Gardience Documentation
gardience.com →
Docs / Administration

Set up sign-in with Okta

This page connects your company's Okta to Gardience, so people sign in to the console with their Okta account and Okta's group membership decides their Gardience role. These steps were tested with Okta in October 2026. Okta changes its screens from time to time, so a menu name may differ slightly.

Pick one method. Gardience runs one at a time.

In the steps below, replace https://gardience.example.com with the public address of your console (see Before you start).

Step 1: Make an Okta group for each Gardience role

  1. In the Okta admin console, open Directory > Groups > Add group.
  2. Name it, for example Gardience-Admins, and save.
  3. Open the group, click Assign people, and add the people who should be Gardience admins.
  4. Repeat for any other roles you want, for example Gardience-Operators or Gardience-Viewers.

Option A: OpenID Connect

In Okta

  1. Open Applications > Applications > Create App Integration.
  2. Choose OIDC - OpenID Connect, then Web Application, then Next.

  3. Fill in the form:

    • App integration name: Gardience.
    • Grant type: only Authorization Code checked.
    • Sign-in redirect URIs: https://gardience.example.com/gardience/sso/callback.
    • Sign-out redirect URIs: remove the default so it is empty.
    • Assignments: Limit access to selected groups, then choose your Gardience groups.
  4. Click Save. Note the Client ID and Client secret on the app's General tab.

  5. Okta does not put groups in the sign-in token unless you add them. Current Okta screens have no groups setting on the app itself, so add it on the authorization server:

    1. Open Security > API > Authorization Servers and click default.

    2. On the Claims tab, click Add Claim and fill in:

      • Name: groups
      • Include in token type: ID Token, Always
      • Value type: Groups
      • Filter: Matches regex, .* (or Starts with Gardience to send only your Gardience groups)
      • Include in: Any scope
    3. Click Create.

  6. Still on the default authorization server, open the Access Policies tab. Okta refuses every sign-in through this server until it has a policy with a rule:

    1. If no policy is listed, click Add Policy, name it Gardience, assign it to All clients, and create it.
    2. In the policy, click Add rule, name it allow, keep the defaults, and click Create rule.

In Gardience

  1. Open Settings > Single sign-on and set Protocol to OpenID Connect.

  2. Fill in:

    • Public URL of this Gardience: https://gardience.example.com
    • Issuer URL: https://YOUR-ORG.okta.com/oauth2/default (your Okta address followed by /oauth2/default)
    • Client ID and Client secret from step 4 above.
    • Leave Scopes, User name claim and Groups claim at their defaults.
  3. Under Groups to roles, add a row for each Okta group, with the group name exactly as in Okta, for example Gardience-Admins mapped to admin.
  4. Click Save, then Test connection. A good result names the issuer and how many signing keys it found.
  5. Tick Turn on single sign-on and click Save.

Option B: SAML 2.0

In Okta

  1. Open Applications > Applications > Create App Integration, choose SAML 2.0, then Next.
  2. App name: Gardience, then Next.

  3. Fill in:

    • Single sign-on URL: https://gardience.example.com/gardience/sso/saml/acs. Leave Use this for Recipient URL and Destination URL checked.
    • Audience URI (SP Entity ID): https://gardience.example.com/gardience/sso/saml/metadata
    • Name ID format: Unspecified. Application username: Okta username.

  4. Add a group statement so Okta sends people's groups. In current Okta screens it is under Attribute statements > Show legacy configuration > Group Attribute Statements (older screens show it directly):

    • Name: groups
    • Name format: Basic
    • Filter: Matches regex, .* (or Starts with Gardience)
  5. Click Next, choose I'm an Okta customer adding an internal app, and click Finish.
  6. On the app's Assignments tab, click Assign > Assign to Groups and add your Gardience groups.
  7. On the app's Sign On tab, copy the Metadata URL.

In Gardience

  1. Open Settings > Single sign-on, set Protocol to SAML 2.0, set Public URL of this Gardience, and click Save.
  2. Paste the Okta Metadata URL into IdP metadata URL.
  3. Leave Groups claim / attribute as groups.
  4. Under Groups to roles, map each Okta group name to a Gardience role.
  5. Click Save, then Test connection. A good result names the identity provider found in the metadata.
  6. Tick Turn on single sign-on and click Save.

Check that it works

  1. Open a private browser window and go to your console.
  2. Click the single sign-on button and sign in with an Okta account that is in a mapped group. Okta asks for any second factor your Okta policy requires.
  3. The console should show you signed in with the role of your group. The audit log records it as sso.login.

If Gardience says No Gardience access, Okta signed the person in but sent no group that matches a mapping. Check the person is in the group, the group is assigned to the app, and the group name in Gardience matches Okta's exactly.

PreviousSingle sign-on and directory accountsNextGovernment sign-in (notice, marking banner, smart cards)
Gardience by Bouziden Management LLC.