---
title: "OAuth"
slug: "oauth"
updated: 2026-03-03T12:30:44Z
published: 2026-03-03T12:30:44Z
canonical: "help.symphonysummitai.com/oauth"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.symphonysummitai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth

Error rendering macro 'pagetree' : could not load an entity: [com.atlassian.confluence.pages.AbstractHierarchical#53194183]

OAuth is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.

Using OAuth you can enable Single Sign Ons for the following portals:

**Office 365**

To enable Single Sign on for Office 365 from Apex, the following configuration should be done in Office 365 portal.

**Web Application**

**Prerequisites**

Prerequisites to be performed in Office 365

1. Log into Office 365 using [https://apps.dev.microsoft.com/](https://apps.dev.microsoft.com/). ![Office 365 Login Screen](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ewuy2rhb.png)Figure: Office 365 Login Screen
2. Enter your Office 365 credentials and login to the portal. **My Applications** page is displayed. ![My Applications page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ks1zdv3j.png)Figure: My Applications page

> [!NOTE]
> Note
> 
> Under **Converged Applications** you can configure both Office 365 and Azure. Under **Azure AD only Applications** you can configure only Azure.

1. Click **Add an app** under **Converged Applications**. **Register your application** pop-up page is displayed. ![Register your Application pop-up page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-nvofle8u.png)Figure: Register your Application pop-up page
2. Specify a name for the application and click **Create**. The Application ID is displayed. ![Office 365 Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ecgr0k4e.png)Figure: Office 365 Page

> [!NOTE]
> Note
> 
> The Application ID displayed here is the Client ID to be used in Apex application.
3. Click **Generate New Password**. A New password is generated and displayed in the Pop-up page. This is the only time the password is displayed. Store it securely. ![New Password generated pop-up page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-yhzucvbx.png)Figure: New Password generated pop-up page

> [!NOTE]
> Note
> 
> The Password generated here is the **Client Secret Key** in Apex application.
4. Click **Add Platform** under the **Platforms** section. The **Add Platform** pop-up page is displayed. ![Add Platform Pop-up page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-vx1mfxql.png)Figure: Add Platform Pop-up page
5. On the **Add Platform** pop-up page, select **Web**.
6. Specify the Redirect URL. This URL is your Apex Web Application login URL. (Eg: [https://baseurl/Apex_SAMLResponse.aspx).](https://baseurl/SUMMIT_SAMLResponse.aspx).)

> [!NOTE]
> Note
> 
> - The **Redirect URL** you provide here should be entered in the **Redirect URL** field in application.
> - The Delegated Permissions (user.read) displayed in the Microsoft Graph Permissions section should be entered in the **Scope** field of application.

![Microsoft Graph Permissions section](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-vawivouf.png) Figure: Microsoft Graph Permissions
7. Click **SAVE** after all the above actions are performed. ![Office 365 page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-88kuajnd.png) Figure: Office 365 page

**Configure in Apex application**

To Configure SSO for Office 365 from Apex, perform the following steps:

1. Navigate to **Admin** > **Infrastructure** > **SSO Configuration**. The **SSO Configuration** page is displayed.
2. On the **SSO Configuration** page, select **OAuth** under the **Authentication Type** and click **Add New** on the right action panel. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/forms oauth(1).png) Figure: SSO Configuration: OAuth_Office 365
3. Specify the required details and click **Submit**. For more details about the fields on the **SSO Configuration** page, see **Field Description**.

#### Field Description

The following table describes the fields on the **SSO Configuration** page:

| **Fields** | **Description** |
| --- | --- |
| Domain | Select the domain name from the list. The OAuth based authentication will be configured for the selected domain. **Note:** This field is not visible for single domain users. |
| URL | Specify the Mobile Web Service URL. Example: https://baseurl/mobilews |
| Grant Type | Select the Grant Type as Authorization Code from the drop-down list. |
| Authorization URL | Specify the following Authorization URL: [https://login.microsoftonline.com/common/oauth2/v2.0/authorize](https://login.microsoftonline.com/common/oauth2/v2.0/authorize) |
| Access Token URL | Specify the following Access Token URL: [https://login.microsoftonline.com/common/oauth2/v2.0/token](https://login.microsoftonline.com/common/oauth2/v2.0/token) |
| Client ID | Specify the Client ID. This is the Application ID from Office 365 portal. Refer to Prerequisites section for more information about this field. |
| Client Secret Key | Specify the Client Secret Key. This is the Password generated from Office 365 portal. Refer to Prerequisites section for more information about this field. |
| User Information URL | Specify the following User Information URL: [https://graph.microsoft.com/v1.0/me](https://graph.microsoft.com/v1.0/me) |
| Redirect URL | Specify the Redirect URL. This is the same URL you have specified in the Redirect URL field of Office 365 portal. Eg: https://baseurl/Apex_SAMLResponse.aspx |
| ACS URL | Specify the ACS URL. |
| Include ACS URL | If selected, the ACS URL is included. |
| Scope | Specify the Scope as user.read. This is from the Delegated Permissions section of Office 365 portal. |
| Response Attribute | Specify the Response Attribute as mail. |
| User Creation | Upon enabling this checkbox, the user is created if that user is not available in Apex database but wants to login into the application using OAuth authentication method. |
| Time Zone | Select the timezone from the drop-down list. The selected timezone will be assigned to the newly created user. > [!NOTE] > Note > > This field is displayed only when the **User Creation** checkbox is enabled. |
| Template Name | Select the role template from the list. The selected role template will be assigned to the newly created user. > [!NOTE] > Note > > This field is displayed only when the **User Creation** checkbox is enabled. |
| Logo | Upload a logo. The uploaded logo is displayed on the Login Screen. The logo image width should be less than 300px and height should be less than 48px. Supported Image formats are .gif, .jpeg, .jpg, .png, .bmp. |

**For Mobile**

**Prerequisites to be performed in Office 365**

1. Log into Office 365 using [https://apps.dev.microsoft.com/](https://apps.dev.microsoft.com/). ![Office 365 Login Screen](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-f44q1jrm.png)Figure: Office 365 Login Screen
2. Enter your Office 365 credentials and login to the portal. **My Applications** page is displayed. ![My Applications page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-6v5bt72u.png)Figure: My Applications page

> [!NOTE]
> Note
> 
> Under **Converged Applications** you can configure both Office 365 and Azure. Under **Azure AD only Applications** you can configure only Azure.
3. Click **Add an app** under **Converged Applications**. **Register your application** pop-up page is displayed. ![Register your Application pop-up page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-5004no24.png)Figure: Register your Application pop-up page
4. Specify a name for the application and click **Create**. The Application ID is displayed. ![Office 365 Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-7jtlujzt.png)Figure: Office 365 Page

> [!NOTE]
> Note
> 
> The Application ID displayed here is the Client ID to be used in application.
5. Click **Generate New Password**. A New password is generated and displayed in the Pop-up page. This is the only time the password is displayed. Store it securely. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-6fdiyknr.png)Figure: New Password generated pop-up page

> [!NOTE]
> Note
> 
> The Password generated here is the **Client Secret Key** in application.
6. Click **Add Platform** under the **Platforms** section. The **Add Platform** pop-up page is displayed. ![Add Platform Pop-up page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-5mfov0rl.png)Figure: Add Platform Pop-up page
7. On the **Add Platform** pop-up page, select **Web**.
8. Specify the Redirect URL. This URL is your Apex Web Application login URL. (Example: https://baseurl/Apex_Weblogin.aspx).

