Connect Okta through Okta Integration Network - Barndoor Documentation

Overview

The Barndoor OIN app provides the easiest setup experience with built-in SCIM provisioning for automated user lifecycle management. This method offers:

• Pre-configured OIDC settings
• Automated user provisioning and deprovisioning
• Automated group provisioning and group membership synchronization
• Official Okta Verified integration path

Supported features

The Barndoor OIN integration supports the following Okta features.

OIDC

• SP-initiated SSO — Single Sign-On initiated from Barndoor
• IdP-initiated SSO — Single Sign-On initiated from the Okta dashboard (through Third-Party Initiated Login)
• Just-In-Time provisioning — Accounts are created and updated in Barndoor at first sign-in

SCIM provisioning

• Create users — Provision new users to Barndoor
• Update user attributes — Sync user attribute changes from Okta to Barndoor
• Deactivate users — Deprovision users in Barndoor when they are unassigned or deactivated in Okta
• Group Push — Push Okta groups and their memberships to Barndoor

Prerequisites:

• Admin access to your Barndoor account
• Admin access to your Okta org
• SCIM token from Barndoor (generated during setup)

For manual configuration with full control, see Connect Okta with custom application registration.

Step 1: Add Barndoor from OIN

1. Navigate to Okta Applications In the Okta Admin Console, go to Applications → Applications.

2. Browse App Catalog Click Browse App Catalog and search for “Barndoor.ai”.

3. Add Integration Click on the Barndoor app and then click Add Integration.

4. Configure Application Settings Add your Application Label and Organization alias. This can be found in the platform on your user profile information.
   In the example below, oin-app-testing is the organization alias.

Step 2: Configure SSO Settings

1. Open SSO Configuration In your newly added Barndoor app, go to the Sign On tab.

2. Note OIDC Settings The OIN app comes pre-configured with:

   • Client ID (auto-generated)
   • Client Secret (auto-generated)
   • Issuer URL (your Okta domain)

You’ll need these values to configure the IDP connection within Barndoor. Copy the Issuer URL along with the Client ID and Client Secret to the Identity Provider section within Barndoor and then save the connection details.
Your OIDC metadata can be found at https://<your-okta-subdomain>.okta.com/.well-known/openid-configuration

Step 3: Configure SCIM Provisioning

1. Enable SCIM Provisioning Go to the Provisioning tab and click Integration in the sidebar.

2. Enable API Integration Check Enable API integration and enter:

   • API Token: Generate this from Barndoor Settings → SCIM Provisioning -> API Token

3. Test Connection Click Test API Credentials to verify the connection.✅ Expected result: “API credentials verified successfully”

4. Enable User Provisioning to App Go to the Provisioning tab and click To App in the sidebar.

   • Enable the lifecycle settings you would wish to synchronize to Barndoor. It is recommended to enable all operations.

Step 4: Assign Users and Groups

1. Go to Assignments Navigate to the Assignments tab in your Barndoor app.

2. Assign Users Click Assign and choose either:

   • Assign to People: Select individual users
   • Assign to Groups: Select entire Okta groups (recommended)

3. Configure User Attributes Review and confirm the attribute mappings for each assigned user.

4. Save Assignments Click Save and Go Back to complete assignments. Users will be automatically provisioned in Barndoor within a few minutes.

5. Assign Groups Navigate to the Push Groups tab in your Barndoor app.

   • Click Push Groups and search for groups by name or rule.
   • Search for the group you would like to sync and click ‘Save’ or ‘Save and Add Another’.
   • Continue adding all groups you would like to synchronize with Barndoor.

   All groups added to ‘Push Groups’ will synchronize with Barndoor but group membership will only synchronize to users that have been assigned to the application.

Map admin access (optional)

SCIM group push keeps users and group membership in sync in Barndoor. To auto-assign the Admin role from an Okta group at login, use the Map groups to roles card on the Identity Provider page—the Admin Role Group Name must match the group you push in Step 4 exactly. See Connect your IdP — Step 3: Configure Role Mapping for the full flow, including the OIDC groups claim if your OIN app does not already emit group names at sign-in.

Testing the Integration

Verify SSO Connection

1. Confirm SSO sign-in works Sign out of Barndoor and sign in with an Okta-assigned test user. You should reach Barndoor after Okta authentication.

