Ensure that you have an admin role in Okta.

Access your Okta domain (e.g., https://trial-5760180.okta.com/).

Navigate to the Admin Panel.

Expand the side panel and select Applications.

Click on the Child Applications link.

Choose Create App Integration.
​

Select "OIDC - OpenID Connect" as the integration type.

Choose "Web Application" and click Next.
​

Provide "Privado" as the Application Name.
​

In the Grant type section, check the refresh token field along with the default checked Authorization code.
​

Enter https://privado.auth.eu-west-1.amazoncognito.com/oauth2/idpresponse in the Sign-in redirect URIs input.

Enter https://code.privado.ai/login in the Sign-out redirect URIs input.
​

Scroll to the bottom and select Allow everyone in your organization to access in the Controlled access field. Enable immediate access with Federation Broker Mode will be selected by default.

Click on save.
​

Copy the Client ID and Client Secret from the General Tab of the newly created application.

Go to the Sign On tab.
​

Edit the OpenID Connect ID Token section and change the "Issuer" from dynamic to your Okta domain. Save the details.
​

Copy the URL from the issuer field (e.g., https://trial-5760180.okta.com).

Navigate to the Okta API Scopes tab.
​

Search for okta.myAccount.profile.read in the list and click on grant.
​

Change the filter on the left section to "Granter" and select okta.myAccount.profile.read.
​

Create Groups for Privado and assign those groups to your employees

Go to the application created above to allow groups via token

Go to Sign On tab and edit “OpenID Connect ID Token” Section

Add a groups claim filter with the condition that groups start with 'Privado.' This ensures that we only retrieve groups relevant to 'Privado' and exclude any internal roles. (We are assuming you are creating step 1 with Privado prefix otherwise this logic needs to be tweaked accordingly)

Click on Save

Login to the Privado dashboard, navigate to settings and roles here.