> Markdown version of [Okta](https://vaadin.com/docs/next/tools/sso/integrations/okta). Section index: [llms.txt](https://vaadin.com/docs/next/tools/llms.txt)

# Okta Integration (deprecated since V25.3)

> **Warning:** SSO Kit is deprecated and won’t be available in Vaadin 26.
>
> A replacement is already in place: all of the kit’s major features are now available directly in Spring Security and in Vaadin’s Spring Security integration. See [Migrating from SSO Kit to Spring Security](https://vaadin.com/docs/next/tools/sso/migrating-to-spring-security.md) for how to move an existing application, and which features you have to build yourself.

This tutorial shows how to restrict access to a Vaadin view by using SSO Kit together with Okta.

## <a id="pre-requisites"></a>Pre-Requisites

You will need access to [SSO Kit](https://vaadin.com/docs/next/tools/sso.md) and a Vaadin application with SSO Kit installed. You can install SSO Kit by following the instructions in the [Getting Started](https://vaadin.com/docs/next/tools/sso.md#topics) guide. You also need an [Okta account](https://www.okta.com). For this, you can choose between three types of Okta accounts: a developer account; a trial account; and a commercial account. You may use any of these for this tutorial.

## <a id="creating-an-okta-workspace"></a>Creating an Okta Workspace

You can access your Okta workspace after registering with Okta. A workspace includes an Authorization Server and administrator account. The workspace is behind a URL like *dev-12345678.okta.com*

### <a id="creating-a-new-application-integration"></a>Creating a New Application Integration

To integrate Okta with your Vaadin application, go to your Okta workspace and select **Applications** from the sidebar menu. In the view that opens, select **Create App Integration** and choose **OIDC - OpenIdConnect** for the Sign-in method by ticking the box next to it. SSO Kit uses the OpenID Connect (OIDC) protocol standard built on top of OAuth 2.0 to leverage the Spring Security framework for configuring role-based user authorization.

Next, select **Web Application** as the **Application type** and move to the next step by clicking **Next**.

### <a id="setting-sign-in-and-sign-out-uris"></a>Setting Sign-In and Sign-Out URIs

Add a name and check **Client credentials** as the Grant type. Then give `http://localhost:8080/login/oauth2/code/okta` as the **Sign-in redirect URI** and `http://localhost:8080` as the **Sign-out redirect URI**. These are the addresses where the user is directed when they try to sign into the application and when they sign out.

There are settings related to groups. They can be used to group users into categories, for example, to split access privileges between different user groups. However, skip group assignments for now. That’s covered at the end of this page.

When ready, select **Save** to create your application.

## <a id="connecting-okta-to-your-vaadin-application"></a>Connecting Okta to your Vaadin Application

Select your newly created application from the **Applications** menu and copy the Client ID by clicking **Copy to clipboard** next to the Client ID and paste it into your `application.properties` file.

Repeat this process with the Secret by clicking **Copy to clipboard** next to the hidden Secret.

Then add your Okta workspace URL by first selecting **Security** and then **API** from the sidebar menu. You can find the URL in the Authorization Servers tab under **Issuer URI**.

Your `application.properties` file should then look something like this:

`application.properties`

```properties
# SSO Kit configuration

spring.security.oauth2.client.registration.okta.client-secret=[paste your secret value here]
spring.security.oauth2.client.provider.okta.issuer-uri=https://dev-12345678.okta.com/oauth2/default
spring.security.oauth2.client.registration.okta.client-id=[paste your client ID here]
spring.security.oauth2.client.registration.okta.scope=openid
vaadin.sso.login-route=/oauth2/authorization/okta
```

Views protected by the `@PermitAll` security annotation will now redirect to Okta for login.

## <a id="assigning-users-to-the-application"></a>Assigning Users to the Application

You need to assign the users you wish to authorize within your application. You can test the integration by assigning yourself as a user. Go to your Okta Web application and choose the **Assignments** tab where you can find a list of your user accounts, including your Okta administrator account. Assign the application to your administrator user by selecting the *Assign* drop-down menu, choosing the **Assign to People** option, and selecting your administrator account from the list.

You may now run your application and access protected views by signing in with your Okta administrator account once prompted.

### <a id="adding-new-users"></a>Adding New Users

In the Okta developer dashboard, select **Directory** from the sidebar menu and select **People**. Click **Add Person** and fill in the user details. Okta requires a valid email address for every user.

### <a id="adding-new-groups"></a>Adding New Groups

You may group users by specifying rules and restrictions. Start by selecting **Directory** from the sidebar menu and then **Groups**. Okta creates a default group when you sign up for a workspace named "Everyone" where all current users are assigned without any rules.

Create a new Group by clicking **Add group**. After providing a name and a description, you’ll be redirected to the Group details where you can assign users to the Group and assign the Group to an application.