[{"data":1,"prerenderedAt":1223},["ShallowReactive",2],{"navigation_docs_en":3,"-en-sign-in-and-directories-okta":427,"-en-sign-in-and-directories-okta-surround":1218},[4,31,117,188,238,271,310,369,378],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":30},"Getting started","i-hugeicons-rocket-01","\u002Fen\u002Fgetting-started","en\u002F01.getting-started",[10,15,20,25],{"title":11,"path":12,"stem":13,"icon":14},"What is DDM?","\u002Fen\u002Fgetting-started\u002Fwhat-is-ddm","en\u002F01.getting-started\u002F01.what-is-ddm","i-hugeicons-information-circle",{"title":16,"path":17,"stem":18,"icon":19},"Account and sign-in","\u002Fen\u002Fgetting-started\u002Fsign-in","en\u002F01.getting-started\u002F02.sign-in","i-hugeicons-key-01",{"title":21,"path":22,"stem":23,"icon":24},"AI in DDM","\u002Fen\u002Fgetting-started\u002Fai-in-ddm","en\u002F01.getting-started\u002F03.ai-in-ddm","i-hugeicons-ai-magic",{"title":26,"path":27,"stem":28,"icon":29},"System status","\u002Fen\u002Fgetting-started\u002Fsystem-status","en\u002F01.getting-started\u002F04.system-status","i-hugeicons-activity-03",false,{"title":32,"icon":33,"path":34,"stem":35,"children":36,"page":30},"CMS","i-hugeicons-dashboard-square-01","\u002Fen\u002Fcms","en\u002F02.cms",[37,42,47,52,57,62,67,72,77,82,87,92,97,102,107,112],{"title":38,"path":39,"stem":40,"icon":41},"The CMS at a glance","\u002Fen\u002Fcms\u002Foverview","en\u002F02.cms\u002F01.overview","i-hugeicons-compass-01",{"title":43,"path":44,"stem":45,"icon":46},"Uploading documents","\u002Fen\u002Fcms\u002Fupload","en\u002F02.cms\u002F02.upload","i-hugeicons-upload-01",{"title":48,"path":49,"stem":50,"icon":51},"Categories","\u002Fen\u002Fcms\u002Fcategories","en\u002F02.cms\u002F03.categories","i-hugeicons-folder-tree",{"title":53,"path":54,"stem":55,"icon":56},"Editing documents","\u002Fen\u002Fcms\u002Fdocuments","en\u002F02.cms\u002F04.documents","i-hugeicons-file-edit",{"title":58,"path":59,"stem":60,"icon":61},"Searching and filtering","\u002Fen\u002Fcms\u002Fsearch-and-filters","en\u002F02.cms\u002F05.search-and-filters","i-hugeicons-search-01",{"title":63,"path":64,"stem":65,"icon":66},"Groups and permissions","\u002Fen\u002Fcms\u002Fgroups-and-permissions","en\u002F02.cms\u002F06.groups-and-permissions","i-hugeicons-user-multiple",{"title":68,"path":69,"stem":70,"icon":71},"Users","\u002Fen\u002Fcms\u002Fusers","en\u002F02.cms\u002F07.users","i-hugeicons-user-add-01",{"title":73,"path":74,"stem":75,"icon":76},"Approvals","\u002Fen\u002Fcms\u002Fapprovals","en\u002F02.cms\u002F08.approvals","i-hugeicons-checkmark-badge-01",{"title":78,"path":79,"stem":80,"icon":81},"Markets and translations","\u002Fen\u002Fcms\u002Fmarkets-and-translations","en\u002F02.cms\u002F09.markets-and-translations","i-hugeicons-globe-02",{"title":83,"path":84,"stem":85,"icon":86},"Note templates","\u002Fen\u002Fcms\u002Fnote-templates","en\u002F02.cms\u002F10.note-templates","i-hugeicons-layout-01",{"title":88,"path":89,"stem":90,"icon":91},"Usage and audit log","\u002Fen\u002Fcms\u002Fusage-and-audit","en\u002F02.cms\u002F11.usage-and-audit","i-hugeicons-chart-column",{"title":93,"path":94,"stem":95,"icon":96},"AI assistant","\u002Fen\u002Fcms\u002Fassistant","en\u002F02.cms\u002F12.assistant","i-hugeicons-sparkles",{"title":98,"path":99,"stem":100,"icon":101},"Settings","\u002Fen\u002Fcms\u002Fsettings","en\u002F02.cms\u002F13.settings","i-hugeicons-settings-02",{"title":103,"path":104,"stem":105,"icon":106},"Plans","\u002Fen\u002Fcms\u002Fplans","en\u002F02.cms\u002F14.plans","i-hugeicons-package",{"title":108,"path":109,"stem":110,"icon":111},"Feature