Single sign-on with Okta

Parzify signs people in through Okta with OpenID Connect (OIDC). Once connected, everyone assigned to the Parzify app in Okta can open the org chart from their Okta dashboard or from app.parzify.com, with no separate password. Setup takes about ten minutes.

Provisioning (who appears on the chart, and who reports to whom) is a separate guide: Provisioning with Okta.

Prerequisites

• A Parzify company account with an admin who can sign in at app.parzify.com. New companies start at app.parzify.com/signup.
• An Okta account with permission to add and configure app integrations (Super Administrator or Application Administrator).
• Your Okta domain, for example acme.okta.com. It is the address you use to reach Okta, without -admin.

Supported features

• SP-initiated SSO: people start at app.parzify.com, enter their work email and are sent to Okta.
• IdP-initiated SSO: people click the Parzify tile on their Okta End-User Dashboard.
• Just-in-time account creation is optional and off by default. We recommend leaving it off and letting provisioning create accounts, because provisioning also carries the manager, title and department the chart is drawn from.

Not supported: SAML and single logout. Signing out of Parzify ends the Parzify session only.

Configuration steps

1. Add Parzify in Okta

1. In the Okta Admin Console go to Applications › Applications and click Browse App Catalog.
2. Search for Parzify, open it and click Add Integration.
3. Keep the application label Parzify (or rename it) and click Done.

2. Copy the client credentials

1. Open the new app's Sign On tab.
2. Copy the Client ID and the Client secret. You need both in the next step.

3. Enter them in Parzify

1. Sign in to Parzify as an admin and open Admin › Identity › Single sign-on.
2. Enter your Okta domain (for example acme.okta.com), the Client ID and the Client secret, and save.
3. Turn on Enable single sign-on. Parzify checks that it can reach your Okta org before it turns on.

4. Assign people

1. Back in Okta, open the Parzify app's Assignments tab and click Assign › Assign to Groups (or Assign to People).
2. Assign a group that holds everyone who should be able to open the org chart. Assigning the same group in the provisioning app keeps sign-in and the chart in step.

5. Test

1. In Parzify, on Admin › Identity › Single sign-on, click Test sign-in with Okta. You bounce through Okta and land back in Parzify.
2. Then try the tile: open the Okta End-User Dashboard as an assigned user and click Parzify.

SP-initiated SSO

Go to app.parzify.com/login, enter your work email and click Continue with single sign-on. Parzify finds your company from the email domain and sends you to Okta. Admins can also sign in with a password and an authenticator app, which keeps an admin door open if Okta is ever unavailable.

Troubleshooting

• "Sign-in with your identity provider failed" right after Okta: the Client ID or Client secret in Parzify does not match the app in Okta. Re-copy both from the app's Sign On tab.
• Okta shows a 400 or "user is not assigned": the person is not assigned to the Parzify app. Check the Assignments tab.
• "Your account has not been assigned to Parzify yet": sign-in worked, but no Parzify account matches the Okta username or email. Assign the person in the provisioning app, or enable just-in-time creation.
• "Single sign-on is not enabled for your company yet": the toggle on Admin › Identity › Single sign-on is off, or the connection test failed when turning it on. Check the Okta domain.
• Every sign-in attempt is recorded under Admin › Audit log.

Still stuck? Email hello@parzify.com with your company name and the error text.