> [!NOTE]
> Note
> 
> - The **Redirect URL** you provide here should be entered in the **Redirect URL** field in the application.
> - The Delegated Permissions (user.read) displayed in the Microsoft Graph Permissions section should be entered in the **Scope** field of the application.

![Microsoft Graph Permissions section](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-laa6befn.png) Figure: Microsoft Graph Permissions section
9. Click **SAVE** after all the above actions are performed. ![Office 365 page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ycs866z7.png)Figure: Office 365 page

**Configuration in Apex Application**

To Configure SSO for Office 365 from Apex, perform the following steps:

1. Select **Admin** > **Infrastructure** > **SSO Configuration**. The **SSO Configuration** page is displayed.
2. On the **SSO Configuration** page, select **OAuth** under the **Authentication Type** and click **Add New** on the **Actions** Panel. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/forms oauth(2).png) Figure: SSO Configuration: OAuth_Office 365
3. Specify the required details and click **Submit**. For more details about the fields on the **SSO Configuration** page, see Field Description.

#### Field Description

The following table describes the fields on the **SSO Configuration** page:

| **Fields** | **Description** |
| --- | --- |
| Domain | Select the domain name from the list. The OAuth based authentication will be configured for the selected domain. > [!NOTE] > Note > > This field is not visible for single domain users. |
| URL | Specify the Mobile Web Service URL. Example: https://baseurl/mobilews |
| Grant Type | Select the Grant Type as Authorization Code from the drop-down list. |
| Authorization URL | Specify the following Authorization URL: [https://login.microsoftonline.com/common/oauth2/v2.0/authorize](https://login.microsoftonline.com/common/oauth2/v2.0/authorize) |
| Access Token URL | Specify the following Access Token URL: [https://login.microsoftonline.com/common/oauth2/v2.0/token](https://login.microsoftonline.com/common/oauth2/v2.0/token) |
| Client ID | Specify the Client ID. This is the Application ID from Office 365 portal. Refer to Prerequisites section for more information about this field. |
| Client Secret Key | Specify the Client Secret Key. This is the Password generated from Office 365 portal. Refer to Prerequisites section for more information about this field. |
| User Information URL | Specify the following User Information URL: [https://graph.microsoft.com/v1.0/me](https://graph.microsoft.com/v1.0/me) |
| Redirect URL | Specify the Redirect URL. This is the same URL you have specified in the Redirect URL field of Office 365 portal. Eg: https://baseurl/Apex_SAMLResponse.aspx |
| ACS URL | Specify the ACS URL. |
| Include ACS URL | If selected, the ACS URL is included. |
| Scope | Specify the Scope as user.read. This is from the Delegated Permissions section of Office 365 portal. |
| Response Attribute | Specify the Response Attribute as mail. |
| User Creation | Upon enabling this checkbox, the user is created if that user is not available in Apex database but wants to login into the application using OAuth authentication method. |
| Time Zone | Select the time zone from the drop-down list. The selected time zone will be assigned to the newly created user. > [!NOTE] > Note > > This field is displayed only when the **User Creation** checkbox is enabled. |
| Template Name | Select the role template from the list. The selected role template will be assigned to the newly created user. > [!NOTE] > Note > > This field is displayed only when the **User Creation** checkbox is enabled. |
| Logo | Upload a logo. The uploaded logo is displayed on the Login Screen. The logo image width should be less than 300px and height should be less than 48px. Supported Image formats are .gif, .jpeg, .jpg, .png, .bmp. |

**Azure**

To enable Single Sign on for Azure from Apex, the following configuration should be done in Azure portal.

**Web Application**

To Configure SSO for Azure from Apex, perform the following steps:

1. Select **Admin** > **Infrastructure** > **SSO Configuration**. The **SSO Configuration** page is displayed.
2. On the **SSO Configuration** page, select **OAuth** under the **Authentication Type** and click **Add New** on the **Actions** Panel. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/forms oauth(3).png)

Figure: SSO Configuration: OAuth_Azure
3. Specify the required details and click **Submit**. For more details about the fields on the **SSO Configuration** page.

##### Field Description

The following table describes the fields on the **SSO Configuration** page:

| **Fields** | **Description** |
| --- | --- |
| Domain | Select the domain name from the list. The Azure OAuth based authentication will be configured for the selected domain. > [!NOTE] > Note > > This field is not visible for single domain users. |
| URL | Specify the Mobile Web Service URL. Example: https://baseurl/mobilews |
| Grant Type | Select the Grant Type as **Authorization Code** from the drop-down list. |
| Authorization URL | Specify the following Authorization URL: [https://login.microsoftonline.com/common/oauth2/authorize](https://login.microsoftonline.com/common/oauth2/authorize) |
| Access Token URL | Specify the following Access Token URL: [https://graph.microsoft.com](https://graph.microsoft.com) |
| Client ID | Specify the Client ID. This is the Application ID from Azure portal. Refer to Prerequisites section for more information about this field. |
| Client Secret Key | Specify the Client Secret Key. This is the Password generated from Azure portal. Refer to Prerequisites section for more information about this field. |
| User Information URL | Specify the following User Information URL: [https://graph.microsoft.com/v1.0/me](https://graph.microsoft.com/v1.0/me) |
| Redirect URL | Specify the Redirect URL. This is the same URL you have specified in the Redirect URL field of Azure portal. Eg: https://baseurl/Apex_SAMLResponse.aspx |
| ACS URL | Specify the ACS URL. |
| Include ACS URL | If selected, the ACS URL is included. |
| Scope | Specify the Scope as user.read |
| Response Attribute | Specify the Response Attribute as userPrincipalName. > [!NOTE] > Note > > When the **Response Attribute** field is configured as **userPrincipleName** and Azure is returning the username as an **Email ID** then you must configure the key <add key="ConfigureOAuthLoginType" value="W" /> in the Web.Config file. |
| User Creation | Upon enabling this checkbox, the user is created if that user is not available in Apex database but wants to login into the SummtAI application using Azure OAuth authentication method. |
| Time Zone | Select the time zone from the drop-down list. The selected time zone will be assigned to the newly created user. > [!NOTE] > Note > > This field is displayed only when the **User Creation** checkbox is enabled. |
| Template Name | Select the role template from the list. The selected role template will be assigned to the newly created user. > [!NOTE] > Note > > This field is displayed only when the **User Creation** checkbox is enabled. |
| Logo | Upload a logo. The uploaded logo is displayed on the Login Screen. The logo image width should be less than 300px and height should be less than 48px. Supported Image formats are .gif, .jpeg, .jpg, .png, .bmp. |