requests","\u002Fen\u002Fcms\u002Ffeature-requests","en\u002F02.cms\u002F15.feature-requests","i-hugeicons-idea-01",{"title":113,"path":114,"stem":115,"icon":116},"Report a bug","\u002Fen\u002Fcms\u002Fbug-reports","en\u002F02.cms\u002F16.bug-reports","i-hugeicons-bug-01",{"title":118,"icon":119,"path":120,"stem":121,"children":122,"page":30},"App","i-hugeicons-smart-phone-01","\u002Fen\u002Fapp","en\u002F03.app",[123,128,133,138,143,147,152,157,162,167,170,173,176,179,184],{"title":124,"path":125,"stem":126,"icon":127},"Signing in and finding your way","\u002Fen\u002Fapp\u002Foverview","en\u002F03.app\u002F01.overview","i-hugeicons-login-03",{"title":129,"path":130,"stem":131,"icon":132},"Tabs and split view","\u002Fen\u002Fapp\u002Ftabs","en\u002F03.app\u002F02.tabs","i-hugeicons-layout-2-column",{"title":134,"path":135,"stem":136,"icon":137},"Finding and reading documents","\u002Fen\u002Fapp\u002Fdocuments","en\u002F03.app\u002F03.documents","i-hugeicons-file-01",{"title":139,"path":140,"stem":141,"icon":142},"Favorites","\u002Fen\u002Fapp\u002Ffavorites","en\u002F03.app\u002F04.favorites","i-hugeicons-favourite",{"title":144,"path":145,"stem":146,"icon":61},"Searching","\u002Fen\u002Fapp\u002Fsearch","en\u002F03.app\u002F05.search",{"title":148,"path":149,"stem":150,"icon":151},"Notes","\u002Fen\u002Fapp\u002Fnotes","en\u002F03.app\u002F06.notes","i-hugeicons-note-edit",{"title":153,"path":154,"stem":155,"icon":156},"Calendar and appointments","\u002Fen\u002Fapp\u002Fcalendar","en\u002F03.app\u002F07.calendar","i-hugeicons-calendar-03",{"title":158,"path":159,"stem":160,"icon":161},"Sending to customers","\u002Fen\u002Fapp\u002Foutbox","en\u002F03.app\u002F08.outbox","i-hugeicons-sent",{"title":163,"path":164,"stem":165,"icon":166},"Working offline","\u002Fen\u002Fapp\u002Foffline","en\u002F03.app\u002F09.offline","i-hugeicons-wifi-off-01",{"title":93,"path":168,"stem":169,"icon":96},"\u002Fen\u002Fapp\u002Fassistant","en\u002F03.app\u002F10.assistant",{"title":98,"path":171,"stem":172,"icon":101},"\u002Fen\u002Fapp\u002Fsettings","en\u002F03.app\u002F11.settings",{"title":108,"path":174,"stem":175,"icon":111},"\u002Fen\u002Fapp\u002Ffeature-requests","en\u002F03.app\u002F12.feature-requests",{"title":113,"path":177,"stem":178,"icon":116},"\u002Fen\u002Fapp\u002Fbug-reports","en\u002F03.app\u002F13.bug-reports",{"title":180,"path":181,"stem":182,"icon":183},"Desktop app","\u002Fen\u002Fapp\u002Fdesktop-app","en\u002F03.app\u002F14.desktop-app","i-hugeicons-computer",{"title":185,"path":186,"stem":187,"icon":119},"Mobile app","\u002Fen\u002Fapp\u002Fmobile-app","en\u002F03.app\u002F15.mobile-app",{"title":189,"icon":190,"path":191,"stem":192,"children":193,"page":30},"Sign-in & directories","i-hugeicons-security-check","\u002Fen\u002Fsign-in-and-directories","en\u002F04.sign-in-and-directories",[194,198,202,207,212,217,222,226,230,234],{"title":195,"path":196,"stem":197,"icon":19},"Sign-in methods","\u002Fen\u002Fsign-in-and-directories\u002Fsign-in-methods","en\u002F04.sign-in-and-directories\u002F01.sign-in-methods",{"title":199,"path":200,"stem":201,"icon":190},"Single sign-on","\u002Fen\u002Fsign-in-and-directories\u002Fsingle-sign-on","en\u002F04.sign-in-and-directories\u002F02.single-sign-on",{"title":203,"path":204,"stem":205,"icon":206},"Directory services (LDAP)","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-services","en\u002F04.sign-in-and-directories\u002F03.directory-services","i-hugeicons-hierarchy",{"title":208,"path":209,"stem":210,"icon":211},"Synchronisation and