Connect Okta (SSO and SCIM)

What you need

• The Application Administrator role or higher in the Okta Admin Console (https://(your-org)-admin.okta.com).
• SSO works with Okta Single Sign-On. SCIM requires Lifecycle Management.
• The administrator of the Aiyori organization must be able to open “Settings” → “Connect your company’s identity provider” on the trainer’s screen.

1. Create the app (OpenID Connect)

1. Admin Console → Applications → Applications → Create App Integration.
2. For Sign-in method, choose OIDC - OpenID Connect; for Application type, choose Web Application → Next.
3. Enter the values in the table below and Save.
4. On the General tab, note the Client ID and Client secret. Show the secret with the eye icon on its row and copy it.
5. Under Client Credentials, choose Edit → check Require PKCE as additional verification → Save. Leave Client authentication set to Client secret (the default). Aiyori sends PKCE.
6. To let people sign in from a tile on the Okta dashboard (optional), set Login initiated by to Either Okta or App, and enter https://app.aiyori.app/api/web/sso/start?code=(organization code) as the Initiate login URI.

App integration name

Aiyori

Grant type

Authorization Code only (the default)

Sign-in redirect URIs

https://app.aiyori.app/api/web/sso/callback

Sign-out redirect URIs

Can be left empty

Assignments

Limit access to selected groups (assign them later), or Skip group assignment for now

2. Enter the values in Aiyori (SSO)

On Aiyori’s trainer screen, go to “Settings” → “Connect your company’s identity provider” → “SSO”, enter the values and press “Save”.

Issuer URL

https://(your-org).okta.com (the org authorization server: your Admin Console URL without -admin). If your company uses a custom domain, use that URL.

Client ID and Client secret

The values you noted in section 1

Allowed email domains

Your company’s email domains (one per line)

A custom authorization server ending in /oauth2/default also works (for companies with API Access Management). To decide, open the issuer URL followed by /.well-known/openid-configuration in a browser and enter exactly the issuer value shown there.

Assign a test user on the Assignments tab. If they can go from Aiyori’s login screen → “Log in with company account” → organization code → Okta login → back to Aiyori, the connection works. Administrators can also test with “Try with my company account” in “Try logging in yourself”.

3. SCIM (Provisioning)

1. In Aiyori, go to “Connect your company’s identity provider” → “SCIM”, enter Okta as the “Key name” and press “Create key” → note the key that appears (it’s shown only on this screen).
2. In Okta, open the Aiyori app → General tab → Edit under App Settings → set Provisioning to SCIM → Save. If this option doesn’t appear, connect with section 4 below, which uses a separate app just for SCIM.
3. Provisioning tab → Integration → Edit: enter the values in the table below, then run Test Connector Configuration. When Create Users, Update User Attributes and Push Groups are checked, Save.
4. Provisioning tab → To App → Edit → Enable Create Users, Update User Attributes and Deactivate Users → Save. Leave Sync Password off, and turn off the option that sets a password when new users are created (Aiyori doesn’t store passwords).
5. The attribute mappings (Aiyori User Profile Mappings) can stay at their defaults. Check that userName is the work email address (the default is the Okta username, which is usually the email address).
6. On the Assignments tab, assign the groups that should use Aiyori. The people you assign become Aiyori learners.
7. Push Groups tab → + Push Groups → choose groups such as departments → Save. They become Aiyori groups.

SCIM connector base URL

https://app.aiyori.app/api/scim/v2

Unique identifier field for users

userName

Supported provisioning actions

Check Push New Users, Push Profile Updates and Push Groups (Import New Users and Profile Updates isn’t needed)

Authentication Mode

HTTP Header. Put the key from step 1 in Authorization (Bearer)

4. SCIM through a separate app (if the option in section 3 doesn’t appear)

Sometimes the General tab of an OpenID Connect app has no Provisioning option. In that case, connect SCIM alone through an app from the Okta catalog.

1. Applications → Applications → Browse App Catalog → search for SCIM 2.0 Test App → SCIM 2.0 Test App (Header Auth) → Add Integration.
2. General settings: set the Application label to Aiyori SCIM, check Do not display application icon to users (learners don’t see a tile), clear Browser plugin auto-submit, then Next.
3. Sign-on options can stay at their defaults (sign-in goes through the app from section 1, so they aren’t used). Set Application username format to Email, then Done.
4. Provisioning tab → Configure API Integration → check Enable API integration → enter https://app.aiyori.app/api/scim/v2 as the Base URL and paste the key from section 3, step 1 as the API Token as it is → Test API Credentials → Save.
5. The rest is the same as section 3, steps 4–7 (To App, attribute mappings, assignments, Push Groups).
6. Assign the same groups to the SSO app (Aiyori) and the SCIM app (Aiyori SCIM).

This app sends the API Token value as it is, without Bearer in front of it. Aiyori accepts either form.

5. Check on the day you connect

• One assigned person can get in with a company account. People who aren’t assigned are stopped on the Okta screen.
• Assigned people appear as Aiyori learners and are in the groups you pushed.
• When you unassign that person (or Deactivate them in Okta), they show as “Disabled by company settings” in Aiyori and can’t log in. When you restore them, they can get in again.

How Okta works with Aiyori

• The SCIM operations used are creating users, updating attributes, deactivating users (Deactivate) and pushing groups. Password sync and importing from Aiyori into Okta (Import) aren’t used.
• When you unassign someone, Okta sends active: false (it doesn’t send DELETE). In Aiyori, both suspend the learner and keep their training records.
• People who sign in with SSO are linked to the learner created by SCIM through their work email address.
• SCIM keys don’t expire. To replace one, create a new key in Aiyori and enter it in the Okta Integration settings, then set the old key to “Revoke”.