Connecting Okta to Landfall

Two independent connections, both configured from Landfall's own Settings → Security screen: Okta as your organization's sign-in provider (OIDC), and Okta as the source of truth for who's on your team (SCIM). Set up either one alone, or both together.

What you'll need

• Okta admin access (Super Admin, or an admin role that can create apps).
• An admin seat on your Landfall organization.
• For the SSO half: Landfall's SSO plan entitlement. For the SCIM half: Landfall's SCIM plan entitlement.

Part 1 — Sign-in (OIDC)

1. Okta Admin Console → Applications → Create App Integration

   Choose OIDC — OpenID Connect as the sign-in method, and Web Application as the application type.

   yourorg.okta.com/admin/apps/add-app

   🖼Okta's "Create a new app integration" dialog with OIDC / Web Application selected.

2. Sign-in redirect URI

   In Landfall, open Settings → Security → Single sign-on first — the exact callback URL to paste into Okta's Sign-in redirect URIs field is shown right there:

   https://<your-landfall-domain>/o/<your-org-slug>/auth/sso/callback

3. Copy the client credentials, paste them into Landfall

   After saving, Okta shows a Client ID and Client secret under the app's General tab. In Landfall's Single sign-on panel, fill in a display name (e.g. "Okta"), the issuer (https://yourorg.okta.com), the client ID, and the client secret, then save. The secret is write-only — Landfall never shows it back once saved.

4. Run a test sign-in, then activate

   Landfall requires a real test sign-in through the provider before anyone else can use it — click Run a test sign-in, complete it as yourself, then Activate for everyone.

Part 2 — User provisioning (SCIM)

Okta's App Integration Wizard supports SCIM provisioning directly on the same app you created above (or a separate one, if you'd rather keep sign-in and provisioning apart).

1. Enable SCIM in Landfall first

   In Landfall's Settings → Security → SCIM provisioning panel, click Enable SCIM. Copy the base URL shown, and copy the bearer token — it is shown exactly once.

2. Okta app → General → App Settings → Provisioning

   Edit the app, check Enable SCIM provisioning, then open the new Provisioning tab and choose Configure API Integration.

   yourorg.okta.com/admin/app/.../instance/.../provisioning

   🖼Okta's Provisioning tab, "Configure API Integration" panel with SCIM connector base URL and API token fields.

3. Paste the base URL and token

   Set SCIM connector base URL to the base URL Landfall showed you, and API Token (Okta's field for the bearer credential) to the token — Okta sends it as Authorization: Bearer <token>. Click Test API Credentials to confirm Okta can reach Landfall.

4. Turn on the provisioning features you want

   Under To App, enable Create Users, Update User Attributes, and Deactivate Users. Assign people or groups to the app to start provisioning them.

5. Map a group to a Landfall role (optional)

   By default, a provisioned person with no matching group gets Landfall's default role. To grant a specific role to an Okta group, push that group to the app (Okta's Push Groups tab), then add a matching row in Landfall's SCIM panel — group name to role key. Landfall never invents this mapping on its own from an Okta sync; you set it explicitly, once, and it survives every future sync unchanged.

Okta console steps last verified against Okta's own documentation: 2026-09-11.