> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/faqs/okta-single-sign-on.md).

# Okta single sign-on

FAQs on how to set up single sign-on with Okta

You can integrate DoControl with Okta single sign on (SSO), so there's no need for your organization to maintain user names, passwords, or password rotation.

<details>

<summary>Q. Why should I use Okta with DoControl?</summary>

A. Okta single sign-on manages and secures user authentication into DoControl, eliminating the need to maintain separate usernames and passwords. It significantly reduces the risk of stolen credentials and ensures optimal security.&#x20;

Additionally, logging into DoControl with Okta enforces all Okta policies, including multi-factor authentication.

</details>

<details>

<summary>Q. What type of SSO does DoControl support?</summary>

A. DoControl supports only Service Provider (SP) initiated SSO, which means users must log in through DoControl's login page.&#x20;

Identity Provider (IdP) initiated SSO directly from the Okta dashboard is not natively supported, but you can set up an optional bookmark app in Okta to achieve similar functionality.

</details>

<details>

<summary>Q. Where do I find the DoControl application in Okta?</summary>

A. After logging into your Okta console with admin credentials:

1. Navigate to **Applications > Applications.**
2. Click **Browse App Catalog**.&#x20;
3. Search for **DoControl** and click it to begin the integration process.

</details>

<details>

<summary>Q. Can I log into DoControl directly from my Okta dashboard?</summary>

A. While DoControl only supports SP-initiated SSO natively, you can optionally set up a Bookmark App in Okta that allows users to access DoControl login from their Okta dashboard. This is a third-party application supported by Okta.

</details>

<details>

<summary>Q. What visibility settings should I configure for the DoControl application in Okta?</summary>

A. During the integration setup in General Settings, you should check both visibility options:

* Do not display application icon to users, and&#x20;
* Do not display application icon in the Okta mobile app

This prevents the SAML application from appearing directly in user dashboards.

</details>

<details>

<summary>Q. Do the users I assign in Okta need to already exist in DoControl?</summary>

A. Yes, all people and groups you assign in Okta must already exist as team members in DoControl, and the names must match exactly (case-sensitive). Make sure to verify this before you set up Okta SSO.

</details>

<details>

<summary>Q. I’m getting an error trying to use Okta SSO for DoControl. What should I do? </summary>

A. Make sure you log in via the DoControl login page, and not the Okta interface.

1. Click **Login with SSO**.

<div align="left"><img src="https://content.gitbook.com/content/-MesrnyDMZGYg1V-tOBo/blobs/wrKnJvnIsE7f8ECLi7EZ/image" alt=""></div>

2. Enter your company email and click **Login**.

<div align="left"><img src="https://content.gitbook.com/content/-MesrnyDMZGYg1V-tOBo/blobs/srk4zEosSc3knGoz3Ydr/image" alt=""></div>

3. Click **Login with Okta**.

<div align="left"><img src="https://content.gitbook.com/content/-MesrnyDMZGYg1V-tOBo/blobs/hfpNMjajMonMxhJx7uk3/image" alt=""></div>

4. Authenticate using your Okta user name and password credentials.

<div align="left"><img src="https://content.gitbook.com/content/-MesrnyDMZGYg1V-tOBo/blobs/P8N2nUcDZc8jN44T9PsV/image" alt=""></div>

</details>

<details>

<summary>Q. A user is unable to login via Okta</summary>

A. Make sure you've configured the single sign-on setup correctly. Note especially the following:

* User configuration is case-sensitive.
* Confirm the users are identical in both Okta and DoControl consoles.
* Use only the xxx/saml/sso/metadata as metadata URL.

</details>

<details>

<summary>Q. After activating SSO, users cannot login with email and password </summary>

A. If [SSO enforcement](/docontrol-user-guide/system-management/settings/single-sign-on-sso/enforce-sso-login.md) was previously turned on, even for a moment, the user name and password login method is now blocked.

If you've turned off SSO enforcement, and you want to restore user access, you need to do the following procedure for every user labeled with `force change password.`

**To restore user access:**

1. In DoControl, select **Settings > Admin > Team**.
2. For each user with the `Force change password`login status, select the 3-dot ellipsis.
3. Click **Resend invitation**.

![](https://content.gitbook.com/content/-MesrnyDMZGYg1V-tOBo/blobs/ZUnGOIXpsQrfsG4vGOsS/image)

</details>

{% hint style="success" %}
For more information, see [Okta SSO](/docontrol-user-guide/system-management/settings/single-sign-on-sso/okta-sso.md).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/faqs/okta-single-sign-on.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.