***

title: Okta Installation Guide (OIDC)
excerpt: ''
deprecated: false
hidden: false
metadata:
title: ''
description: ''
robots: index
next:
description: ''
---------------

# Prerequisites

<Warning title="Making edits?">
  Before you edit your SSO configuration, make sure you are logged into MyMoveworks. Otherwise, you will not be able to log in and update your SSO configuration details.
</Warning>

**Okta SSO Prerequisites**

* Have access to an Okta tenant
* Be an Okta administrator to that tenant

**Moveworks SSO Prerequisites**

* Your Moveworks Environment should be initialized in order to continue. (Verify with your Account Team if this has been completed)
* Note the following values.

  * `data_center_domain` - the data center where your organization is hosted (see table below).

    | Data Center              | data\_center\_domain          |
    | :----------------------- | :---------------------------- |
    | United States (default)  | moveworks.com                 |
    | Canada                   | am-ca-central.moveworks.com   |
    | EU                       | am-eu-central.moveworks.com   |
    | Australia / Asia Pacific | am-ap-southeast.moveworks.com |
    | Government Secure Cloud  | moveworksgov.com              |
  * `subdomain` - your organization's login subdomain. This should match your `customer_id`, which can be[verified from the General Information Page](/service-management/administration/organization-information).

    <Callout intent="warning">
      Make sure to use the unique subdomain. For example, if you're organization's login subdomain is **acme.moveworks.com**, then your `subdomain` is **acme** and your `data_center_domain` is **moveworks.com** which is part of the US Data center.
    </Callout>
  * `customer_id` - The unique identifier for your organization . This is stored as **Org Name** under **Organization Details > General Information**

    ![](https://files.readme.io/ec5bf3b5e47317fcf8d2ba7f7d6b1348befd4c402553e53c4d966795d1715e13-CleanShot_2024-11-11_at_14.53.19.png)

    <Callout intent="error" title="The Org name cannot be changed. Once set, the same value should be used in all cases.">
      In exceptional cases where you would like Moveworks to support your organisation with a different subdomain value. Please reach out to Moveworks Support.
    </Callout>

# Configuration Steps

## Install Application

1. Go to the Okta Admin screen that lets you create Applications.
2. Click on **Browse App Catalog**.

   ![](https://files.readme.io/c98ebc8-okta_oin.png)
3. Search and select **Moveworks**.

   ![](https://files.readme.io/de76ba1-okta_oin_search.png)
4. Add a logo for the Moveworks application:

   ![](https://files.readme.io/99d48bf-moveworks-logo.png)

   <br />
5. Click **Add integration**.

   ![](https://files.readme.io/08d4b0e-okta_oin_add.png)
6. Set the *Application Label* as Moveworks and click **Done**.

   ![](https://files.readme.io/f4b252e-okta_oin_moveworks.png)

   **Note**: Make sure you get your `Customer ID` from your Customer Success Team before this next step.

## Configure Moveworks Settings

1. On the **General** tab., add your `subdomain`, `data_center_domain`, and optionally your `customer_id`

   <Callout intent="info">
     You can leave `data_center_domain` blank if it is just`moveworks.com`

     In this example, my `data_center_domain` was **am-eu-central.moveworks.com** and my `subdomain` was **acme**.
   </Callout>

   ![](https://files.readme.io/8f099eb9ab4e010737a8b1fac24d6762333c1ed33ff3f4b1d7599304f6e2755d-image.png)

   <br />

## Add OIDC Configuration in MyMoveworks

1. Copy the `Client ID` , `Client secret` from the Sign On tab

   ![](https://files.readme.io/64e3f6446697ced305ccc8c5cd9d46a2dec124303acf30e19f30d037e207b301-CleanShot_2024-10-28_at_09.37.592x.png)
2. Copy the `idp_issuer`. This is not in the Okta settings, but it should be based on your Okta instance name (e.g. If you login at `https://acme.okta.com`, then your `idp_issuer` is `https://acme.okta.com`
3. Navigate to SSO Settings in MyMoveworks

   ![](https://files.readme.io/e2673f514a8e9f3f2e2d91fd92ee244235255676ca6e5413204a6e535e85fdf8-CleanShot_2024-10-28_at_09.42.202x.png)
4. If you already see a `studio` config, edit it. Otherwise, choose **Create**.
5. Add your configuration using the values you've noted above
   * **Moveworks Product**: `studio`
   * **Select Connector**: `okta` or `moveworks`
   * **Authentication Protocol**: `OIDC`
   * **IDP Redirect URL**:  `https://{{subdomain}}.{{data_center_domain}}/login/sso/oidc`
     * e.g. `https://acme.am-eu-central.moveworks.com/login/sso/oidc`
   * **IDP Issuer**: `idp_issuer`
     * e.g. `https://acme.okta.com`
   * **IDP Client Id**: `idp_client_id` (from Step 1)
   * **IDP Client Secret**: `idp_client_secret` (from Step 1)
6. Click **Submit**.
7. Wait a few minutes, then attempt to log into your instance at `https://{{subdomain}}.{{data_center_domain}}`