**For Mobile**

**Prerequisites**

Prerequisites to be performed in Azure Portal:

1. Go to [https://portal.azure.com](https://portal.azure.com). The login page is displayed.
2. Login to the application with valid Azure credentials.
3. On the menu, click **Azure Active Directory,** then click **App Registrations**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-nnq2oxeh.jpg) Figure: Azure Active Directory Menu
4. Click **New registration**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-1uajv1zi.jpg)Figure: New Application Registration Menu
5. Specify the name and select supported account types. Click **Register**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-bnk37ar2.jpg)Figure: Registering Application
6. The application is Registered and displayed in the list. Click the newly created application. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ib0g6ecg.jpg)Figure: Application Registration - OAuth Mobile

> [!NOTE]
> Note
> 
> The Application ID displayed here is the Client ID to be specified in Apex application.
7. Click **Add a certificate or secret**. The Certificate & secrets screen is displayed. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-43i1mls9.jpg)Figure: Certificates & secrets
8. Click **New client secret**.![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-2l73i63d.jpg)Figure: Add a client secret
9. Enter the client secret description and expires time. Click **Add**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-yzzgiwpy.jpg)Figure: Certificate & secret
10. Click **Add a Redirect URL** from Registered Application page. The Platform configuration screen is displayed. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-3tf1lwr1.jpg)Figure: Authentication - Platform configuration
11. Click **Add a Platform**. The Configure platforms section is displayed. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-rq11xel3.jpg)Figure: Authentication - Configure platforms
12. Click **Web widget** from Web application section.
13. Specify the redirect URLs from Configure Web screen and click **Configure**. The URL must be Mobile App base Web Service URL should have the suffix **/SSO/MobileSAMLResponse.aspx**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-92n7rj6p.jpg)Figure: Configure Web ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-uxcoxwmn.jpg)Figure: Authentication - Redirect URL

On completing all the configuration, the registered application screen is displayed with Application ID, Directory ID, Client credentials, and Redirect URL (web).

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ygih5gaf.jpg)Figure: OAuth Mobile - Configuration.

> [!NOTE]
> Note
> 
> In the event of any alterations are found in the Azure application screenshots, you can refer the generic Azure register documentation link to access the updated information:
> 
> **Link**: [https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app)

OR

Prerequisites to be performed in Office 365

1. Log into Office 365 using [https://apps.dev.microsoft.com/](https://apps.dev.microsoft.com/). ![Office 365 Login Screen](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-cf7ipf8c.png)Figure: Office 365 Login Screen
2. Enter your Office 365 credentials and login to the portal. **My Applications** page is displayed. ![My Applications page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-rwjd3i12.png) Figure: My Applications page

Note:

Under **Converged Applications** you can configure both Office 365 and Azure. Under **Azure AD only Applications** you can configure only Azure.

1. Click **Add an app** under **Converged Applications**. **Register your application** pop-up page is displayed. ![Register your Application pop-up page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-69v8j3mu.png)Figure: Register your Application pop-up page
2. Specify a name for the application and click **Create**. The Application ID is displayed. ![Office 365 Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ytcwvabo.png)Figure: Office 365 Page

Note:

The Application ID displayed here is the Client ID to be used in application.

1. Click **Generate New Password**. A New password is generated and displayed in the Pop-up page. This is the only time the password is displayed. Store it securely. ![New Password generated pop-up page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-2pfg9f49.png)Figure: New Password generated pop-up page

Note:

The Password generated here is the **Client Secret Key** in application.

1. Click **Add Platform** under the **Platforms** section. The **Add Platform** pop-up page is displayed. ![Add Platform Pop-up page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-aw6kaqin.png)Figure: Add Platform Pop-up page
2. On the **Add Platform** pop-up page, select **Web**.
3. Specify the Redirect URL. This URL is your Apex Web Application login URL. (Eg: https://baseurl/Apex_Weblogin.aspx).

Note

- The **Redirect URL** you provide here should be entered in the **Redirect URL** field in application.
- The Delegated Permissions (user.read) displayed in the Microsoft Graph Permissions section should be entered in the **Scope** field of application.

![Microsoft Graph Permissions section](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-pmot47sq.png) Figure: Microsoft Graph Permissions section

1. Click **SAVE** after all the above actions are performed. ![Office 365 page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-gve21kbo.png) Figure: Office 365 page

## Configuration in application

To Configure SSO for Azure from Apex, perform the following steps:

1. Navigate to **Admin** > **Infrastructure** > **SSO Configuration**. The **SSO Configuration** page is displayed.
2. On the **SSO Configuration** page, select **OAuth** under the **Authentication Type** and click **Add New** on the **Actions** Panel. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/forms oauth.png)

Figure: OAuth Authentication Type
3. Specify the required details and click **Submit**. For more details about the fields on the **SSO Configuration** page, see Field Description.

##### Field Description

The following table describes the fields on the **SSO Configuration** page:

| **Fields** | **Description** |
| --- | --- |
| Domain | Select the domain name from the list. The Azure OAuth based authentication will be configured for the selected domain. **Note:** This field is not visible for single domain users. |
| URL | Specify the Mobile Web Service URL. Example: [https://baseurl/mobilews](https://baseurl/mobilews) |
| Grant Type | Select the Grant Type as **Authorization Code** from the drop-down list. |
| Authorization URL | Specify the following Authorization URL: [https://login.microsoftonline.com/common/oauth2/v2.0/authorize](https://login.microsoftonline.com/common/oauth2/v2.0/authorize) (If Configured from Office 365) [https://login.microsoftonline.com/[tenant]/oauth2/v2.0/authorize](https://login.microsoftonline.com/%5btenant%5d/oauth2/v2.0/authorize) (If Configured from Azure) |
| Access Token URL | Specify the following Access Token URL: [https://login.microsoftonline.com/common/oauth2/v2.0/token](https://login.microsoftonline.com/common/oauth2/v2.0/token) (If Configured from Office 365) [https://login.microsoftonline.com/[tenant]/oauth2/v2.0/token](https://login.microsoftonline.com/%5btenant%5d/oauth2/v2.0/token) (If Configured from Azure) |
| Client ID | Specify the Client ID. This is the Application ID from Azure portal. Refer to Prerequisites section for more information about this field. |
| Client Secret Key | Specify the Client Secret Key. This is the Password generated from Azure portal. Refer to Prerequisites section for more information about this field. |
| User Information URL | Specify the following User Information URL: [https://graph.microsoft.com/v1.0/me](https://graph.microsoft.com/v1.0/me) |
| Redirect URL | Specify the Redirect URL. This is the same URL you have specified in the Redirect URL field of Azure portal. Eg: https://baseurl/Apex_Weblogin.aspx |
| ACS URL | Specify the ACS URL. |
| Include ACS URL | If selected, the ACS URL is included. |
| Scope | Specify the Scope as user.read |
| Response Attribute | Specify the Response Attribute as userPrincipalName . |
| User Creation | Upon enabling this checkbox, the user is created if that user is not available in Apex database but wants to login into the application using Azure OAuth authentication method. |
| Time Zone | Select the time zone from the drop-down list. The selected time zone will be assigned to the newly created user. **Note:** This field is displayed only when the User Creation checkbox is enabled. |
| Template Name | Select the role template from the list. The selected role template will be assigned to the newly created user. **Note:** This field is displayed only when the User Creation checkbox is enabled. |
| Logo | Upload a logo. The uploaded logo is displayed on the Login Screen. The logo image width should be less than 300px and height should be less than 48px. Supported Image formats are .gif, .jpeg, .jpg, .png, .bmp. |

