Setup Okta SSO in MyPay

Create/configure Okta Account and Okta Application

You may skip this section if you already have your okta org url, client ID and client Secret

1. https://www.okta.com/free-trial/#
2. sign up today
3. fill in email, name and create domain - and then follow instructions (email confirmation, set password)
4. log in to the domain you just created (e.g. https://emailxxxx.okta.com)
5. click "Applications" in the menu, than "Add Application" button, than "Create New App" button
6. platform "Web", Sign on method: "OpenID Connect", click "Create"
7. choose some Name, set Login redirect URI to "https://api.mypay.management/v1/ext-auth-callback", click Save
   
8. now Okta Application is created. At "General" tab you will find "Client ID" and "Client secret" - these are important for MyPay setup
9. if you want to access MyPay from Okta, see "Access MyPay from Okta" chapter below

Users that will login to MyPay using Okta need to be assigned to the Okta application you just created:

1. in Okta dashboard menu go to "Directory" → "People"
2. click one, in Application tab click "Assign Application" and assign him the created application

Configure 3rd party authentication provider (Okta) in MyPay

You will need:

• okta domain/url
• okta application Client ID
• okta application Client secret

1. Login to MyPay as admin
2. go to "Setup" → "External Authetication Provider" in menu, click "Create"
3. choose a name
4. Type: OKTA
5. set URL where user will be redirected to login: "https://<your-domain>.okta.com/oauth2/v1/authorize"
6. Client ID: copy client id from your Okta application
7. Client secret: copy client secret from your Okta application
8. save the new configuration
9. After the save you will see the field "Login URL" populated with an URL. Admin must provide this URL to all users that should authenticate to MyPay using Okta.
   Users must use this URL - the standard username/password authentication at MyPay login page will not work!

How users can use Okta login

Note: Employee record must exists in MyPay for the user to be able to login to MyPay using Okta. Login will fail if Employee record does not exist.

To login to MyPay using Okta, users can just navigate to the "Login URL" of the external authentication provider.
You can find it in: "Setup" → "External Authentication Provider" → select your authentication provider → Login URL
Users should get this URL from the administrator.

Access MyPay from Okta

• Users can also access MyPay from Okta using Okta chiclets.
• To configure MyPay chiclet in Okta, use setting highlighted in the screenshot below.
• In the "Initiate Login URI" field you need to set your own "Login URL" from the MyPay external authentication provider settings.