This guide explains how to configure Okta as an Identity Provider (IdP) for Kadence using OpenID Connect (OIDC).

By the end of this guide you will be able to:

Estimated setup time:

Your Kadence environment uses a regional login domain.

Throughout this guide you will see the placeholder:

Replace this with the login domain for your region.

Example:

Before starting, make sure you have:

For testing we recommend using a private/incognito browser window.

Log in to the Okta Admin Console.

In the left navigation menu, go to:

Then click:

At the top right of the page, click:

You will see the Create App Integration screen.

Select:

Click:

You will now see the New Web App Integration screen.

Enter a name for the application.

Example:

Under Grant type, enable:

Leave other settings as default.

Scroll to Login settings.

In Sign-in redirect URLs, add:

Example:

⚠ Important

Kadence uses a shared OAuth callback endpoint:

This is not the Kadence login page.

If this URL is missing, Okta will return an error such as:

Under Sign-out redirect URLs, add:

Scroll further down the page until you see:

Here you decide how users are allowed to access the application.

There are two supported configurations.

This is the simplest and most common setup.

At the bottom of the application setup screen you will see:

This includes the option:

Under Controlled access, select:

Ensure the checkbox is enabled:

With Federation Broker Mode enabled:

After saving the application, open:

You will see the message:

This is expected behaviour.

Users can sign in as long as:

This option is recommended because it simplifies setup and scales better for large organisations.

If you prefer to control exactly which users can access Kadence, you can disable Federation Broker Mode.

⚠ Note

Okta warns that disabling Federation Broker Mode may impact performance at scale, because Okta must evaluate application assignments during login.

Most organisations will not notice a difference but large deployments may prefer to leave this enabled.

After creating the application:

Inside the Okta application open:

Scroll to:

Copy the following values:

You will also need your Okta Base URL.

Example:

⚠ Use the base domain only.

Do not include:

Log in to Kadence.

Navigate to:

Select:

Enter the following values.

Example configuration:

Click:

Users start the login process from:

Example:

Kadence will then redirect users to Okta for authentication.

Open a private/incognito browser window.

Visit:

Expected login flow:

Users must exist in Okta before they can authenticate.

Navigate to:

Click:

Example user:

Save the user.

If Federation Broker Mode is disabled users must be assigned manually.

Navigate to:

Open:

Click:

Select users and click Save.

If you instead see:

manual assignment is not required.

Access is controlled through Okta sign-on policies.

Ensure the Okta application contains:

Ensure you are starting login from:

Check:

Okta App Type

Redirect URL

Kadence Login URL

If users encounter issues during setup or login, the following table lists the most common errors and how to resolve them.

The screenshots below show what the Okta configuration screens should look like during setup.

Use these as checkpoints while configuring the integration.

Navigate to:

Select:

Expected screen:

Click Next.

Enter the application name.

Example:

Enable the following grant types:

Your configuration should look similar to:

Under Login settings, add the redirect URL:

Optional sign-out redirect URL:

Your screen should look like:

In the Assignments / Controlled Access section select:

Example configuration:

You may see this option enabled:

This is expected.

If enabled, the application page will display:

This means:

• Access is controlled via Okta sign-on policies

After saving the application, open the General tab.

Copy the following values:

These will be entered in Kadence.

Your screen should show something similar to:

Open:

You may see the message:

This is expected when Federation Broker Mode is enabled.

If you want manual assignment instead:

You will then see:

Open a private browser window.

Visit the Kadence SSO login page:

Expected flow:

Successful authentication will redirect the user to Kadence and create a session.

Authentication sequence:

Behind the scenes this uses:

Always test SSO setup using:

This prevents existing Okta sessions from interfering with testing.
​

For support, reach out to:
​📩 [email protected]

For more helpful articles see:
​📚 Kadence Help Center