sign-in","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-sync","en\u002F04.sign-in-and-directories\u002F04.directory-sync","i-hugeicons-refresh",{"title":213,"path":214,"stem":215,"icon":216},"Microsoft Entra ID","\u002Fen\u002Fsign-in-and-directories\u002Fmicrosoft-entra-id","en\u002F04.sign-in-and-directories\u002F05.microsoft-entra-id","i-hugeicons-building-03",{"title":218,"path":219,"stem":220,"icon":221},"Okta","\u002Fen\u002Fsign-in-and-directories\u002Fokta","en\u002F04.sign-in-and-directories\u002F06.okta","i-hugeicons-finger-print",{"title":223,"path":224,"stem":225,"icon":81},"Google Workspace","\u002Fen\u002Fsign-in-and-directories\u002Fgoogle-workspace","en\u002F04.sign-in-and-directories\u002F07.google-workspace",{"title":227,"path":228,"stem":229,"icon":119},"Two-factor authentication","\u002Fen\u002Fsign-in-and-directories\u002Ftwo-factor-authentication","en\u002F04.sign-in-and-directories\u002F08.two-factor-authentication",{"title":231,"path":232,"stem":233,"icon":221},"Passkeys","\u002Fen\u002Fsign-in-and-directories\u002Fpasskeys","en\u002F04.sign-in-and-directories\u002F09.passkeys",{"title":235,"path":236,"stem":237,"icon":156},"Calendar access","\u002Fen\u002Fsign-in-and-directories\u002Fcalendar-access","en\u002F04.sign-in-and-directories\u002F10.calendar-access",{"title":239,"icon":240,"path":241,"stem":242,"children":243,"page":30},"MCP server","i-hugeicons-ai-network","\u002Fen\u002Fmcp-server","en\u002F05.mcp-server",[244,248,253,257,262,266],{"title":245,"path":246,"stem":247,"icon":240},"Overview","\u002Fen\u002Fmcp-server\u002Foverview","en\u002F05.mcp-server\u002F01.overview",{"title":249,"path":250,"stem":251,"icon":252},"Setup","\u002Fen\u002Fmcp-server\u002Fsetup","en\u002F05.mcp-server\u002F02.setup","i-hugeicons-plug-socket",{"title":254,"path":255,"stem":256,"icon":111},"What you can do with it","\u002Fen\u002Fmcp-server\u002Fuse-cases","en\u002F05.mcp-server\u002F03.use-cases",{"title":258,"path":259,"stem":260,"icon":261},"Tools","\u002Fen\u002Fmcp-server\u002Ftools","en\u002F05.mcp-server\u002F04.tools","i-hugeicons-wrench-01",{"title":263,"path":264,"stem":265,"icon":76},"Approving changes","\u002Fen\u002Fmcp-server\u002Fapproving-changes","en\u002F05.mcp-server\u002F05.approving-changes",{"title":267,"path":268,"stem":269,"icon":270},"Administration & security","\u002Fen\u002Fmcp-server\u002Fadmin-and-security","en\u002F05.mcp-server\u002F06.admin-and-security","i-hugeicons-shield-key",{"title":272,"icon":273,"path":274,"stem":275,"children":276,"page":30},"External sources","i-hugeicons-database-sync","\u002Fen\u002Fexternal-sources","en\u002F06.external-sources",[277,280,285,290,295,300,305],{"title":245,"path":278,"stem":279,"icon":273},"\u002Fen\u002Fexternal-sources\u002Foverview","en\u002F06.external-sources\u002F01.overview",{"title":281,"path":282,"stem":283,"icon":284},"SharePoint","\u002Fen\u002Fexternal-sources\u002Fsharepoint","en\u002F06.external-sources\u002F02.sharepoint","i-hugeicons-microsoft",{"title":286,"path":287,"stem":288,"icon":289},"OneDrive","\u002Fen\u002Fexternal-sources\u002Fonedrive","en\u002F06.external-sources\u002F03.onedrive","i-hugeicons-folder-cloud",{"title":291,"path":292,"stem":293,"icon":294},"Google Drive","\u002Fen\u002Fexternal-sources\u002Fgoogle-drive","en\u002F06.external-sources\u002F04.google-drive","i-hugeicons-google-drive",{"title":296,"path":297,"stem":298,"icon":299},"FTP \u002F SFTP","\u002Fen\u002Fexternal-sources\u002Fftp-sftp","en\u002F06.external-sources\u002F05.ftp-sftp","i-hugeicons-server-stack-01",{"title":301,"path":302,"stem":303,"icon":304},"REST interface","\u002Fen\u002Fexternal-sources\u002Frest","en\u002F06.external-sources\u002F06.rest","i-hugeicons-api",{"title":306,"path":307,"stem":308,"icon":309},"SOAP