> ## Documentation Index > Fetch the complete documentation index at: https://wundergraphinc-milinda-eng-9918-router-cache-tag-based-inva.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Okta > Setting up SSO with Okta ### Steps to set Okta as an OIDC identity provider Navigate to the Applications view within your Okta Administrator Dashboard. Click on **Create App Integration**. A dialog appears, select **OIDC - OpenID Connect** as the sign-in method. For the application type, select **Web Application** and click on **Next**. Create new app integration page for selecting sign-in method and application type Now give the app a name. Web app integration settings showing App integration name field set to My Web App /> For **Grant Type,** keep the defaults. Scroll down to the **Assignments** section and select one of the options based on your choice and then click on **Save.** Cosmo Docs access assignment dialog with options for group or org-wide access /> Copy the **Client ID** and **Client Secret.** Client Credentials section editing client ID for OAuth flows Navigate to **Security** -> **API**. Client Credentials section editing client ID and authentication settings Select the **default** authorization server. Copy the **Metadata URI.** Default authorization server settings highlighting metadata URI in Cosmo Docs Navigate to the settings page on Cosmo. Organization settings showing name, slug, and status of AI, RBAC, and SCIM features Give the connection a name, paste the **Metadata URI** copied before, into the **Discovery Endpoint,**and paste the **Client ID** and **Client secret** copied before into the **Client ID** and **Client Secret fields respectively,**and then click on **Connect.** Connect OpenID Connect Provider form with fields for name, endpoint, and credentials Configure the mapping between the roles in Cosmo and the user groups in Okta. The field **Group in the provider** can be populated with the name of the group or a regex to match the user groups. Once all the mappers are configured, click on **Save**. Group mapper configuration dialog linking provider groups to Cosmo roles Copy the sign-in and sign-out redirect URIs displayed in the dialog. Steps to configure OIDC provider with sign-in and sign-out redirect URLs Navigate back to the application created on Okta and populate the Sign-in and Sign-out redirect URIs with the above-copied values. Click on **Save**. Login configuration specifying sign-in and sign-out redirect URIs and login initiator Depending on your Okta tenant's available features, configure the `ssoGroups` claim directly on your application, using either Authorization Servers or Token Claims. You may now assign users and groups to the application. Assigned users can sign in to Cosmo with the provider URL. Users assigned to the application must have a username. ### Using Authorization Servers Navigate to Security → API, then click the **Default authorization server**. Open the Claims tab, then click **Add Claim**. Access Policies section showing claims list and Token Preview button Name the claim `ssoGroups` and include it in the **ID Token**. For value type, select **Groups**. For filter, select **Matches** regex and enter `.*` in the field. Click **Create**. Add Claim dialog for ssoGroups with filters, scopes, and create button ### Using Token Claims Navigate to Applications and Resources → Applications, then select the application. Select the `Sign On` tab, scroll to the `Token Claims` card, then click **Add Expression**. Access the Token claims under the application Sign On configuration Name the expression `ssoGroups`. For the expression, enter `user.getGroups({'group.profile.name': 'WunderGraph.*'}).![profile.name]`, then click **Save**. This expression tells Okta to assign all groups that start with `WunderGraph` to the `ssoGroups` claim. You can adjust the expression to fit your organization's needs. To learn more, refer to the Okta documentation. Add claim expression dialog for ssoGroups