Okta single sign-on

Configure the connection in Settings, Single sign-on. This guide covers sign-in and Universal Logout. For automated member and role management, follow the Okta provisioning guide.

Prerequisites

• An owner or admin account in the Cust organization you want to connect.
• Single sign-on enabled for your Cust plan. Contact support@cust.co if it is unavailable.
• Permission to add and configure applications in your Okta Admin Console.
• Access to the DNS records for the email domains your team uses.

Use the Cust region where your organization is hosted. Select EU or US at the top of this documentation before opening links to Cust. Copy connection values from your organization's Single sign-on page.

The settings screenshots show example configurations. Use the values displayed in your own Cust organization when following the steps.

Supported features

• Sign-in from Cust: users enter their work email and continue to Okta.
• Sign-in from the Okta dashboard: the Cust app tile starts the same sign-in flow.
• Just-in-time membership: new users join the organization as Members on their first successful sign-in. Existing Cust accounts with the same email are retained.
• Required SSO: optionally require users on verified email domains to sign in through the identity provider.
• Universal Logout: Okta can revoke a user's Cust sessions. See Universal Logout.

The sign-in protocol is OpenID Connect (OIDC). SCIM provisioning and Entitlement Management are configured separately.

Connect the Cust app from Okta

1. In Cust, open Settings, then Single sign-on, and select Okta as the identity provider.

2. In the Okta Admin Console, open Applications, then Browse App Catalog. Find Cust and add the integration.

3. Enter the two values shown in Cust:

   Okta setting	Value from Cust
   Host	The host for your region, such as app.cust.co or app.us.cust.co, without https:// or a path.
   SSO configuration ID	The Configuration ID shown for your organization.

4. On the Okta application's Sign On tab, copy the Client ID and Client Secret into the corresponding Cust fields.

5. In Cust, set Okta URL to your Okta organization URL, such as https://acme.okta.com. Use the organization domain, not an address containing -admin.

6. Save the connection in Cust. In Okta, assign the users or groups who should have access to the Cust application.

7. Continue with Verify your email domains, then enable and test SSO.

Manual setup with a custom app

Use this option if you are connecting a custom OIDC application instead of the Cust catalog integration.

1. In Cust, select Other OpenID Connect provider as the identity provider.

2. In the Okta Admin Console, open Applications, then Create App Integration. Select OIDC and Web Application.

3. Enable the Authorization Code grant type and enter the URLs displayed in Cust:

   Okta setting	Value from Cust
   Sign-in redirect URI	Callback URL. Copy the complete URL, including your configuration ID.
   Initiate login URI	Initiate login URL, so the Cust tile can start sign-in from Okta.
   Sign-out redirect URIs	Leave empty.

4. Assign the users or groups who should have access to the application.

5. Copy the Client ID and Client Secret into Cust. Set the Issuer URL to your Okta organization URL, such as https://acme.okta.com. Use the organization domain, not the -admin domain or a custom authorization-server path.

6. Save the connection and continue below.

Verify your email domains

1. Add each email domain your users will sign in with, such as acme.com, in Cust's Single sign-on settings.
2. For each domain, publish the TXT record displayed by Cust with your DNS provider. Copy the generated value exactly.
3. Once the record is available in DNS, select Verify in Cust.

Only verified domains can be used for this SSO connection. Add subdomains separately when your team's email addresses use them. Public email-provider domains cannot be added. If your DNS provider automatically appends your domain to record names, follow its instructions when entering the TXT host.

Enable and test sign-in

The sign-in screen above uses the EU region. Choose the region where your organization is hosted.

1. Turn on Enable single sign-on in Cust after saving the connection and verifying at least one domain.
2. Open a private browser window and visit the Cust sign-in page for the same region.
3. Enter the work email of a user assigned to the Cust app in Okta, then select Continue.
4. Sign in to Okta and confirm that you return to the intended Cust organization.
5. If users will launch Cust from Okta, also test the Cust tile in the Okta dashboard.

Test with an assigned user before requiring SSO for everyone.

Require SSO

Turn on Require single sign-on for verified domains to enforce SSO. Google and Microsoft sign-in are then refused for those domains, and existing sessions created outside SSO are ended. Those sessions also stop working in other Cust organizations. Existing SSO sessions remain valid. Users whose sessions were ended need to sign in again through the identity provider.

Cust invitations continue to work unless Allow inviting members from Cust is turned off. When invitations are disabled, manage who can join through Okta. If you also enable provisioning, make membership and role changes in Okta for users it manages.

This example allows SSO without requiring it. Turn on Require single sign-on for verified domains only after testing the connection.

Universal Logout

Use the Cust Okta integration with Universal Logout support and an Okta plan that provides the corresponding logout controls.

1. In the Okta application, open Sign On.
2. Under Logout, enable Okta system or admin initiates logout.
3. Sign in to Cust as an assigned test user, then clear that user's sessions in Okta to verify the connection.

Okta's logout request revokes that user's active Cust sessions. Further authenticated requests require sign-in, including requests from sessions in other Cust organizations. An already-open browser page may remain visible until it makes another authenticated request.

Identity Threat Protection can also initiate logout when configured in Okta. No additional Cust setting or SCIM provisioning token is needed for Universal Logout.

Troubleshooting

Contact us

Email support@cust.co with your Cust region, organization name, the setup step, and the error message. Do not include client secrets or provisioning tokens.