How do I configure Okta OIDC SSO?

Last updated: October 15, 2026

At a glance

  • Typical setup time: About 15 minutes

  • Who you need: An Okta administrator

  • What Hadrius reads: Each user's Okta profile at sign-in

Before you begin

You need administrator access to the Okta Admin Console with permission to create app integrations.

In Okta

Create an OIDC app integration

In the Okta Admin Console, go to Applications in the left navigation and create a new app integration.

  1. Under Sign-in method, select OIDC - OpenID Connect.

  2. Under Application type, select Web Application.

Configure the app settings

Name

Set App integration name to Hadrius. If you'd like a logo, contact the Hadrius team and we'll send you a high-resolution file.

Grant types

Under Core grants, select both Authorization Code and Refresh Token.

Redirect URIs

Set both Sign-in redirect URIs and Sign-out redirect URIs to:
https://app.hadrius.com/auth/sso

Assign users

Under Assignments, choose who can sign in to Hadrius with Okta. For example, you can allow everyone in your organization.

Okta Assignments section with 'Allow everyone in your organization to access' selected

Grant the profile scope

On the Okta API Scopes tab, grant okta.myAccount.profile.read so Hadrius can read profile information.

Set a static Issuer URL

On the Sign On tab, scroll to OpenID Connect ID Token and set Issuer to a static URL (the Okta URL, not Dynamic).

OpenID Connect ID Token section showing the static URL option

In Hadrius

Add the credentials

On the General tab, copy the Client ID and Client secret. On the Okta SSO integration page in Hadrius, paste them into the Client ID and Client secret fields, and enter your Okta domain, without https://, in the Okta domain field (for example, company.okta.com).

The client secret is sensitive. Paste it directly into Hadrius and don't share it by email or chat.

Issuer URL set to static value

Choose who signs in with SSO

Once the credentials are saved, the Choose who signs in with SSO step opens. Requirement status sets how strictly SSO is enforced:

  • Not required: everyone can choose SSO or their password.

  • Required for internal users: people on your Internal domains must use SSO. Everyone else can still use a password.

  • Required for all users: everyone must use SSO. Hadrius won't allow this while any existing user's email domain is missing from the list, so nobody is locked out.

The domains table lists the email domains that can sign in through Okta. Your firm's own email domain is always first and always Internal. To add more, paste them into Add domains, one per line or separated by commas, and set each one to Internal (your own staff) or External (for example consultants or affiliates).

Your edits appear under Unsaved changes, where you can undo any of them. Click Save there to apply them.