Connect Okta to Kanroo

Configure SSO for an existing Kanroo organization. This flow was manually tested with an Okta Integrator Free Plan organization in September 2026. Creating the Okta organization is outside this guide. For account linking and settings access, see Personal sign-in and SSO sign-in.

Before you start

• SSO must be available: any hosted plan or self-hosted Enterprise.
• Sign in to Kanroo personally by email as the organization owner.
• Have Okta administrator access and an active Okta user with the owner’s Kanroo email address.
• Keep users’ mailboxes accessible for the initial Kanroo email verification.
• The browser and Kanroo server must be able to reach Okta over HTTPS. Self-hosted operators must configure the OIDC encryption keyring before storing a client secret.

1. Configure the Okta application

In Kanroo, open Settings → SSO and copy the displayed Redirect URL.

In Okta, open Applications → Applications → Create App Integration. Some consoles label the first menu Applications and Resources. Choose Classic experience if prompted.

Setting	Value
Sign-in method	OIDC – OpenID Connect
Application type	Web Application
App integration name	Kanroo
Grant type	Authorization Code only
Sign-in redirect URIs	The exact Callback URL from Kanroo; remove defaults and use no wildcards
Sign-out redirect URIs	Empty
Trusted Origins / Base URIs	Empty
Require DPoP header	Off
Assignments	Skip group assignment for now

Save. Under General → Client Credentials → Edit, select Client secret, enable the requirement for a PKCE code challenge, and save. Keep Login initiated by set to App Only. Copy the Client ID and Client Secret; keep the secret private. See Okta’s application settings.

Under Assignments → Assign → Assign to People, assign the owner’s Okta user. Retain the email address as the application username, then select Save and Go Back → Done. Assign each intended member as well, or use assignments to selected groups for your organization. See Okta’s assignment instructions.

2. Connect the organization

(enlarge)

In Kanroo’s Settings → SSO, check that the Redirect URL (box 1) is the one you registered, then enter these values in the provider fields (box 2):

Field	Value
Issuer URL	Your Okta organization URL, for example https://your-company.okta.com
Client ID	The application’s Client ID
Client Secret	The application’s Client Secret

This guide uses Okta’s built-in Org Authorization Server for SSO. Use the organization URL without /oauth2/default or /.well-known/openid-configuration. See Okta authorization servers.

Choose Save draft (box 3), then select Test and connect. Sign in as the owner’s assigned Okta user, then enter the email verification code sent by Kanroo. The connection should show Connected. If the browser is signed in as a different Okta administrator, sign out of Okta first. Leave Require SSO off while testing member access.

3. Admit members and check sign-in

Invite members in Kanroo, or enable automatic joining (JIT). With JIT enabled, assigned Okta users can join as Members without a Kanroo invitation, subject to organization limits. Restrict Okta application assignments to the intended users.

Members select Continue with SSO on the Kanroo sign-in page and enter the organization’s slug, or open the SSO sign-in link you copy from Settings → SSO, which preselects the organization. The first login includes Kanroo email verification. After signing out and repeating SSO sign-in, no further linking code is needed. An existing Okta session may complete that return automatically.

Check that the owner remains Owner and a new JIT user appears as Member. A SSO-only session shows Personal verification required in place of API keys, security activity, and Webhooks; verifying the account email in place opens them, and this does not change roles.

4. Require SSO

As the owner, return to Settings → SSO using personal sign-in if needed. Generate Recovery codes, complete the email verification, save the codes, and acknowledge that they are saved. Enable Require SSO and confirm.

In a separate browser session, sign a member out of Kanroo and sign in personally by email. Opening the organization must require SSO sign-in; completing Okta login restores access.

For recovery and offboarding, see SSO help. Removing an Okta assignment alone does not immediately revoke an existing Kanroo session’s SSO access; remove departing members in Kanroo too.