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-xj5ymbqi.png)Facebook

To enable Single Sign on for Facebook from Apex, the following configuration should be done in Facebook application:

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-e6l6zokc.png)For Web Application

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-h17v0nnr.png)Prerequisites to be performed in Facebook

1. Log into Facebook using [https://developers.facebook.com/](https://developers.facebook.com/). Click **Log In**. ![Login Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ndohuf4y.png)Figure: Login Page
2. The Facebook login page is displayed. Specify your User Name and Password and click **Log In**. If you do not have an account already, click **Create New Account** to Sign up. ![Login Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-3565h21p.png)Figure: Facebook Login Screen
3. On the top right corner, hover your mouse over My Apps, and then click Add a New App. ![Add a New App](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-lxtge252.png)Figure: Add a New App
4. **Create a New App ID** pop-up page is displayed. Specify a **Display Name** and **Contact Email**, and then click **Create App ID**. ![Create App ID page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-funyoeim.png)Figure: Create App ID page
5. You are redirected to the Dashboard page. The **App ID** is displayed on the top left corner of the page. Click **Show** to view the **App Secret**.

Note:

- 
  - The App ID displayed here should be entered in the Client ID field of application.
  - The Client Secret displayed here should be entered in the Client Secret Key field of application.

![ Dashboard page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-4smwl6yx.png) Figure: Dashboard page

1. Click **Settings > Basic**. Specify the required information in the fields. Select the **Category** as **Utility & Productivity**. ![Settings page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-yzodm1fb.png)Figure: Settings page
2. Click **Add Platform**. The **Select Platform** pop-up page is displayed. Select **Website**. ![Select Platform Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-q1cw2edw.png)Figure: Select Platform Page
3. Specify the **Site URL** and click **Save Changes**. ![Basic Settings page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-wxgjkyzd.png)Figure: Basic Settings page
4. Click **Advanced** and **Allow API Access to App Settings**. ![Advanced Settings Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-mlyinmif.png)Figure: Advanced Settings Page
5. Click **Save Changes**.
6. Click **App Review** and make your app Public by clicking Yes. ![App Review Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-2hrcdn0k.png)Figure: App Review Page
7. Click **Add Product** and select **Facebook Login**. ![Add Product](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-62pvvjxb.png)Figure: Add Product
8. Under the Valid OAuth redirect URLs section, specify a Re-direct URL. ![Redirect URL](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ow9hlv2w.png)Figure: Redirect URL

Note:

The Redirect URL specified here should be entered in the Redirect URL field of application.

## Configuration in application

To Configure SSO for Facebook from Apex, perform the following steps:

1. Select **Admin** > **Infrastructure** > **SSO Configuration**. The **SSO Configuration** page is displayed.
2. On the **SSO Configuration** page, select **OAuth** under the **Authentication Type** and click **Add New** on the **Actions** Panel.
3. Specify the required details and click **Submit**. For more details about the fields on the **SSO Configuration** page, see [Field Description](/apex/docs/oauth#field-description1).

#### Field Description

The following table describes the fields on the **SSO Configuration** page:

| **Fields** | **Description** |
| --- | --- |
| Domain | Select the domain name from the list. The Facebook OAuth based authentication will be configured for the selected domain. **Note:** This field is not visible for single domain users. |
| URL | Specify the Mobile Web Service URL. Example: https://baseurl/mobilews |
| Grant Type | Select the Grant Type as **Authorization Code** from the drop-down list. |
| Authorization URL | Specify the following Authorization URL: [https://www.facebook.com/dialog/oauth](https://www.facebook.com/dialog/oauth) |
| Access Token URL | Specify the following Access Token URL: [https://graph.facebook.com/v2.9/oauth/access_token](https://graph.facebook.com/v2.9/oauth/access_token) |
| Client ID | Specify the Client ID. This is the Application ID from Facebook portal. Refer to Prerequisites section for more information about this field. |
| Client Secret Key | Specify the Client Secret Key. This is the Password generated from Facebook portal. Refer to Prerequisites section for more information about this field. |
| User Information URL | Specify the following User Information URL: [https://graph.facebook.com/v2.9/me?fields=id,name,email](https://graph.facebook.com/v2.9/me?fields=id,name,email) |
| Redirect URL | Specify the Redirect URL. This is the same URL you have specified in the Redirect URL field of Facebook portal. Eg: https://baseurl/Apex_SAMLResponse.aspx |
| ACS URL | Specify the ACS URL. |
| Include ACS URL | If selected, the ACS URL is included. |
| Scope | Specify the scope as email,public_profile |
| Response Attribute | Specify the Response Attribute as email. |
| User Creation | Upon enabling this checkbox, the user is created if that user is not available in Apex database but wants to login into the SummtAI application using Facebook OAuth authentication method. |
| Time Zone | Select the timezone from the drop-down list. The selected timezone will be assigned to the newly created user. **Note:** This field is displayed only when the User Creation checkbox is enabled. |
| Template Name | Select the role template from the list. The selected role template will be assigned to the newly created user. **Note:** This field is displayed only when the User Creation checkbox is enabled. |
| Logo | Upload a logo. The uploaded logo is displayed on the Login Screen. The logo image width should be less than 300px and height should be less than 48px. Supported Image formats are .gif, .jpeg, .jpg, .png, .bmp. |

## For Mobile

Prerequisites to be performed in Facebook

1. Log into Facebook using [https://developers.facebook.com/](https://developers.facebook.com/). Click **Log In**. ![Login Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-w4l35x5d.png)Figure: Login Page
2. The Facebook login page is displayed. Specify your User Name and Password and click **Log In**. If you do not have an account already, click **Create New Account** to Sign up. ![Facebook Login Screen](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-zm1qc8oe.png)Figure: Facebook Login Screen
3. On the top right corner, hover your mouse over My Apps, and then click Add a New App. ![Add a New App](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-4fu1ml7a.png)Figure: Add a New App
4. **Create a New App ID** pop-up page is displayed. Specify a **Display Name** and **Contact Email**, and then click **Create App ID**. ![Create App ID page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-cw484cbr.png)Figure: Create App ID page
5. You are redirected to the Dashboard page. The **App ID** is displayed on the top left corner of the page. Click **Show** to view the **App Secret**.