interface","\u002Fen\u002Fexternal-sources\u002Fsoap","en\u002F06.external-sources\u002F07.soap","i-hugeicons-source-code",{"title":311,"icon":304,"path":312,"stem":313,"children":314,"page":30},"Integration API","\u002Fen\u002Fintegration-api","en\u002F07.integration-api",[315,318,322,327,332,337,341,346,350,354,359,364],{"title":245,"path":316,"stem":317,"icon":14},"\u002Fen\u002Fintegration-api\u002Foverview","en\u002F07.integration-api\u002F01.overview",{"title":319,"path":320,"stem":321,"icon":19},"Authentication","\u002Fen\u002Fintegration-api\u002Fauthentication","en\u002F07.integration-api\u002F02.authentication",{"title":323,"path":324,"stem":325,"icon":326},"Conventions","\u002Fen\u002Fintegration-api\u002Fconventions","en\u002F07.integration-api\u002F03.conventions","i-hugeicons-book-open-01",{"title":328,"path":329,"stem":330,"icon":331},"Pushing documents","\u002Fen\u002Fintegration-api\u002Fpushing-documents","en\u002F07.integration-api\u002F04.pushing-documents","i-hugeicons-upload-02",{"title":333,"path":334,"stem":335,"icon":336},"Consuming content","\u002Fen\u002Fintegration-api\u002Fconsuming-content","en\u002F07.integration-api\u002F05.consuming-content","i-hugeicons-download-02",{"title":338,"path":339,"stem":340,"icon":137},"Reference: documents","\u002Fen\u002Fintegration-api\u002Freference-documents","en\u002F07.integration-api\u002F06.reference-documents",{"title":342,"path":343,"stem":344,"icon":345},"Reference: categories, tags, markets","\u002Fen\u002Fintegration-api\u002Freference-categories-tags","en\u002F07.integration-api\u002F07.reference-categories-tags","i-hugeicons-folder-01",{"title":347,"path":348,"stem":349,"icon":211},"Reference: sync manifest","\u002Fen\u002Fintegration-api\u002Freference-sync","en\u002F07.integration-api\u002F08.reference-sync",{"title":351,"path":352,"stem":353,"icon":309},"OpenAPI","\u002Fen\u002Fintegration-api\u002Fopenapi","en\u002F07.integration-api\u002F09.openapi",{"title":355,"path":356,"stem":357,"icon":358},"Changelog","\u002Fen\u002Fintegration-api\u002Fchangelog","en\u002F07.integration-api\u002F10.changelog","i-hugeicons-time-schedule",{"title":360,"path":361,"stem":362,"icon":363},"Reference: groups, markets, access","\u002Fen\u002Fintegration-api\u002Freference-groups-access","en\u002F07.integration-api\u002F11.reference-groups-access","i-hugeicons-user-lock-01",{"title":365,"path":366,"stem":367,"icon":368},"Moving from CMWS","\u002Fen\u002Fintegration-api\u002Fcmws","en\u002F07.integration-api\u002F12.cmws","i-hugeicons-arrow-reload-horizontal",{"title":370,"icon":371,"path":372,"stem":373,"children":374,"page":30},"What's new","i-hugeicons-gift","\u002Fen\u002Fwhats-new","en\u002F08.whats-new",[375],{"title":355,"path":376,"stem":377,"icon":358},"\u002Fen\u002Fwhats-new\u002Fchangelog","en\u002F08.whats-new\u002F01.changelog",{"title":379,"icon":299,"path":380,"stem":381,"children":382,"page":30},"Self-hosting","\u002Fen\u002Fself-hosting","en\u002F09.self-hosting",[383,386,390,395,399,404,408,413,418,422],{"title":245,"path":384,"stem":385,"icon":14},"\u002Fen\u002Fself-hosting\u002Foverview","en\u002F09.self-hosting\u002F01.overview",{"title":387,"path":388,"stem":389,"icon":106},"Docker