Set up single sign-on

Querio supports Okta OIDC. Connect your company's Okta account, test sign-in, then choose whether to require it for your team.

Before you start

You'll need:

• A workspace with SSO enabled on its plan.
• Admin or a role with the Single sign-on permission.
• An Okta administrator to prepare an OIDC application for Querio, assign the intended users and provide its issuer URL, client ID and client secret.
• Your team's email domain, such as company.com.

For Querio at app.querio.ai, have your Okta administrator register this sign-in redirect URI:

https://auth.querio.ai/api/sso/browser/callback

Connect Okta

1. Open Settings > Single sign-on and select Set up SSO, or Edit SSO for an existing connection.
2. Enter the SSO API URL using the Okta issuer URL, such as https://example.okta.com/oauth2/default.
3. Enter your SSO domain, Client ID and Client secret.
4. Set SSO type to Optional while you test the connection.
5. Select Save SSO, then Return to Querio.

Saving checks the issuer's OIDC metadata. Complete the sign-in test below to check the client credentials and user access too.

Test sign-in

1. Keep your administrator session open. In a private browser window, open Querio and choose Continue with SSO.
2. Enter an email at your configured domain and sign in through Okta as a user assigned to the application.
3. Check that the user reaches the intended workspace. In Settings > Users, review their role and groups.
4. Check that they can open the expected work and query the data they need.

SSO handles sign-in. Use Manage team access and permissions to control what users can do and which data they can query.

Require Okta sign-in

Once the test succeeds, open Settings > Single sign-on > Edit SSO, enter the client secret again and change SSO type to Enforced. Select Save SSO.

Enforced requires SSO for the configured domain and workspace users. Check sign-in modes before changing or disabling an existing connection.

For configuration fields and troubleshooting, see Single sign-on reference. To request another identity provider, contact Querio support.