> ## Documentation Index
> Fetch the complete documentation index at: https://artie.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on (SSO)

> Set up single sign-on (SSO) for your Artie dashboard using OIDC providers like Okta, including step-by-step configuration and SCIM user provisioning.

Artie supports single sign-on to your dashboard via OIDC. If you are using Okta, we have provider specific documentation for setting up SSO. If you are using another provider, just contact us!

<Accordion title="Okta">
  <Note>
    You need to be your company's Okta and Artie admin to set this up
  </Note>

  <Steps>
    <Step title="Create an Artie Okta application">
      To create an app, please do the following:

      1. Log in to your Okta admin dashboard
      2. Go to Applications > Applications
      3. Click "Create App Integration", select "OIDC - OpenID Connect", and pick "Web Application"
    </Step>

    <Step title="Fill in the form with the following values">
      * Application Name: Artie
      * Grant type: Only "Authorization Code" should be selected
      * Sign-in redirect URIs: `https://api.artie.com/sso/okta/callback`
      * Sign-out redirect URIs: `https://api.artie.com/logout`
      * (Optional) If you want to enable Artie as an Okta tile app. You can also specify `https://api.artie.com/sso/okta/login` as the "Initiate login URI"
    </Step>

    <Step title="Retrieve your credentials">
      * Client ID
      * Client secret
      * Okta domain (You can get this from the top right navigation bar)

              <img src="https://mintcdn.com/artie/cR74rDu7gj_LCvTI/assets/okta/client_id_secret.png?fit=max&auto=format&n=cR74rDu7gj_LCvTI&q=85&s=a98737479393ed521e0474b2ad4eeff6" alt="Client ID and secret" width="944" height="990" data-path="assets/okta/client_id_secret.png" />

              <img src="https://mintcdn.com/artie/cR74rDu7gj_LCvTI/assets/okta/okta_url.png?fit=max&auto=format&n=cR74rDu7gj_LCvTI&q=85&s=132e1a6c1afe128c7467ae6cab8b5db5" alt="Retrieving your Okta domain" width="455" height="444" data-path="assets/okta/okta_url.png" />
    </Step>
  </Steps>
</Accordion>

## Provisioning users (SCIM)

Artie supports automatic provisioning and deprovisioning users from Okta via SCIM integration (beta) -- for access to this feature, contact us!

<Accordion title="Okta">
  <Note>
    This integration is used for provisioning only. Artie does not support SAML/SWA login through this SCIM app.

    To enable SSO, you must configure a separate SSO application in Okta.
  </Note>

  <Steps>
    <Step title="Create SCIM API key in Artie">
      In Artie, [Settings > Authentication](https://app.artie.com/settings?tab=authentication), create a new API key with the `SCIM` API key type.

      <Frame>
        <img src="https://mintcdn.com/artie/HctSyTJLvXKbfyLs/images/create_artie_scim_api_key.png?fit=max&auto=format&n=HctSyTJLvXKbfyLs&q=85&s=69ad35a45da19e1d633fcdb3316da1b9" alt="Create Artie SCIM API Key" width="1115" height="374" data-path="images/create_artie_scim_api_key.png" />
      </Frame>

      Copy and securely store the key. You will use it during Okta configuration.

      <Frame>
        <img src="https://mintcdn.com/artie/HctSyTJLvXKbfyLs/images/copy_artie_scim_secret_key.png?fit=max&auto=format&n=HctSyTJLvXKbfyLs&q=85&s=deeca86937afc5b4083d3547cecd6954" alt="Copy Artie Scim Secret Key" width="1124" height="331" data-path="images/copy_artie_scim_secret_key.png" />
      </Frame>
    </Step>

    <Step title="Create an Artie Okta SCIM application">
      Add the [Oauth Bearer Token Governance with SCIM 2.0](https://www.okta.com/integrations/oauth-bearer-token-governance-with-scim-2-0/) integration to your Okta tenant.

      <Steps>
        <Step title="Installation">
          On the **General Settings** page:

          * Set the **Application label** (for example: `Artie SCIM`).
          * Under **Application visibility**, uncheck `Display application icon to users`

            > This application should not be visible to end users because it does not support login.
        </Step>

        <Step title="Configure sign-on settings">
          On the next page:

          * Ignore most **SAML** and **SWA** fields, as the integration does not support login.
          * Under **Credentials Details**:
            * Set **Application username format** to `Email`

          Click **Next**.
        </Step>
      </Steps>
    </Step>

    <Step title="Configure SCIM application">
      Open the newly created application and complete the following:

      <Steps>
        <Step title="Configure SCIM provisioning">
          * Navigate to the **Provisioning** tab.
          * Click **Configure API Integration**.
          * Check `Enable API integration `
          * Configure the following:
            * **Base Url:** `https://api.artie.com/scim/v2`
            * **OAuth Bearer Token:** Paste the **SCIM API key** generated in Step 1.
            * **Import Groups:** Leave unchecked, as Artie's SCIM integration does not support groups.
          * Click **Test Integration**, then **Save**.
        </Step>

        <Step title="Enable SCIM provisioning">
          * In the **Provisioning** tab, select **To App**.
          * Click **Edit**.
          * Enable:
            * **Create Users**
            * **Deactivate Users**
          * Click **Save**.
        </Step>
      </Steps>
    </Step>

    <Step title="Assign users to Artie.">
      * Navigate to the **Assignments** tab.
      * Click **Assign**.
      * Assign users or groups to the application.

      Assigned users will be automatically provisioned to Artie with normal permissions.
    </Step>
  </Steps>
</Accordion>

## Configuring this on Artie

Once you have gathered the information from above, go to the [settings](https://app.artie.com/settings) page in your Artie dashboard.

Under "Authentication", you can click "Configure Okta SSO". Once all the necessary information is filled out, users can now [log in](https://app.artie.com/login/sso) through Okta SSO.

## Questions

<Accordion title="User login flow">
  To log in through SSO, users would:

  1. Go to the [SSO login screen](https://app.artie.com/login/sso)
  2. Enter their company email address
  3. If matched, an email will be sent to the user to log in
  4. It will prompt them to log in through their configured IDP
  5. They will then be redirected and authenticated into Artie
</Accordion>