2. Run the enforcement preflight (recommended) Before enforcing organization-wide SSO, run Test SSO sign-in from Roll out SSO enforcement below. Barndoor requires that pop-up test—not just a manual login—before Enforce SSO is enabled.

Verify SCIM Provisioning

1. Assign Users In Okta, assign user(s) to the Barndoor application by either individual users or groups.

2. Verify user provisioned in Barndoor In Barndoor, go to Users and verify the user appears.

3. Push Groups In Okta, assign group(s) to the Barndoor application by pushing groups by name or rule.

   • Push groups for users that are already assigned to the application.
   • In Okta, verify groups pushed have transitioned from ‘Pushing’ to ‘Activated’

4. Verify user groups provisioned in Barndoor In Barndoor, go to Users and verify the users previously provisioned now show their pushed group memberships.

Roll out SSO enforcement

After your IdP connection is saved and SSO sign-in works, the Roll out SSO enforcement section on the Identity Provider page lets you require SSO for every member of your organization. Until you enforce SSO, users can still sign in with Barndoor passwords in addition to your IdP.

If you don’t see Roll out SSO enforcement controls on the Identity Provider page, organization-wide SSO enforcement may not be enabled for your workspace yet. Contact your Barndoor account team.

Enforcing SSO is irreversible in production. It permanently clears Barndoor passwords for all members, terminates every active session (including yours), and requires all future logins through your IdP—except the dedicated break-glass account described below.

What changes when you enforce SSO

When you confirm enforcement, Barndoor:

• Requires all organization members to sign in through your IdP
• Permanently clears saved Barndoor passwords for every member
• Leaves password sign-in enabled only for the break-glass admin email you configure
• Terminates all active sessions, including the administrator who enabled enforcement

After enforcement succeeds, sign out and sign back in through your IdP to continue working as an administrator.

Prerequisites

Both items in Before you can enforce SSO must be complete before Enforce SSO is enabled:

1. Test SSO sign-in Click Test SSO sign-in. Barndoor opens a pop-up window and runs the full IdP login path—not just a connection preflight. Complete authentication in the pop-up. When the test succeeds, the row is marked complete. You can run the test again anytime to confirm sign-in still works.

If the pop-up is blocked, allow pop-ups for the Barndoor site and run the test again.

2. Configure break-glass admin email Click Manage on the Break-glass admin email row and set an emergency mailbox your security or platform team can use if your IdP is unavailable.
   • The address must use your organization’s IdP email domain (shown as @your-domain in the dialog)
   • It must not already belong to an existing Barndoor user
   • You cannot use your own administrator email as the break-glass account

Click Save. Barndoor stores the address as the configured break-glass email. The dedicated break-glass user account is created when you enforce SSO.

Enable organization-wide SSO

1. Review the rollout card When both prerequisites are complete, click Enforce SSO at the bottom of the rollout card.

2. Acknowledge each consequence In the confirmation dialog, check every acknowledgement:

   • Future logins will be exclusively via IdP SSO
   • All Barndoor passwords will be permanently cleared
   • Only your break-glass email will be able to sign in via password going forward
   • All active sessions—including your current one—will be terminated

The dialog also shows your IdP connection name and redirect URI for a final sanity check.

3. Confirm enforcement Click Confirm Enforcement. On success, Barndoor shows SSO enforcement is active and prompts you to Sign out and sign in with SSO.

If enforcement succeeds but Barndoor shows a warning that not all member passwords were cleared or sessions could not be terminated, SSO enforcement is still active. Sign out and sign in again with SSO, verify member access, and contact support if the warning persists.

SSO enforcement is active. All organization members must sign in through your Identity Provider. Password login is disabled for everyone except the break-glass account.

Set up the break-glass account

When enforcement completes, Barndoor provisions a dedicated Barndoor Break Glass administrator account at the email you configured and sends a setup email to that mailbox. The recipient must:

1. Open the setup email and follow the link to set a password
2. At first sign-in, complete the email one-time passcode (OTP) sent to that mailbox—the same second factor used during an IdP outage

Store break-glass credentials in your organization’s secure emergency-access process (for example, a sealed envelope or privileged-access vault)—not in shared chat or email threads.

