Integrations / Okta
Integration guide
Your people sign in to Metano with their Okta credentials. Accounts and roles are created, updated and deactivated automatically, and revoking a user in Okta ends their Metano sessions within seconds.
You need administrator access in both Metano and your Okta org. Set-up runs Metano-first: Metano issues the connection identifier that the Okta application needs, so the Metano connection has to exist before you add the app in Okta.
The recommended protocol. Use SAML only if OIDC is not an option for you.
In Metano, go to Settings → SSO and select Add connection.
Choose Okta as your identity provider and OIDC as the protocol. Metano displays a connection ID and a redirect URI — copy both.
In the Okta Admin Console, go to Applications → Browse App Catalog and search for Metano. Select it and choose Add integration.
Paste the connection ID from step 2 into Metano connection ID, then continue to the sign-on options and keep OpenID Connect selected. Save.
Copy the Client ID and Client secret from the application's Sign On tab.
Okta shows the secret only once. If you lose it, generate a new one from the application's General → Client Credentials section.
Back in Metano, enter your Okta domain (for example
https://your-company.okta.com), the Client ID and the Client secret. Save.
In Okta, assign the users and groups who should have Metano access to the application.
Your users can now sign in. They enter their work email address on the Metano sign-in page and are redirected to Okta — Metano does not ask them to choose a sign-in method.
Sign-in resolves by email domain. Once a connection is active for a domain your organization has claimed, every address at that domain is redirected to Okta. Addresses outside it are unaffected.
The same flow as OIDC, with three differences.
Choose SAML instead of OIDC at step 2, and select SAML 2.0 in the app's sign-on options at step 4.
email,
firstName and lastName by default. If you have customised the
attribute statements, keep an email attribute and either a full name or a first and
last name.
Metano supports service-provider-initiated sign-in: users start at the Metano sign-in page, not from the Okta dashboard tile.
Assigning a user to the Metano application creates their Metano account. Unassigning or deactivating them deactivates it.
In Metano, go to Settings → SSO and generate a SCIM token. Copy it — Metano shows it once.
In Okta, open the Metano application and go to the Provisioning tab. Select Configure API Integration and enable it.
Set the SCIM connector values:
Select Test API Credentials. Save once it succeeds.
Under To App, enable Create Users, Update User Attributes and Deactivate Users.
Deactivated members are kept, not deleted. Metano keeps deactivated members visible to your administrators rather than removing them, so historical activity stays attributable. They cannot sign in.
No configuration required.
Once SSO is connected, Okta can end a user's active Metano sessions. Clearing a user's sessions in Okta — or a Universal Logout triggered by an Okta policy — revokes their Metano sessions server-to-server within seconds.
Metano terminates both active sessions and refresh tokens, so access ends immediately rather than when the current token expires.
Metano has six roles. Send a user's role from Okta over SCIM using the standard
roles attribute, or set it in Metano.
| Role | Intended for |
|---|---|
admin | Full administration, including SSO and provisioning settings |
it_admin | Endpoint and agent administration |
policy_analyst | Authoring and reviewing policy |
soc_analyst | Detection triage and investigation |
compliance | Audit and reporting access |
viewer | Read-only access |
Send one role per user. Where several are sent, mark one as primary. A value outside the list above is recorded but does not change the member's role.
Roles are assigned explicitly. A member's role comes from the
roles attribute sent over SCIM, or from the role set in Metano. Group Push is
supported, and group membership is recorded and visible for access review. If you model
entitlements with groups in Okta, send the role attribute as well so each member's access
is set explicitly.
Every action Okta takes is recorded in Metano's immutable audit log and attributed to Okta by name — account creation, attribute and role changes, deactivation, group membership changes, and session revocations. Administrators can export it for access reviews.
Test API Credentials fails.
Confirm the base URL is exactly https://scim.metano.ai/scim/v2 with no
trailing slash, and that the token was pasted whole. Tokens are shown once — generate a
new one in Metano if in doubt.
A user reaches Okta but Metano rejects the sign-in.
Confirm the user is assigned to the application in Okta, and that their email domain is one your organization has claimed in Metano.
A user is sent a one-time code instead of being redirected to Okta.
Their email domain is not covered by an active connection. Check the domain is claimed and the connection's status is active.
Sign-in worked, then stopped after a certificate rotation.
SAML only. Supply the metadata URL rather than a pasted certificate, so Metano re-reads it automatically.
A role set in Okta did not apply.
Confirm the value matches one of the six roles exactly. Unrecognized values are recorded without changing the role.