Note:

- The App ID displayed here should be entered in the Client ID field of application.
- The Client Secret displayed here should be entered in the Client Secret Key field of application.

![Dashboard page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-lz2i0sz6.png) Figure: Dashboard page

1. Click **Settings > Basic**. Specify the required information in the fields. Select the **Category** as **Utility & Productivity**. ![Settings page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-2o7q30gj.png) Figure: Settings page
2. Click **Add Platform**. The **Select Platform** pop-up page is displayed. Select **Website**. ![Select Platform Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-y6bmj9mt.png) Figure: Select Platform Page
3. Specify the **Site URL** and click **Save Changes**. ![Basic Settings page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-4w4ya8d4.png) Figure: Basic Settings page
4. Click **Advanced** and **Allow API Access to App Settings**. ![Advanced Settings Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-bkxbstuc.png) Figure: Advanced Settings Page
5. Click **Save Changes**.
6. Click **App Review** and make your app Public by clicking Yes. ![App Review Page](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-4hqnsuv3.png) Figure: App Review Page
7. Click **Add Product** and select **Facebook Login**. ![Add Product](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-k21q98rw.png) Figure: Add Product
8. Under the Valid OAuth redirect URLs section, specify a Re-direct URL. ![Redirect URL](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-k2esakbx.png) Figure: Redirect URL

Note:

The Redirect URL specified here should be entered in the Redirect URL field of application.

## Configuration in application

To Configure SSO for Facebook from Apex, perform the following:

1. Select **Admin** > **Infrastructure** > **SSO Configuration**. The **SSO Configuration** page is displayed.
2. On the **SSO Configuration** page, select **OAuth** under the **Authentication Type** and click **Add New** on the **Actions** Panel.
3. Specify the required details and click **Submit**. For more details about the fields on the **SSO Configuration** page, see [Field Description](/apex/docs/oauth#field-description1).

##### Field Description

The following table describes the fields on the **SSO Configuration** page:

| **Fields** | **Description** |
| --- | --- |
| Domain | Select the domain name from the list. The Facebook OAuth based authentication will be configured for the selected domain. **Note:** This field is not visible for single domain users. |
| URL | Specify the Mobile Web Service URL. Example: [https://baseurl/mobilews](https://baseurl/mobilews) |
| Grant Type | Select the Grant Type as **Authorization Code** from the drop-down list. |
| Authorization URL | Specify the following Authorization URL: [https://www.facebook.com/dialog/oauth](https://www.facebook.com/dialog/oauth) |
| Access Token URL | Specify the following Access Token URL: [https://graph.facebook.com/v2.9/oauth/access_token](https://graph.facebook.com/v2.9/oauth/access_token) |
| Client ID | Specify the Client ID. This is the Application ID from Facebook portal. Refer to Prerequisites section for more information about this field. |
| Client Secret Key | Specify the Client Secret Key. This is the Password generated from Facebook portal. Refer to Prerequisites section for more information about this field. |
| User Information URL | Specify the following User Information URL: [https://graph.facebook.com/v2.9/me?fields=id,name,email](https://graph.facebook.com/v2.9/me?fields=id,name,email) |
| Redirect URL | Specify the Redirect URL. This is the same URL you have specified in the Redirect URL field of Facebook portal. Eg: [https://baseurl/Apex_SAMLResponse.aspx](https://baseurl/SUMMIT_SAMLResponse.aspx) |
| ACS URL | Specify the ACS URL. |
| Include ACS URL | If selected, the ACS URL is included. |
| Scope | Specify the scope as email,public_profile |
| Response Attribute | Specify the Response Attribute as email. |
| User Creation | Upon enabling this checkbox, the user is created if that user is not available in Apex database but wants to login into the application using Facebook OAuth authentication method. |
| Time Zone | Select the timezone from the drop-down list. The selected timezone will be assigned to the newly created user. **Note:** This field is displayed only when the User Creation checkbox is enabled. |
| Template Name | Select the role template from the list. The selected role template will be assigned to the newly created user. **Note:** This field is displayed only when the User Creation checkbox is enabled. |
| Logo | Upload a logo. The uploaded logo is displayed on the Login Screen. The logo image width should be less than 300px and height should be less than 48px. Supported Image formats are .gif, .jpeg, .jpg, .png, .bmp. |

## Okta

To enable Single Sign on for Okta from Apex, the following configuration should be done in Okta portal.

### For Web Application

Prerequisites to be performed in Okta Portal

**Prerequisites to be performed in Okta Portal**

1. Sign up in Okta portal using [https://www.okta.com/developer/signup/](https://www.okta.com/developer/signup/). ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-bpyo33xw.png)Figure**:** Sign up
2. Click **Get Started**. Your login URL is displayed. Login to Okta using this URL. You will receive a confirmation mail. Set your password by clicking this link. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-mpwzek8j.png)**Figure:** Okta URL
3. Specify your User **Name** and **Password** and click **Sign In**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-p674t3pk.png)**Figure:** Okta Login page
4. On the top menu, select **Security > API**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-4g152nov.png)**Figure:** Security Menu
5. On the API page, click **Authorization Servers**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-mpri7vfg.png)**Figure:** API Page
6. On the Add Authorization Server pop-up page, Specify Name, Audience, and Description. For more information about these fields, refer [https://developer.okta.com/authentication-guide/implementing-authentication/set-up-authz-server.html](https://developer.okta.com/authentication-guide/implementing-authentication/set-up-authz-server.html). ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-r3315bfc.png)**Figure:** Add Authorization URL Pop-up page
7. Under the Settings section, the issuer field is displayed. Store this URL securely. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-o0cyy6x1.png)**Figure:** Settings section

Note:

The **Issuer URL** displayed here should be entered in the Authorization URL, Access Token URL, and User Info URL fields of application.

1. Select **Access Policies** and click **Add Policy**. The **Add Policy** pop-up page is displayed. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-3udii8ml.png)**Figure:** Add Policies pop-up page
2. On the **Add Policy** pop-up page, specify the **Name**, and **Description** and click **Create Policy**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-8ogi9hzo.png)**Figure:** Add Policy page.
3. On the **Add New Access Policy** page, create **Add Rule**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-uflm15ue.png)**Figure:** Add New Access Policy Page
4. On the **Add Rule** pop-up page, specify the **Rule Name** and click **Create Rule**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-4pgr3kpb.png)**Figure:** Add Rule Pop-up page
5. On the top menu, hover your mouse over **Applications** and select **Applications**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-o3efd0fi.png)**Figure:** Applications
6. On the **Applications** page, click **Add Application** and then click **Create New App**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-b0753fwb.png)**Figure:** Add Application
7. On the **Create New Application** pop-up page, select the platform as **Web** and **Sign On Method** as **OpenID Connect**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-g80bite4.png)**Figure:** Create New App page
8. On the Create OpenID page, specify the Application Name and the Redirect URL. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-kcrxtwzv.png)**Figure:** Create OpenID page

Note:

The Redirect URL specified here should be entered in the Redirect URL field application.

