Skip to content

230. Integrate with Okta Single Sign-On (SSO)

Foretify Manager supports integrating with Okta SSO via OAuth2 for authenticating and authorizing users.

230.1 Configuration in Okta

Configure Foretify Manager as a single-page web application (SPA) in Okta. For detailed information, follow the instructions in Okta Developer Documentation.

  1. Create a new App Integration, with Sign-In method set to OIDC - OpenID Connect and Application type set to Single-Page Application.

  2. Set these configurations:

  3. Grant type: Check Authorization Code and Refresh Token

  4. Sign-in redirect URIs: Set to Foretify Manager's /login/callback API (e.g. http://fmanager.me.com/login/callback)

    !!! note "Python SDK Callback URI"

     For Python SDK authentication, also add http://127.0.0.1:8765/callback to the Sign-in redirect URIs list. The Python SDK uses a browser-based OAuth flow and requires this local callback endpoint to complete authentication.

  5. Sign-out redirect URIs: Set to Foretify Manager's /logout API (e.g. http://fmanager.me.com/logout)

  6. Initiate login URI: Set to Foretify Manager's /login API (e.g. http://fmanager.me.com/login)

  7. Assign users to the fmanager_user and/or fmanager_admin groups.

230.2 Configuration in Foretify Manager

Note

Foretify Manager must be configured to use SSL (HTTPS) before integrating with Okta. Follow Secure and configure Foretify Manager for instructions.

Configure Okta's settings in Foretify Manager, by editing the application.properties:

Option name Description
spring.security.oauth2.client.registration.okta.client-id Client ID given by the Okta service
spring.security.oauth2.client.provider.okta.issuer-uri URL for the Okta server OAuth2 base URL (configured as part of an Authorization Server)
spring.security.oauth2.client.provider.okta.authorization-uri URL for the Okta server authorization
spring.security.oauth2.client.provider.okta.token-uri URL for the Okta server token request
spring.security.oauth2.client.provider.okta.callback-uri URL for Foretify Manager's callback API (see "Sign-in redirect URIs" above)

For example:

application.properties file example
spring.security.oauth2.client.registration.okta.client-id=0011223344aabbcc
spring.security.oauth2.client.provider.okta.issuer-uri=https://dev-12345678.okta.com/oauth2/default
spring.security.oauth2.client.provider.okta.authorization-uri=https://dev-12345678.okta.com/oauth2/default/v1/authorize
spring.security.oauth2.client.provider.okta.token-uri=https://dev-12345678.okta.com/oauth2/default/v1/token
spring.security.oauth2.client.provider.okta.callback-uri=http://localhost:8080/login/callback

230.3 Using Python SDK in Remote SSH Environments

For remote SSH sessions, browser-based authentication does not work because the callback server runs on the remote machine, while the browser opens on the local machine.

The recommended approach is to use access token authentication, which avoids the need for SSH port forwarding and works reliably in all remote scenarios.

  1. Generate an access token on a machine with browser access or via the Foretify Manager web UI.
  2. Use the generated token to authenticate in your remote SSH session:
import ftx.shell.client as client
client.login(host='fmanager.example.com', access_token='your-generated-token')