Manage break-glass access after enforcement

After SSO is enforced, the rollout card shows SSO enforcement as active and lets you manage the break-glass email:

• Resend invite — If the break-glass account has not finished password setup, resend the setup email from the break-glass dialog
• Change break-glass email — Opens a destructive change flow. Enter the new address, check the acknowledgement that the current account will lose password sign-in, then click Save. The new mailbox must complete password and OTP setup before it can be used

Changing the break-glass email while SSO is enforced removes the previous break-glass account’s password credentials and requires the new mailbox to complete setup from scratch.

Sign in with break-glass during an IdP outage

If your IdP is unavailable and you need emergency administrator access:

1. On the Barndoor sign-in page, choose password sign-in (not SSO)
2. Enter the break-glass email address and password
3. Complete the email one-time passcode sent to that mailbox

Password sign-in and email OTP at login are available only for the break-glass account once SSO is enforced. All other members must use IdP SSO.

Remove the SSO connection (optional)

To disconnect IdP integration before or after enforcement, open the actions menu (⋯) on the rollout card and choose Remove SSO. Confirm when prompted.

Removing the SSO connection immediately revokes IdP-based access for your organization. Only users who can still authenticate with a Barndoor password—including the break-glass account, if configured—can sign in. SSO enforcement remains on for the organization; re-connecting an IdP does not restore member password login.

SSO enforcement troubleshooting

Test SSO sign-in pop-up blocked or closes early

Common causes:

• Browser blocked pop-ups for the Barndoor site
• The sign-in window was closed before authentication finished

Solution: Allow pop-ups for your Barndoor portal origin, then click Test SSO sign-in again. If the test times out, cancel and retry.

Break-glass email rejected on Save

Common causes:

• Address is outside your organization’s IdP email domain
• Address already belongs to an existing Barndoor user
• You entered your own administrator email

Solution: Use a dedicated emergency mailbox on your IdP domain that is not yet a Barndoor user. Enter only the part before @—the domain is shown in the dialog.

Break-glass setup email not received

Solution: From the break-glass Manage dialog after enforcement, click Resend invite. Check spam filters and confirm the mailbox is monitored. The recipient must complete password setup from the link before the account can sign in.

Enforcement succeeded with a warning

Cause: SSO enforcement is active, but Barndoor could not clear every member password or terminate every session. Solution: Sign out and sign back in with SSO. Verify affected members can still reach the app through your IdP. Contact Barndoor support if the warning remains or members report unexpected password login.

Troubleshooting

SSO Login Fails

Common causes:

• Incorrect Client ID or Secret
• Incorrect organization alias
• User is not assigned to application

Solution:

• Verify OIDC credentials in both systems
• Confirm organization alias is correct
• Check user logging in is assigned to the Barndoor application

SCIM Connection Fails

Common causes:

• Invalid or expired SCIM token

Solution:

• Generate a new SCIM token in Barndoor

Users Not Provisioning

Common causes:

• Provisioning not enabled in Okta
• Users not assigned to the application
• Attribute mapping conflicts

Solution:

• Verify “Create Users” is enabled in Provisioning settings
• Check user assignments in the Assignments tab
• Review attribute mappings for required fields

Groups Not Syncing

Common causes:

• Group push not configured
• Group already exists with different ID

Solution:

• Enable “Push Groups” in Provisioning settings
• Deactivate the group and re-add it to trigger reprovisioning

Best Practices

Use Groups for Assignment

Assign Okta groups rather than individual users for easier management.

Test Before Production

Always test with a small group before rolling out to all users.

Monitor Provisioning Logs

Regularly check Okta’s provisioning logs for any sync issues.

Secure SCIM Tokens

Rotate SCIM tokens periodically and store them securely.

Summary

You’ve successfully configured the Okta integration with Barndoor using the Okta Integration Network!
This enables SSO and SCIM provisioning for your organization.

Centralized authentication - Users sign in with their Okta credentials
Automated user lifecycle management - Users are managed automatically
Real-time group synchronization - Membership changes take effect immediately
Reduced manual work - No need to manually provision users in Barndoor
(Optional) Admin role mapping and organization-wide SSO enforcement - See sections above