Okta OIDC Single Sign-On
Connect Okta as your identity provider for Global Zanrefsi
Overview
Global Zanrefsi uses OpenID Connect (OIDC) — not SAML — for single sign-on. Okta acts as the identity provider (IdP): when a user signs in, Okta authenticates them and returns an ID token that Global Zanrefsi validates to create or resume the user's session.
This guide walks administrators through creating the Okta OIDC app, copying credentials into the platform, and optionally enabling SCIM for automatic user lifecycle sync.
Prerequisites
- Okta Admin access — you need an Okta account with permission to create OIDC applications (Okta Administrator or Application Administrator role).
- Global Zanrefsi Admin access — platform admin role to configure SSO in the Base44 dashboard.
- A verified company domain — e.g.
globalzanrefsi.org— for enterprise SSO enforcement and auto-provisioning.
Step 1 — Configure in Okta
Create an OIDC Web Application
Sign in to your Okta Admin Console and navigate to:
Applications → Applications → Browse App Catalog → Create New App
Select OIDC - OpenID Connect as the sign-in method, and Web Application as the application type.
Set the Sign-in Redirect URI
In the application's Sign-in redirect URIs field, paste the redirect URI that matches your chosen scope. See the Redirect URIs section below to copy the correct value.
You can add both app-level and workspace-level URIs if you use both scopes.
Configure Sign-out (Optional)
In Sign-out redirect URIs, add your app's home URL so users land back on Global Zanrefsi after signing out of Okta:
https://globalzanrefsi.org
Assign Users and Groups
Under the Assignments tab, assign the users or groups that should be able to sign in to Global Zanrefsi via this OIDC app. You can assign everyone or restrict to specific groups (e.g. GZ_Staff).
Copy Your Credentials
On the application's General tab, copy these three values — you'll paste them into Global Zanrefsi next:
- Client ID — e.g.
0oa1b2c3d4e5f6g7h8i9 - Client Secret — revealed once when created
- Okta Domain — e.g.
yourtenant.okta.com
Step 2 — Configure in Global Zanrefsi
SSO credentials are entered in the Base44 dashboard — Global Zanrefsi runs on the Base44 platform, which manages the OIDC handshake server-side. The in-app SSO Admin Console tracks configuration status but does not store the secret itself.
Open the Authentication Settings
In the Base44 dashboard, navigate to:
App Settings → Authentication → Single Sign-On → Set Up → Okta
Enter Okta Credentials
Paste the values you copied from Okta:
| Field | Value |
|---|---|
| Client ID | 0oa1b2c3d4e5f6g7h8i9 |
| Client Secret | your-client-secret |
| Okta Domain | yourtenant.okta.com |
| Scopes | openid email profile |
Enable SSO
Toggle Enable SSO and save. The platform will use Okta's authorization endpoint (https://yourtenant.okta.com/oauth2/v1/authorize) for the OIDC authorization-code flow.
Mark as Configured (Optional)
After enabling, visit the SSO Admin Console and set the Okta provider status to
Redirect URIs & Endpoints
The redirect URI depends on whether SSO is wired at the app level or the workspace level. Copy the one that matches your setup and paste it into Okta's Sign-in redirect URIs field.
https://app.base44.com/api/apps/{APP_ID}/auth/sso/callbackhttps://app.base44.com/api/workspaces/{WORKSPACE_ID}/auth/sso/callbackSCIM User Provisioning (Optional)
SCIM (System for Cross-domain Identity Management) automatically syncs user lifecycle events — creations, updates, deactivations, and group membership changes — from Okta to Global Zanrefsi. This eliminates manual user invites and ensures deprovisioning happens instantly when an employee leaves.
Enable SCIM in Okta
In your Okta OIDC app, go to the Provisioning tab and enable SCIM. Set the SCIM base URL to the platform's SCIM endpoint (available in Base44 workspace auth settings).
Enable in Base44
In the Base44 dashboard, go to Workspace Settings → Auth & Security and enable SCIM provisioning. Okta will then push user profiles via the standard SCIM 2.0 API.
Map Attributes
Ensure these Okta user attributes map to the platform user fields:
email ← okta user primary email full_name ← okta user firstName + lastName role ← okta group assignment (GZ_Admin → admin)
Testing the Integration
Open an Incognito Window
To avoid session conflicts with your existing Okta admin session, test SSO in a private/incognito browser window.
Trigger the SSO Login
Navigate to Global Zanrefsi and click Sign In. If SSO is enabled and your email domain is verified, you'll be redirected to Okta's login page.
Authenticate in Okta
Sign in with your Okta credentials (including MFA if configured). Okta will redirect back to Global Zanrefsi with an authorization code, which the platform exchanges for an ID token.
Verify the Session
You should land on your Global Zanrefsi dashboard, authenticated as your Okta user. Check the SSO Admin Console and mark the test result as
Troubleshooting
"redirect_uri mismatch" error
The redirect URI in Okta doesn't exactly match the one the platform sends. Copy the exact URI from the Redirect URIs section above — it must be character-for-character identical, including https:// and trailing slashes.
"invalid_client" error
The Client ID or Client Secret is incorrect. Re-copy both from the Okta app's General tab and re-enter them in the Base44 dashboard. Remember that Okta only shows the Client Secret once — if you lost it, generate a new one.
User not assigned to the Okta app
Okta will reject logins from users not assigned to the OIDC application. In Okta, go to the app's Assignments tab and add the user or their group.
SSO works but user isn't provisioned
If SCIM is not enabled, the first SSO login creates the user automatically (JIT provisioning). If JIT is disabled and SCIM is off, the user must be invited manually via the User Management page before they can sign in.