README

Okta login for the Magento 2 admin panel.

A thin Okta provider plugin for the provider-agnostic admin-sso capability. It supplies the Okta OIDC preset — discovery from your org domain, scopes, groups claim, login-button branding — while all OIDC protocol lives in sso-core and all admin logic in admin-sso. Installing it pulls admin-sso and sso-core automatically.

Installation

composer require magedevgroup/module-admin-sso-okta
bin/magento module:enable MageDevGroup_SsoCore MageDevGroup_AdminSso MageDevGroup_AdminSsoOkta
bin/magento setup:upgrade

Create the Okta OIDC app

In the Okta Admin Console → Applications → Create App Integration:

1. Sign-in method OIDC - OpenID Connect, application type Web Application.
2. Sign-in redirect URI — the admin-sso callback: https://<admin-host>/<admin-path>/adminsso/sso/callback (<admin-path> is the backend frontName, default admin). It must match the admin URL used at runtime exactly.
3. Save, then copy the Client ID and Client secret.
4. Groups claim — for IdP-group → ACL-role mapping, add a groups claim to the ID token: Sign On → OpenID Connect ID Token → Groups claim, filter e.g. Matches regex .*. Without this Okta emits no groups and role mapping falls back to the default role.

Configuration

Admin → Stores → Configuration → MageDevGroup → Admin SSO.

General (magedevgroup_admin_sso/general/*):

Okta (magedevgroup_admin_sso/okta/*, shown when Okta is selected):

The discovery URL is derived from these: https://<domain>/.well-known/openid-configuration, or https://<domain>/oauth2/<auth-server>/.well-known/openid-configuration with a custom authorization server.

Group → role mapping and enforce-SSO/break-glass are configured in admin-sso; see that module's README.

Requirements

• Magento 2.4.x
• PHP 8.3 – 8.5

Part of the MageDevGroup identity suite

License

OSL-3.0 © MageDevGroup. Commercial licensing and support: https://magedevgroup.com.