1. On the **General Settings** Page, click **Edit** and select all the available options under **Allowed grant types**. The **Client ID** and **Client Secret** are displayed under Client Credentials section. Store them securely. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-5ns0srj6.png) **Figure:** General Settings page

Note:

The **Client ID** and **Client Secret** displayed here should be entered in the **Client Id** and **Client Secret Key** fields of application.

1. You can add multiple People or Groups to the application under the **Assignments** section. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-sahzus5s.png) **Figure:** Add Assignment page

## Configuration in application

To Configure SSO for Okta from Application, perform the following steps:

1. Navigate to **Admin** > **Infrastructure** > **SSO Configuration**. The **SSO Configuration** page is displayed.
2. On the **SSO Configuration** page, select **OAuth** under the **Authentication Type** and click **Add New** on the **Actions** Panel.
3. Specify the required details and click **Submit**. For more details about the fields on the **SSO Configuration** page, see **Field Description**.

#### Field Description

The following table describes the fields on the **SSO Configuration** page:

| **Fields** | **Description** |
| --- | --- |
| Domain | Select the domain name from the list. The Facebook OAuth based authentication will be configured for the selected domain. **Note:** This field is not visible for single domain users. |
| URL | Specify the Mobile Web Service URL. Example: https://baseurl/mobilews |
| Grant Type | Select the Grant Type as **Authorization Code** from the drop-down list. |
| Authorization URL | Specify the following Authorization URL: urlfromoktaportal/v1/authorize |
| Access Token URL | Specify the following Access Token URL: urlfromoktaportal/v1/token |
| Client ID | Specify the Client ID. This is the Application ID from Okta portal. Refer to Prerequisites section for more information about this field. |
| Client Secret Key | Specify the Client Secret Key. This is the Password generated from Okta portal. Refer to Prerequisites section for more information about this field. |
| User Information URL | Specify the following User Information URL: urlfromoktaportal/userinfo |
| Redirect URL | Specify the Redirect URL. This is the same URL you have specified in the Redirect URL field of Okta portal. Eg: https://baseurl/Apex_SAMLResponse.aspx |
| ACS URL | Specify the ACS URL. |
| Include ACS URL | If selected, the ACS URL is included. |
| Scope | Specify the scope as openid email profile address phone offline_access |
| Response Attribute | Specify the Response Attribute as email. |
| User Creation | Upon enabling this checkbox, the user is created if that user is not available in Apex database but wants to login into the application using Okta authentication method. |
| Time Zone | Select the timezone from the drop-down list. The selected timezone will be assigned to the newly created user. **Note:** This field is displayed only when the **User Creation** checkbox is enabled. |
| Template Name | Select the role template from the list. The selected role template will be assigned to the newly created user. **Note:** This field is displayed only when the **User Creation** checkbox is enabled. |
| Logo | Upload a logo. The uploaded logo is displayed on the Login Screen. The logo image width should be less than 300px and height should be less than 48px. Supported Image formats are .gif, .jpeg, .jpg, .png, .bmp. |

### For Mobile

Prerequisites to be performed in Okta Portal

**Prerequisites to be performed in Okta Portal**

1. Sign up in Okta portal using [https://www.okta.com/developer/signup/](https://www.okta.com/developer/signup/). ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-4iu4wgtl.png) **Figure:** Sign up
2. Click **Get Started**. Your login URL is displayed. Login to Okta using this URL. You will receive a confirmation mail. Set your password by clicking this link. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-37sluqyc.png) **Figure:** Okta URL
3. Specify your User **Name** and **Password** and click **Sign In**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-bqp8nvht.png) **Figure:** Okta Login page
4. On the top menu, select **Security > API**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-c52n0jit.png) **Figure:** Security Menu
5. On the API page, click **Authorization Servers**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-c7tp9qk4.png) **Figure:** API Page
6. On the Add Authorization Server pop-up page, Specify Name, Audience, and Description. For more information about these fields, refer [https://developer.okta.com/authentication-guide/implementing-authentication/set-up-authz-server.html](https://developer.okta.com/authentication-guide/implementing-authentication/set-up-authz-server.html). ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-p4v851dv.png) **Figure:** Add Authorization URL Pop-up page
7. Under the Settings section, the issuer field is displayed. Store this URL securely. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-7qwnjglo.png) **Figure:** Settings section

Note:

The **Issuer URL** displayed here should be entered in the Authorization URL, Access Token URL, and User Info URL fields of application.

1. Select **Access Policies** and click **Add Policy**. The **Add Policy** pop-up page is displayed. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ajsvc8sy.png) **Figure:** Add Policies pop-up page
2. On the **Add Policy** pop-up page, specify the **Name**, and **Description** and click **Create Policy**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-5r4wvpgt.png) **Figure:** Add Policy page.
3. On the **Add New Access Policy** page, create **Add Rule**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-tx7ulags.png) **Figure:** Add New Access Policy Page
4. On the **Add Rule** pop-up page, specify the **Rule Name** and click **Create Rule**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-7x5h7lx6.png) **Figure:** Add Rule Pop-up page
5. On the top menu, hover your mouse over **Applications** and select **Applications**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-7gim2n62.png) **Figure:** Applications
6. On the **Applications** page, click **Add Application** and then click **Create New App**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-qjtm4ydw.png) **Figure:** Add Application
7. On the **Create New Application** pop-up page, select the platform as **Web** and **Sign On Method** as **OpenID Connect**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-80fg6jsl.png) **Figure:** Create New App page
8. On the Create OpenID page, specify the Application Name and the Redirect URL. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-weq6q62t.png) **Figure:** Create OpenID page

Note:

The Redirect URL specified here should be entered in the Redirect URL field of application.

1. On the **General Settings** Page, click **Edit** and select all the available options under **Allowed grant types**. The **Client ID** and **Client Secret** are displayed under Client Credentials section. Store them securely. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-n5ibdc7f.png) **Figure:** General Settings page

Note:

The **Client ID** and **Client Secret** displayed here should be entered in the **Client Id** and **Client Secret Key** fields of application.

1. You can add multiple People or Groups to the application under the **Assignments** section. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-mspsx6i4.png) **Figure:** Add Assignment page

## Configuration in application

To Configure SSO for Okta from Apex, perform the following steps:

1. Select **Admin** > **Basic** > **Infrastructure** > **SSO Configuration**. The **SSO Configuration** page is displayed.
2. On the **SSO Configuration** page, select **OAuth** under the **Authentication Type** and click **Add New** on the **Actions** Panel.
3. Specify the required details and click **Submit**. For more details about the fields on the **SSO Configuration** page, see **Field Description**.

