How to Configure SSO with Okta for Activaire Curator

This guide walks Okta administrators through enabling Single Sign-On (SSO) to Activaire Curator (curator.activaire.com) using OpenID Connect (OIDC).

Prerequisites

• An Okta administrator account for your organization's Okta org.

• An active Activaire Curator subscription. If you're not yet a customer, contact us.

Supported features

• SP-initiated SSO (sign-in starting from Activaire Curator)

• IdP-initiated SSO (through Third-party Initiated Login — launching Curator from your Okta End-User Dashboard)

• Just-In-Time provisioning (a Curator account is created automatically on first sign-in)

For more information on the listed features, visit the Okta Glossary.

How sign-in works

Curator uses the OpenID Connect authorization code flow. The token exchange happens on Curator's servers using your app's client secret — your users' credentials and the client secret never pass through the browser, and Curator never sees your Okta password. When a user opens the sign-in link or clicks the Okta tile, they authenticate at Okta, Okta returns a one-time code, and Curator's server exchanges that code (server-to-server) to complete the sign-in.

Configuration steps

1. In your Okta Admin Console, go to Applications > Applications, click Browse App Catalog, search for Activaire Curator, and click Add integration.

2. Assign the application to the users and/or groups who should have access to Curator (Assignments tab).

3. Open the app's Sign On tab and copy the Client ID and Client secret.

4. Sign in to Activaire Curator (https://curator.activaire.com) as an organization admin, go to Profile > Account, and find the Single Sign-On with Okta section. Click Set up Okta SSO and enter:

   • Your Okta org URL (for example https://yourcompany.okta.com)

   • The Client ID and Client secret from step 3

5. Click Save. SSO is active immediately — the page shows your organization's sign-in link:

   https://curator.activaire.com/login/okta-initiate?iss=https://yourcompany.okta.com

If you prefer, or if no one on your team has admin access to Curator yet, you can instead email the same three values to our support team, from your company email and we'll activate SSO for you (typically within one business day).

Signing in

IdP-initiated SSO (from Okta)

1. Sign in to your Okta End-User Dashboard.

2. Click the Activaire Curator tile.

3. You are signed in to Curator automatically.

SP-initiated SSO (from Curator)

1. From your browser, open your organization's sign-in link. This link is shown on the Single Sign-On with Okta card in Curator right after you save your configuration, and you can copy it from there at any time. You can bookmark it or add it to your intranet.

2. If you aren't already signed in to Okta, you're redirected to your Okta sign-in page. Enter your Okta credentials.

3. You are redirected back to Activaire Curator, signed in.

Notes

• New users signing in for the first time get a Curator account automatically (Just-In-Time provisioning), linked to your organization and with standard user access — assigning someone to the app in Okta is all it takes. To change a user's access level (for example, to make them an admin), contact Activaire Support

• Removing a user's app assignment in Okta prevents future sign-ins; to also deactivate their existing Curator access automatically, enable SCIM provisioning (see the SCIM configuration guide).

• Signing out of Curator does not sign you out of Okta.

• Activaire Curator never sees or stores your Okta password.

Troubleshooting

• "Your OKTA org is not supported" error: your organization's Okta configuration hasn't been activated on the Activaire side yet, or the Okta org URL doesn't match the one you provided.

• The Curator tile doesn't appear on the Okta dashboard: verify the app is assigned to your user or group in the app's Assignments tab.

• For any other issue, contact us and include your Okta org URL and a screenshot of the error.