Okta SSO

Set up Okta as your identity provider for Willow.

Prerequisites

• An active Okta account with administrative privileges
• A Willow account with administrative access

Supported features

SSO Features

• SP-initiated SSO

SCIM Features

• Import Users
• Create Users
• Update User Attributes
• Deactivate Users
• Group Push

Configuration steps

Add Willow integration

1. Sign in to your Okta Admin Console at https://{your-org}-admin.okta.com/admin/apps/add-app
2. Navigate to Applications → Browse App Catalog
3. Search for Willow in the search bar
4. Click + Add Integration
5. Fill in the application details:
   • Application label: Enter a name for your app (recommended: "Willow")
   • Willow Admin URL:
     • For SaaS deployments: app.withwillow.ai
     • For On-Premise deployments: Your APP_URL (for example, willow-admin.your-domain.com)
   • Willow Dashboard URL:
     • For SaaS deployments: {your-willow-org}.mcp-s.com
     • For On-Premise deployments: Your CONNECT_URL (for example, willow-dashboard.your-domain.com)
6. Click Done

Configure SSO

1. In the Willow app on Okta, navigate to the Sign On tab
2. Click Edit in the OpenID Connect ID Token section
3. Under Credentials Details, set Application username format to Email
4. Click Save
5. Copy the Client ID and Client secret values
6. Open a new browser tab and go to your Willow Admin Console at https://app.withwillow.ai/admin/settings
7. Navigate to Settings → Authentication
8. Select Provider: Okta from the dropdown
9. Enter the following values:
   • Client ID: Paste the Client ID from step 5
   • Client Secret: Paste the Client secret from step 5
   • Issuer: Your Okta domain URL (for example, https://acme-corp.okta.com)
10. Click Save Changes

Your SSO configuration is now complete.

Assign users or groups

1. Return to the Okta Admin Console
2. In the Willow app, navigate to the Assignments tab
3. Click Assign and select Assign to People or Assign to Groups
4. Select the users or groups who should have access to Willow
5. Click Assign and then Done

Add users to Willow

1. Go to https://app.withwillow.ai/manage/users
2. Click Add User
3. Enter the user's name and email
4. Click Create

SP-initiated SSO

Users can sign in to Willow by starting from the Willow dashboard:

1. Navigate to your Willow dashboard at https://{your-willow-org}.mcp-s.com
2. You'll be automatically redirected to Okta to authenticate
3. Enter your Okta credentials (if not already signed in to Okta)
4. After successful authentication, you'll be redirected back to the Willow dashboard

Configure SCIM provisioning

If you want to automatically provision and manage users from Okta to Willow, follow these steps:

1. In your Willow Admin Console, navigate to https://app.withwillow.ai/admin/api-tokens
2. Click Generate Token

3. Enter a descriptive name for the token (for example, "Okta SCIM")

4. Click Generate

5. Copy the API Token (it starts with wxt_...)

   Important: Save this token securely. You won't be able to see it again.

6. Return to the Okta Admin Console

7. In the Willow app, navigate to the Provisioning tab

8. Click Configure API Integration

9. Check the Enable API integration checkbox

10. Paste the API token from step 5 into the API Token field

11. Click Test API Credentials to verify the connection

12. Click Save

13. Navigate to Provisioning → To App → Edit

14. Enable the following features:

    • Create Users: Automatically create new users in Willow when assigned in Okta
    • Update User Attributes: Sync user attribute changes from Okta to Willow
    • Deactivate Users: Automatically deactivate users in Willow when unassigned in Okta

15. Click Save

Your SCIM provisioning is now configured.

Contact support

If you continue to experience issues, contact Willow support at [email protected] with the following information:

• Your Okta organization domain
• The error message or behavior you're experiencing
• Screenshots of your configuration (with sensitive information redacted)