#### Field Description

The following table describes the fields on the **SSO Configuration** page:

| **Fields** | **Description** |
| --- | --- |
| Domain | Select the domain name from the list. The Facebook OAuth based authentication will be configured for the selected domain. **Note:** This field is not visible for single domain users. |
| URL | Specify the Mobile Web Service URL. Example: https://baseurl/mobilews |
| Grant Type | Select the Grant Type as **Implicit** from the drop-down list. |
| Authorization URL | Specify the following Authorization URL: urlfromoktaportal/v1/authorize |
| Access Token URL | Specify the following Access Token URL: urlfromoktaportal/v1/token |
| Client ID | Specify the Client ID. This is the Application ID from Okta portal. Refer to Prerequisites section for more information about this field. |
| Client Secret Key | Specify the Client Secret Key. This is the Password generated from Okta portal. Refer to Prerequisites section for more information about this field. |
| User Information URL | Specify the following User Information URL: urlfromoktaportal/v1/userinfo |
| Redirect URL | Specify the Redirect URL. This is the same URL you have specified in the Redirect URL field of Okta portal. Eg: https://baseurl/Apex_Weblogin.aspx |
| ACS URL | Specify the ACS URL. |
| Include ACS URL | If selected, the ACS URL is included. |
| Scope | Specify the scope as openid email profile address phone offline_access |
| Response Attribute | Specify the Response Attribute as email. |
| User Creation | Upon enabling this checkbox, the user is created if that user is not available in Apex database but wants to login into the application using Okta authentication method. |
| Time Zone | Select the timezone from the drop-down list. The selected timezone will be assigned to the newly created user. **Note:** This field is displayed only when the **User Creation** checkbox is enabled. |
| Template Name | Select the role template from the list. The selected role template will be assigned to the newly created user. **Note:** This field is displayed only when the **User Creation** checkbox is enabled. |
| Logo | Upload a logo. The uploaded logo is displayed on the Login Screen. The logo image width should be less than 300px and height should be less than 48px. Supported Image formats are .gif, .jpeg, .jpg, .png, .bmp. |

## Ping Federate

To enable Single Sign on for Ping Federate from Apex, the following configuration should be done in Ping Federate portal.

Prerequisites to be performed in Ping Federate Portal

1. Login to Ping Federate server. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-pe61cs8q.png)Figure**:** Login Screen
2. On the **Server Configuration** tab, click **Server Settings**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-9e022501.png)Figure**:** Server Configuration
3. On the **Server Settings** page, configure the tabs as shown below:

**System Administration**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-mgnn59uf.png)

Figure**:** System Administration tab

**System Info**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-b6aedqqr.png)

Figure**:** System Info tab

**Runtime Notifications**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-8e55r0lj.png)

Figure**:** Runtime Notifications tab

**Runtime Reporting**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-67dj1sbs.png)

Figure**:** Runtime Reporting tab

**Account Management**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-mmx3knb8.png)

Figure**:** Account Management tab

**Roles & Protocols**

Make sure that **Enable OAUTH 2.0 Authorization Server (AS) Role** is selected.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-7pqke97u.png)

Figure**:** Roles & Protocols tab

**Federation Info**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-yusmp5uu.png)

Figure**:** Federation Info tab

**System Options**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-d6ai89pe.png)

Figure**:** System Options tab

**Metadata Signing**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-uh5k2taw.png)

**Figure:** Metadata Signing tab

**Metadata Lifetime**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-aeu4btlk.png) Figure**:** Metadata Lifetime tab

**Summary**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-wgqiugen.png)Figure**:** Summary tab

1. On the **Server Configuration** page, click **Data Stores**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-esanlcfv.png)Figure**:** Data Stores
2. On the **Manage Data Stores** page, click **Add New Data Store**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-g8sc8czf.png)Figure**:** Manage Data Stores
3. On the **Data Store** page, configure the tabs as shown below:

**Data Store Type**

Select the **Data Store Type** as **LDAP**.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-uslfgty1.png)

Figure**:** Data Store Type tab

**LDAP Configuration**

Provide your LDAP Credentials.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-qei1fibu.png)

Figure**:** LDAP Configuration tab

**Summary**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-qrrampog.png)

Figure**:** Summary tab

1. On the **Server Configuration** page, click **Active Directory Domains/Kerberos Realms**.
2. On the **Manage AD Domains/Kerberos Realms** page, click **Add Domain/Realm**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-k23uo0uk.png)Figure**:** Add Domain/Realm

> [!NOTE]
> Note
> 
> To check the configuration, click **Test Domain/Realm Connectivity**. You should receive a Test Successful message if your configuration is correct.

1. On the **Manage Domain/Realm** page, Specify the Domain Name, Username and Password. **![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-fnnrtt76.png)**Figure: Manage Domain/Realm page
2. On the **Server Configuration** page, click **Password Credential Validators**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-em4koibf.png)Figure**:** Password Credential Validators
3. On the **Password Credential Validators** page, click **Create New Instance**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-62pk5y4v.png)Figure**:** Create New Instance
4. On the Create Credential Validator Instance, configure the tabs as shown below:

**Type**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-kymieaw7.png)

Figure**:** Type

**Instance Configuration**

Specify the **Search Filter** as (|(sAMAccountName=${username})(userPrincipalName=${username}))

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-ofh34y00.png)

Figure**:** Instance Configuration tab

**Extended Contract**

Add **sAMAccountName** and **userPrincipalName** under Extend the Contract.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-soy6fjgx.png)

Figure**:** Extended Contract tab

**Summary**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-otmvm9t8.png)Figure**:** Summary

1. On the **Identity Provider** page, click **Adapters**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-o8c7cdpa.png)Figure**:** Adapters
2. On the **Manage IDP Adapter Instances** page, click **Create New Instance**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-k3qrcr9a.png)Figure**:** Manage IDP Adapter Instances
3. On the Create Adapter Instance page, configure the tabs as shown below:

**Type**

Select **Type** as **HTML Form IdP Adapter**.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-61fj0sic.png)

Figure**:** Adapter Type

**IDP Adapter**

Select **Password Credential Validator Instance** as **Password Validator** and click **Update** under **Action**.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-iyrmp160.png) Figure**:** IDP Adapter

**Extended Contract**

Under **Extend the Contract** add **domainusername** and **email**.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-a9g0qmrg.png)

Figure**:** Extended Contract

**Adapter Attributes**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-l9xxdgnv.png)

Figure**:** Adapter Attributes

**Adapter Contract Mapping**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-xlhzdkd5.png)

Figure**:** Adapter Contract Mapping

**Summary**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-0kdw5blo.png)Figure**:** Summary

1. On the OAuth Server page, click Create New under Clients. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-uops34f0.png)Figure**:** OAuth Server page
2. On the Client page, configure the tabs as shown below: ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-duovburc.png)Figure**:** Client page

> [!NOTE]
> Note
> 
> - **Client ID**: The Client ID you enter above should be entered in the **Client ID** field of application.
> - **Client Secret**: The Client Secret generated above should be entered in the **Client Secret Key** field of application.
> - **Redirect URL**: The Redirect URL you enter above should be entered in the **Redirect URL** field of application. Example: [*https://baseurl/Apex_Samlresponse.aspx*](https://baseurl/Summit_Samlresponse.aspx) for Web Application and [*https://baseurl/Apex_Weblogin.aspx*](https://baseurl/Summit_Weblogin.aspx) for Mobile Application.

