Single sign-on

amahub signs people in through any OIDC provider; Okta is the reference setup. Configuration is per organization, in the admin panel.

Configure the org

Admin → Members → Single sign-on: set the issuer (for Okta, https://<tenant>.okta.com), client ID / secret, a button label, and — optionally — the groups claim with Sync groups from IdP switched on. Test connection validates OIDC discovery before anyone signs in.

Set up the Okta app

1. Applications → Create App Integration → OIDC — Web Application.
2. Sign-in redirect URI: https://<your-api>/auth/oidc/callback (shown copy-ready in the admin card).
3. To pass groups: Sign On → OpenID Connect ID Token → Groups claim filter (e.g. Matches regex .*).

Group sync

With sync on, every SSO login reconciles the person’s groups:

• IdP groups are matched to amahub groups by name (case-insensitive); missing ones are created and marked from IdP.
• Membership of IdP-sourced groups follows the IdP exactly on each login.
• Manually created groups are never touched — a login can’t erase access an admin granted by hand.

IdP groups then drive everything groups already drive: catalog visibility, custom-connector grants, skill shares.