Compose","\u002Fen\u002Fself-hosting\u002Fdocker-compose","en\u002F09.self-hosting\u002F02.docker-compose",{"title":391,"path":392,"stem":393,"icon":394},"Kubernetes","\u002Fen\u002Fself-hosting\u002Fkubernetes","en\u002F09.self-hosting\u002F03.kubernetes","i-hugeicons-cloud",{"title":396,"path":397,"stem":398,"icon":101},"Configuration","\u002Fen\u002Fself-hosting\u002Fconfiguration","en\u002F09.self-hosting\u002F04.configuration",{"title":400,"path":401,"stem":402,"icon":403},"Licence","\u002Fen\u002Fself-hosting\u002Flicence","en\u002F09.self-hosting\u002F05.licence","i-hugeicons-license",{"title":405,"path":406,"stem":407,"icon":211},"Updates","\u002Fen\u002Fself-hosting\u002Fupdates","en\u002F09.self-hosting\u002F06.updates",{"title":409,"path":410,"stem":411,"icon":412},"Postgres","\u002Fen\u002Fself-hosting\u002Fpostgres","en\u002F09.self-hosting\u002F07.postgres","i-hugeicons-database",{"title":414,"path":415,"stem":416,"icon":417},"Backups","\u002Fen\u002Fself-hosting\u002Fbackups","en\u002F09.self-hosting\u002F08.backups","i-hugeicons-database-restore",{"title":419,"path":420,"stem":421,"icon":261},"Troubleshooting","\u002Fen\u002Fself-hosting\u002Ftroubleshooting","en\u002F09.self-hosting\u002F09.troubleshooting",{"title":423,"path":424,"stem":425,"icon":426},"Firewall","\u002Fen\u002Fself-hosting\u002Ffirewall","en\u002F09.self-hosting\u002F10.firewall","i-hugeicons-firewall",{"id":428,"title":218,"body":429,"description":1211,"extension":1212,"links":1213,"meta":1214,"navigation":1215,"path":219,"seo":1216,"stem":220,"__hash__":1217},"docs_en\u002Fen\u002F04.sign-in-and-directories\u002F06.okta.md",{"type":430,"value":431,"toc":1194},"minimark",[432,443,454,459,577,581,591,669,685,704,708,711,775,814,818,938,942,1043,1047,1054,1057,1149,1165,1169],[433,434,435,436,439,440,442],"p",{},"With Okta, your people sign in to DDM through your Okta sign-in page – with your Okta policies and MFA. You create an app integration in Okta and enter it in DDM under ",[437,438,98],"strong",{}," › ",[437,441,199],{},".",[433,444,445,446,449,450,453],{},"You need an Okta administrator who may create app integrations (",[437,447,448],{},"Super Administrator"," or ",[437,451,452],{},"Application Administrator",").",[455,456,458],"h2",{"id":457},"_1-create-the-app-integration","1. Create the app integration",[460,461,463,468,491,495,542,546,556,560],"steps",{"level":462},"3",[464,465,467],"h3",{"id":466},"new-integration","New integration",[433,469,470,471,439,474,439,476,479,480,483,484,487,488,442],{},"In the Okta Admin Console, go to ",[437,472,473],{},"Applications",[437,475,473],{},[437,477,478],{},"Create App Integration",". Choose ",[437,481,482],{},"OIDC – OpenID Connect"," and ",[437,485,486],{},"Web Application",", then ",[437,489,490],{},"Next",[464,492,494],{"id":493},"general-settings","General settings",[496,497,498,509,518,536],"ul",{},[499,500,501,504,505],"li",{},[437,502,503],{},"App integration name:"," ",[506,507,508],"code",{},"DDM",[499,510,511,504,514,517],{},[437,512,513],{},"Grant type:",[437,515,516],{},"Authorization Code"," (preselected)",[499,519,520,523,524,527,528,439,530,532,533],{},[437,521,522],{},"Sign-in redirect URIs:"," the ",[437,525,526],{},"Redirect URI"," from DDM, ",[437,529,98],{},[437,531,199],{}," – e.g. ",[506,534,535],{},"https:\u002F\u002Fcms.documentdistributionmanager.com\u002Fapi\u002Fauth\u002Fsso\u002Fcallback",[499,537,538,541],{},[437,539,540],{},"Sign-out redirect URIs:"," leave empty",[464,543,545],{"id":544},"assignments","Assignments",[433,547,548,549,552,553,555],{},"Under ",[437,550,551],{},"Controlled access",", choose who may use DDM – everybody in your organisation, or selected groups. You can change it later under the app's ",[437,554,545],{}," tab.",[464,557,559],{"id":558},"save","Save",[433,561,562,563,565,566,569,570,573,574,442],{},"Click ",[437,564,559],{},". On the app's ",[437,567,568],{},"General"," tab, copy the ",[437,571,572],{},"Client ID"," and the ",[437,575,576],{},"Client