SSO using OIDC

Open the Okta admin console

Sign in to https://<your-tenant>-admin.okta.com.In the left navigation, go to Applications → Applications and click Create App Integration.

Select the app type

In the dialog that appears, set:

• Sign-in method: OIDC – OpenID Connect
• Application type: Web Application

Click Next.

Fill in the app settings

Give the app a name — e.g. Bifrost Enterprise.Under Grant type, enable Authorization Code only.In Sign-in redirect URIs, add:

https://<your-bifrost-domain>/login

Optionally, to use claim discovery during setup, also add:

https://<your-bifrost-domain>/workspace/scim/oauth-discover-callback

Under Assignments, select Skip group assignment for now.Click Save.

Open the Sign On tab

In your Bifrost Enterprise app, go to the Sign On tab.

Scroll down to find the token claims section. This is where you control what attributes Okta includes in the JWT token sent to Bifrost.

Any attribute you add here is available in Bifrost for role, team, or business unit mappings.You can use an Okta expression to derive or transform values:

user.department
user.profileUrl != null ? user.profileUrl : "default"

Add a groups claim

To sync group membership, add a groups claim under the OpenID Connect ID Token section. Set:

• Claim name: groups
• Value type: Groups
• Filter: Matches regex .* (or a tighter prefix like bifrost-.*)

Click Save.

This path works for the Org Authorization Server and adds the claim to ID tokens only. If you are using a Custom Authorization Server, expand the section below instead.

Using a Custom Authorization Server

Use this path when Bifrost is configured with a Custom Authorization Server. This adds the groups claim through your authorization server and supports both ID and access tokens.

1. Navigate to Security → API → Authorization Servers
2. Select your authorization server (e.g. default)

3. Go to the Claims tab and click Add Claim
4. Configure the claim:

Field	Value
Name	groups
Include in token type	ID Token, Always
Value type	Groups
Filter	Matches regex .* (or a prefix like bifrost-.*)
Include in	Any scope

5. Click Create

Open the Assignments tab

In your Bifrost Enterprise app, go to the Assignments tab.Click Assign → Assign to People or Assign to Groups.

Select users or groups

Select the users or groups that should have access to Bifrost and click Done.

Only users explicitly assigned to the application can authenticate via Okta.

Copy the Client ID and Secret

Open the General tab of your Bifrost Enterprise app.Copy the following — you will need them in Step 5:

• Client ID
• Client Secret (click to reveal)

Note your Issuer URL

Create an API token (optional)

If you want Bifrost to automatically sync users and groups from Okta every 24 hours, you need to create an API token.Go to Security → API → Tokens and click Create token. Give it a name, then copy the token value — it will only be shown once.

This background sync runs every 24 hours and reconciles users, roles, and group memberships — catching anything that may have been missed if you also have SCIM set up. You can skip this if you plan to rely on SCIM push alone, but the two work well together.

Open User Provisioning and choose Okta

In your Bifrost dashboard, go to Governance → User Provisioning.Select Okta as the identity provider and click Next.

Fill in the provider configuration

Enter the credentials you copied in Step 4:

• Issuer URL: your Okta issuer URL
• Authorization Server: Org or Custom — match your Okta setup
• Client ID: from the Okta app General tab
• Client Secret: from the Okta app General tab
• Audience: required only for Custom Authorization Server
• API Token: optional — paste the token from Step 4 if you want 24-hour background sync

Click Verify & Next to confirm the connection.

Discover claims

On the Attribute Mapping screen, click Discover Claims.Bifrost opens a sign-in popup — no session is created.Once you authenticate, it returns the exact claims your Okta tenant is sending in the JWT.Use this to confirm that the attributes you set up in Step 2 — such as groups, department, or division — are present before building your mappings.

Set up attribute mappings

Use the sections below the claim list to map Okta claim values to Bifrost roles, teams, and business units.Attribute-to-Role MappingsMap a claim value to a Bifrost role.

• All matching rules are evaluated — if multiple rules match, the role with the highest permissions is assigned
• If no rule matches, the user is not assigned a role and login is denied

Attribute-to-Team MappingsMap a claim value to a Bifrost team. All matching rules apply.

• Use * as the value to sync the claim value directly as the team name
• Use ${*} to extract part of the string — e.g. Bifrost Playground: ${*} Team matches Bifrost Playground: Alpha Team and creates team Alpha

Attribute-to-Business Unit MappingsSame wildcard support as team mappings.

• Use ${*} to extract a substring as the business unit name — e.g. Bifrost Playground: ${*} BU matches Bifrost Playground: Alpha BU and creates business unit Alpha
• When a rule matches, the resolved business unit is assigned to all of that user’s teams
• Manually assigned teams are left unchanged

Click Next when done.

Review and enable

Review your configuration on the final screen, then click Enable.

Restart your Bifrost server after enabling for the changes to take effect.