1. On the **OAuth Server** page, click **Access Token Management** under **Token Mapping**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-sf5jsfe7.png)Figure**:** Access Token Management
2. On the **Access Token Management** page, click **Create New Instance**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-wajs561d.png)Figure**:** Create New Instance
3. On the **Create Access Token Management Instance**, configure the tabs as shown below:

**Type**

Select the Type as **Internally Managed Reference Tokens**.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-4n5dzlah.png) Figure**:** Access Token Type

**Instance Configuration**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-178gs90p.png) Figure**:** Instance Configuration

**Session Validation**

**![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-pr0f4b3l.png)**Figure**:** Session Validation

**Access Token Attribute Contract**

Under Extend the Contract, add domainusername, email, group, username.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-v9jbc680.png) Figure**:** Access Token Attribute Contract

**Resource URLs**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-b9536d2i.png)Figure**:** Resource URLs

**Access Control**

**![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-j2oc7mxb.png)**Figure**:** Access Control

**Summary**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-0rinx5k2.png)Figure**:** Summary

1. On the **OAuth Server** page, click **IDP Adapter Mapping**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-jyezkfka.png)Figure: IDP Adapter Mapping
2. On the **IDP Adapter Mapping** page, select **HTML Form Adapter** from the drop-down list and click **Add Mapping**. Click **Save. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-7whvuhwz.png)**Figure: Add Mapping
3. The Summary page of IDP Adapter Mapping is displayed. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-7jgyjaym.png)Figure**:** IDP Adapter Summary
4. On the **OAuth Server** page, click **Access Token Mapping**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-joz3zla5.png)Figure**:** Access Token Mapping
5. On the **Access Token Attribute Mapping** page, select **Context** as **HTML Form Adapter**, **Access Token Manager** as **actoken** and click **Add Mapping**. Click **Save**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-givt7g0f.png)Figure**:** Access Token Attribute Mapping
6. The Summary page of **Access Token Attribute Mapping** is displayed. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-tg99soqr.png)Figure**:** Summary
7. On the **OAuth Server** page, click **Authorization Server Settings**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-hun56j95.png)Figure**:** Authorization Server Settings
8. Configure the **Authorization Server Settings** page as shown below: ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-1aiwcw7c.png)Figure**:** Authorization Server Settings
9. On the **OAuth Server** page, click **Scope Management**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-3srcsmqx.png)Figure**:** Scope Management
10. On the **Common Scopes** tab, add **email** under **Scope Value**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-f9hkd1kc.png)Figure**:** Common Scopes
11. On the **OAuth Server** page, click **OpenID Connect Policy Management**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-9dq8svqc.png)Figure**:** OpenID Connect Policy Management
12. On the **Policy Management** page, click **Add Policy**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-0tza6rba.png)Figure**:** Add Policy
13. On the **Policy Management** page, configure the tabs as shown below:

**Prerequisites to be performed in Ping Federate Portal**

**Manage Policy**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-t600g1o7.png)Figure**:** Manage Policy

**Attribute Contract**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-v2ri7c30.png)Figure**:** Attribute Contract

**Attribute Scopes**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-trgdmq0q.png)Figure**:** Attribute Scopes

**Attribute Sources & User Lookup**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-d3ij8wtb.png)Figure**:** Attribute Sources & User Lookup

**Contract Fulfillment**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-amm9iv5b.png)Figure**:** Contract Fulfillment

**Issuance Criteria**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-uhc017f6.png)Figure**:** Issuance Criteria

**Summary**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/oauth-image-x0qo143n.png)Figure**:** Summary

#### Configuration in application

To Configure SSO for Ping Federate from Apex, perform the following steps:

1. Select **Admin** > **Infrastructure** > **SSO Configuration**. The **SSO Configuration** page is displayed.
2. On the **SSO Configuration** page, select **OAuth** under the **Authentication Type** and click **Add New** on the **Actions** Panel.
3. Specify the required details and click **Submit**. For more details about the fields on the **SSO Configuration** page, see [Field Description](/apex/docs/oauth#field-description1).

#### Field Description

The following table describes the fields on the **SSO Configuration** page:

| **Fields** | **Description** |
| --- | --- |
| Domain | Select the domain name from the list. The Facebook OAuth based authentication will be configured for the selected domain. **Note:** This field is not visible for single domain users. |
| URL | Specify the Web Service URL. Example: https://baseurl/Apexweblogin.aspx |
| Grant Type | Select the Grant Type as **Authorization Code** from the drop-down list. |
| Authorization URL | Specify the Authorization URL: Example: [https://pingfederatebaseurl/as/authorization.oauth2](https://pingfederatebaseurl/as/authorization.oauth2) |
| Access Token URL | Specify the Access Token URL: Example: [https://pingfederatebaseurl/as/token.oauth2](https://pingfederatebaseurl/as/token.oauth2) |
| Client ID | Specify the Client ID. This is the Client ID from Ping Federate Server. Refer to Prerequisites section for more information about this field. |
| Client Secret Key | Specify the Client Secret Key. This is the Client Secret generated from Ping Federate Server. Refer to Prerequisites section for more information about this field. |
| User Information URL | Specify User Information URL Example: [https://pingfederatebaseurl/idp/userinfo.openid](https://pingfederatebaseurl/idp/userinfo.openid) |
| Redirect URL | Specify the Redirect URL. This is the same URL you have specified in the Redirect URL field of Ping Federate Server. For Web: Eg: https://baseurl/Apex_SAMLResponse.aspx For Mobile : Eg: https://baseurl/Apex_Weblogin.aspx |
| ACS URL | Specify the ACS URL. |
| Include ACS URL | If selected, the ACS URL is included. |
| Scope | Specify the Scope as openid email. |
| Response Attribute | Specify the Response Attribute as email. |
| User Creation | Upon enabling this checkbox, the user is created if that user is not available in Apex database but wants to login into the application using Okta authentication method. |
| Time Zone | Select the timezone from the drop-down list. The selected timezone will be assigned to the newly created user. **Note:** This field is displayed only when the **User Creation** checkbox is enabled. |
| Template Name | Select the role template from the list. The selected role template will be assigned to the newly created user. **Note:** This field is displayed only when the **User Creation** checkbox is enabled. |
| Logo | Upload a logo. The uploaded logo is displayed on the Login Screen. The logo image width should be less than 300px and height should be less than 48px. Supported Image formats are .gif, .jpeg, .jpg, .png, .bmp. |

### Actions

This section explains all the icons displayed on the **Actions** panel of the **SSO Configuration** page.

#### **SHOW LIST**

Click **SHOW LIST** to display the **LIST** table showing all the SSO Configurations in the application for OAuth based authentications.

#### **Filters**

On the **Filters** pop-up page, select a domain name from the list and then click **Submit**. A list of OAuth based authentications configured for the selected domain is displayed.

#### **Add New**

Click **Add New** to configure a new OAuth based authentication for a domain.