secret",[455,578,580],{"id":579},"_2-enter-it-in-ddm","2. Enter it in DDM",[433,582,548,583,439,585,439,587,590],{},[437,584,98],{},[437,586,199],{},[437,588,589],{},"Identity provider",":",[592,593,594,607],"table",{},[595,596,597],"thead",{},[598,599,600,604],"tr",{},[601,602,603],"th",{},"Field",[601,605,606],{},"Value",[608,609,610,624,640,649,657],"tbody",{},[598,611,612,618],{},[613,614,615],"td",{},[437,616,617],{},"Button label",[613,619,620,621,623],{},"e.g. ",[506,622,218],{}," or your company's name",[598,625,626,631],{},[613,627,628],{},[437,629,630],{},"Issuer",[613,632,633,636,637],{},[506,634,635],{},"https:\u002F\u002F\u003Cyour org>.okta.com"," – the address of your Okta, without ",[506,638,639],{},"-admin",[598,641,642,646],{},[613,643,644],{},[437,645,572],{},[613,647,648],{},"from Okta",[598,650,651,655],{},[613,652,653],{},[437,654,576],{},[613,656,648],{},[598,658,659,664],{},[613,660,661],{},[437,662,663],{},"E-mail claim",[613,665,666],{},[506,667,668],{},"email",[433,670,562,671,487,673,676,677,680,681,442],{},[437,672,559],{},[437,674,675],{},"Test connection",", and switch on ",[437,678,679],{},"Single sign-on active"," – see ",[682,683,199],"a",{"href":684},"\u002Fen\u002Fsign-in-and-directories\u002Fsingle-sign-on#_4-switch-it-on",[686,687,688,689,692,693,439,696,699,700,703],"tip",{},"If your company uses a ",[437,690,691],{},"custom authorisation server"," in Okta (",[437,694,695],{},"Security",[437,697,698],{},"API","), use its issuer instead – e.g. ",[506,701,702],{},"https:\u002F\u002F\u003Cyour org>.okta.com\u002Foauth2\u002Fdefault",". Both work; the issuer is shown on the authorisation server's settings page.",[455,705,707],{"id":706},"map-groups","Map groups",[433,709,710],{},"To have DDM put people into groups by their Okta groups:",[712,713,714,728,757],"ol",{},[499,715,716,717,720,721,724,725,442],{},"In Okta, open the app's ",[437,718,719],{},"Sign On"," tab and, under ",[437,722,723],{},"OpenID Connect ID Token",", click ",[437,726,727],{},"Edit",[499,729,730,731,734,735,738,739,742,743,504,746,749,750,504,753,756],{},"Set ",[437,732,733],{},"Groups claim type"," to ",[437,736,737],{},"Filter",", the claim name to ",[506,740,741],{},"groups",", and a filter – e.g. ",[437,744,745],{},"Matches regex",[506,747,748],{},".*"," for all groups, or ",[437,751,752],{},"Starts with",[506,754,755],{},"DDM-"," for only those meant for DDM. Save.",[499,758,759,760,763,764,766,767,770,771,774],{},"In DDM, under ",[437,761,762],{},"Groups",", enter ",[506,765,741],{}," as the ",[437,768,769],{},"Group claim"," and add a mapping for each group: the ",[437,772,773],{},"name"," of the Okta group and the DDM group.",[686,776,777,778,780,781,784,785,439,787,789,790,439,793,796,797,799,800,803,804,806,807,809,810,813],{},"With a ",[437,779,691],{}," (",[506,782,783],{},"…\u002Foauth2\u002Fdefault","), the groups claim is set up there instead – under ",[437,786,695],{},[437,788,698],{}," › the server › ",[437,791,792],{},"Claims",[437,794,795],{},"Add Claim",", name ",[506,798,741],{},", include in the ",[437,801,802],{},"ID Token",", value type ",[437,805,762],{},". If you limit it to a scope, enter that scope (e.g. ",[506,808,741],{},") under ",[437,811,812],{},"Scopes"," in DDM.",[455,815,817],{"id":816},"with-saml-instead","With SAML instead",[712,819,820,833,847,881,917,933],{},[499,821,548,822,439,824,826,827,483,829,832],{},[437,823,98],{},[437,825,199],{},", add a provider with ",[437,828,218],{},[437,830,831],{},"SAML 2.0",". DDM shows three values for it.",[499,834,835,836,439,838,439,840,439,842,844,845,442],{},"In Okta, go to ",[437,837,473],{},[437,839,473],{},[437,841,478],{},[437,843,831],{},", name it ",[506,846,508],{},[499,848,548,849,852,853,766,856,859,860,766,863,866,867,870,871,874,875,870,878,442],{},[437,850,851],{},"Configure SAML",", enter DDM's ",[437,854,855],{},"Reply URL (ACS URL)",[437,857,858],{},"Single sign-on URL"," and DDM's ",[437,861,862],{},"Identifier (Entity ID)",[437,864,865],{},"Audience URI (SP Entity ID)",". ",[437,868,869],{},"Name ID format",": ",[506,872,873],{},"EmailAddress",", ",[437,876,877],{},"Application username",[506,879,880],{},"Email",[499,882,548,883,886,887,889,890,874,893,889,896,874,899,889,902,905,906,909,910,912,913,766,915,813],{},[437,884,885],{},"Attribute Statements",", add ",[506,888,668],{}," → ",[506,891,892],{},"user.email",[506,894,895],{},"firstName",[506,897,898],{},"user.firstName",[506,900,901],{},"lastName",[506,903,904],{},"user.lastName",". For groups, add a ",[437,907,908],{},"Group Attribute Statement"," named ",[506,911,741],{}," with a filter, as above – and enter ",[506,914,741],{},[437,916,769],{},[499,918,919,920,923,924,926,927,439,930,932],{},"After saving, copy the ",[437,921,922],{},"Metadata URL"," from the app's ",[437,925,719],{}," tab and enter it in DDM under ",[437,928,929],{},"Your provider's metadata",[437,931,922],{},". Save.",[499,934,935,936,442],{},"Assign people or groups under ",[437,937,545],{},[455,939,941],{"id":940},"common-errors","Common errors",[592,943,944,957],{},[595,945,946],{},[598,947,948,951,954],{},[601,949,950],{},"Message",[601,952,953],{},"Cause",[601,955,956],{},"Solution",[608,958,959,977,992,1011,1026],{},[598,960,961,971,974],{},[613,962,963,966,967],{},[506,964,965],{},"400 Bad Request"," – ",[968,969,970],"em",{},"The 'redirect_uri' parameter must be a Login redirect URI",[613,972,973],{},"The redirect URI in Okta differs from the one DDM shows",[613,975,976],{},"Copy it from DDM again.",[598,978,979,984,987],{},[613,980,981],{},[968,982,983],{},"User is not assigned to the client application",[613,985,986],{},"The person is not assigned to the app",[613,988,989,990,442],{},"Assign them or their group under ",[437,991,545],{},[598,993,994,1000,1006],{},[613,995,996,999],{},[437,997,998],{},"There is no discovery document under this issuer"," (in DDM, on saving)",[613,1001,1002,1003,1005],{},"The issuer contains ",[506,1004,639],{},", or a path that does not exist",[613,1007,1008,1009,442],{},"Use ",[506,1010,635],{},[598,1012,1013,1018,1021],{},[613,1014,1015],{},[437,1016,1017],{},"The provider rejected the client ID or the secret",[613,1019,1020],{},"Copied incompletely, or the secret was rotated",[613,1022,1023,1024,555],{},"Copy both again from the ",[437,1025,568],{},[598,1027,1028,1033,1040],{},[613,1029,1030],{},[437,1031,1032],{},"Your e-mail address is not on one of your organisation's confirmed domains",[613,1034,1035,1036,1039],{},"The person's ",[437,1037,1038],{},"Primary email"," in Okta is on another domain",[613,1041,1042],{},"Correct it in Okta, or confirm the domain in DDM.",[455,1044,1046],{"id":1045},"alternatively-oktas-ldap-interface","Alternatively: Okta's LDAP interface",[433,1048,1049,1050,1053],{},"Okta can also present its users as an LDAP directory. Connected as a ",[682,1051,1052],{"href":204},"directory service",", DDM imports your people from Okta in advance, sorts them into groups by their Okta groups and blocks people who are deactivated – but they then type their Okta password into DDM's sign-in page, without Okta's MFA.",[433,1055,1056],{},"The two can be combined: the directory service imports and sorts people, single sign-on signs them