Okta
Okta works with either protocol. OIDC is the quickest to set up; use SAML if that's your standard.
OIDC
1. Create the app integration
In the Okta Admin Console: Applications → Create App Integration → OIDC – OpenID Connect → Web Application.
| Okta field | Value |
|---|---|
| Sign-in redirect URIs | https://<workspace>.waxell.dev/api/waxell/v1/auth/sso/callback/ |
| Grant type | Authorization Code |
| Assignments | the people or groups who should use Waxell |
Copy the Client ID and Client secret.
2. Send groups (optional)
Sign On → OpenID Connect ID Token → Edit, then:
- Groups claim type: Filter
- Groups claim name:
groups - Filter: Matches regex
.*, or Starts withwaxell-
Waxell reads groups from the user-info response.
3. Add the provider in Waxell
Settings → Identity → Add OIDC provider:
| Field | Value |
|---|---|
| Issuer URL | https://<your-org>.okta.com, or https://<your-org>.okta.com/oauth2/default for the default authorization server. It must match Okta's issuer exactly. |
| Client ID / secret | from step 1 |
| Scopes | openid email profile groups (add groups if you set up step 2) |
| Email domains | your users' domain |
Tick Enabled, Save, then Test.
SAML
Applications → Create App Integration → SAML 2.0:
| Okta field | Value |
|---|---|
| Single sign-on URL | https://<workspace>.waxell.dev/api/waxell/v1/auth/saml/acs/<slug>/ |
| Audience URI (SP Entity ID) | https://<workspace>.waxell.dev/api/waxell/v1/auth/saml/metadata/<slug>/ |
| Name ID format | EmailAddress |
| Application username | |
| Attribute statement | email → user.email |
| Group attribute statement (optional) | groups, filter Matches regex .* |
On the app's Sign On tab, open View SAML setup instructions and copy Identity Provider Issuer, Identity Provider Single Sign-On URL and the X.509 Certificate into the Waxell SAML provider.
Provisioning
- SCIM (Okta pushes users and groups to Waxell): SCIM → Okta
- Directory sync (Waxell pulls from Okta's API): Directory sync → Okta