Okta sign-in
By Lena Fischer · created 15 May 2026, 09:10 UTC · last updated 24 Jun 2026, 14:00 UTC · version 7
specoktasingle-sign-onsaml
Owner: Lena Fischer · Epic: ENG-1436 · Shipped: Monday 22 June · Shaped in Emargen as "Okta sign-in for Vossberg"
Why
Vossberg, our largest customer, uses Okta. Our single sign-on had only ever been tested with Entra ID.
What we built
- Single sign-on with Okta over SAML 2.0, depot by depot, like Entra ID: one app per depot in Okta, a switch per depot in the portal.
- Okta groups give roles at every sign-in, as Entra ID groups do.
- Depot from an attribute. A customer can send each person's depot code in a SAML attribute; the attribute's name is set per customer (Vossberg's is
vossbergDepot). identity-service checks the person belongs to the depot they sign in at, and refuses the sign-in if the attribute is missing. - Support loads each depot's Okta metadata. (Customers upload it themselves since SAML metadata upload in August.)
What we left out
- Accounts made from Okta (SCIM).
- Sign-in with OpenID Connect instead of SAML.
- Okta's device checks.
Found on the way
- 16 June: Vossberg's first test sign-in failed because the test account had no depot attribute (SUP-958). The refusal message now names the missing attribute.
Rollout
Vossberg's 60 depots over five evenings, 22 June to 26 June: Vossberg: Okta sign-in rollout. Ridgeway Freight followed in July.