honorificPrefix, honorificSuffix) * `addresses` (formatted, street, locality, region, postalCode, country, primary) * `phoneNumbers` (work, mobile, fax) * `userType` * `nickName` * `locale` * `timezone` ![](/_fern-files/_img/c5a9f39631b6fb232e772d4cb29c02c85bfba352e585fe191032cbfeb41798df.webp) Attributes not listed above are accepted but ignored. #### Push Groups If you plan to sync Okta groups into Method Platform, navigate to the **Push Groups** tab to configure group provisioning. The following group attributes are consumed: | Okta Attribute | SCIM Field | Usage | | -------------- | ------------- | ------------------------------------------- | | Group name | `displayName` | Stored as the group name in Method Platform | | Members | `members` | Synced to group membership | You are now set up to push users and groups from Okta to Method Platform. Assign users or groups to the **Method Security SCIM 2.0** app in the **Assignments** tab to begin provisioning.