in.",[592,1058,1059,1067],{},[595,1060,1061],{},[598,1062,1063,1065],{},[601,1064,603],{},[601,1066,606],{},[608,1068,1069,1081,1098,1110,1124,1137],{},[598,1070,1071,1076],{},[613,1072,1073],{},[437,1074,1075],{},"Host",[613,1077,1078],{},[506,1079,1080],{},"\u003Cyour org>.ldap.okta.com",[598,1082,1083,1092],{},[613,1084,1085,1088,1089],{},[437,1086,1087],{},"Port"," \u002F ",[437,1090,1091],{},"Require TLS",[613,1093,1094,1097],{},[506,1095,1096],{},"636"," \u002F on",[598,1099,1100,1105],{},[613,1101,1102],{},[437,1103,1104],{},"Base DN",[613,1106,1107],{},[506,1108,1109],{},"dc=\u003Cyour org>,dc=okta,dc=com",[598,1111,1112,1117],{},[613,1113,1114],{},[437,1115,1116],{},"Bind DN",[613,1118,1119,1120,1123],{},"a read-only administrator, e.g. ",[506,1121,1122],{},"uid=svc-ddm@company.com,dc=\u003Cyour org>,dc=okta,dc=com"," – Okta shows the exact format on the LDAP interface page",[598,1125,1126,1132],{},[613,1127,1128,1131],{},[437,1129,1130],{},"Search base DN"," of the query",[613,1133,1134],{},[506,1135,1136],{},"ou=users,dc=\u003Cyour org>,dc=okta,dc=com",[598,1138,1139,1144],{},[613,1140,1141],{},[437,1142,1143],{},"Search filter",[613,1145,1146],{},[506,1147,1148],{},"(&(objectClass=inetOrgPerson)(mail=*))",[433,1150,1151,1152,439,1155,439,1158,1161,1162,442],{},"Switch the interface on in Okta under ",[437,1153,1154],{},"Directory",[437,1156,1157],{},"Directory Integrations",[437,1159,1160],{},"Add LDAP Interface",", and check in the preview whether your Okta groups appear under ",[437,1163,1164],{},"memberOf",[455,1166,1168],{"id":1167},"okta-sign-in-for-the-whole-installation","Okta sign-in for the whole installation",[433,1170,1171,1172,1175,1176,874,1179,483,1182,1185,1186,1189,1190,1193],{},"Whoever runs a DDM installation can also offer ",[437,1173,1174],{},"Sign in with Okta"," to every organisation on it – with one Okta app for all of them, set up on the server: ",[506,1177,1178],{},"OKTA_CLIENT_ID",[506,1180,1181],{},"OKTA_CLIENT_SECRET",[506,1183,1184],{},"OKTA_ISSUER"," (e.g. ",[506,1187,1188],{},"https:\u002F\u002Fcompany.okta.com","), redirect URI ",[506,1191,1192],{},"\u003CBETTER_AUTH_URL>\u002Fapi\u002Fauth\u002Fcallback\u002Fokta",". The button appears once all three are set. Like the Microsoft and Google sign-in for the whole installation, it creates no memberships and is the same for everybody; it suits a dedicated installation for one company. An organisation that wants its own Okta, its own rules or group mapping uses single sign-on as described above.",{"title":1195,"searchDepth":1196,"depth":1196,"links":1197},"",2,[1198,1205,1206,1207,1208,1209,1210],{"id":457,"depth":1196,"text":458,"children":1199},[1200,1202,1203,1204],{"id":466,"depth":1201,"text":467},3,{"id":493,"depth":1201,"text":494},{"id":544,"depth":1201,"text":545},{"id":558,"depth":1201,"text":559},{"id":579,"depth":1196,"text":580},{"id":706,"depth":1196,"text":707},{"id":816,"depth":1196,"text":817},{"id":940,"depth":1196,"text":941},{"id":1045,"depth":1196,"text":1046},{"id":1167,"depth":1196,"text":1168},"Connect your organisation's Okta – create an OpenID Connect app integration and enter it in DDM.","md",null,{},{"icon":221},{"title":218,"description":1211},"td-c52kGr3cLFcSzt0F8z0r2tw8nparW31xl9F08svQ",[1219,1221],{"title":213,"path":214,"stem":215,"description":1220,"icon":216,"children":-1},"Connect your organisation's Entra ID (formerly Azure AD) – register DDM in your own tenant and enter it in DDM.",{"title":223,"path":224,"stem":225,"description":1222,"icon":81,"children":-1},"Connect your organisation's Google Workspace – create an OAuth client and enter it in DDM.",1793617719488]