Action needed: Starting July 20, 2026, analyses running with a Java runtime lower than 21 are no longer supported.
Read the scanner requirements page for more details.
Ctrlk
Start FreeLogin
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Using Okta Express Configuration

With the Okta Express Configuration, you can set up OpenID Connect (OIDC) Single Sign-On (SSO) in your SonarQube Cloud enterprise with just a few clicks.

This feature requires the SonarQube Cloud's Enterprise licence.

You must be an admin of your SonarQube Cloud enterprise and Okta administrator within your Okta tenant.

Supported OIDC features

With the Okta Express Configuration, you benefit from:

  • SP-initiated SSO

  • IdP-initiated SSO (through Okta dashboard)

  • Just-In-Time provisioning

The Universal Logout is not supported by the SonarQube Cloud app in Okta. However, SonarQube Cloud will disconnect your session as follows:

  • The session closes after 24 hours, if the user is active.

  • The session closes after 8 hours, if the user is idle.

SCIM provisioning is set up through an additional condiguration step using SonarQube Cloud assistant.

Step 1: Add the SonarQube Cloud integration in Okta

  1. In the Okta Admin Console, go to Applications > Applications.

  2. Select Browse App Catalog.

  3. Search for SonarQube and select SonarQube Cloud.

  4. Select Add Integration.

  5. On the General Settings page, enter a label for the integration, for example, SonarQube Cloud.

  6. Select Done.

Step 2: Configure SSO and Universal Logout

  1. In Okta, go to the Sign On tab of your SonarQube Cloud integration and select Express Configure SSO & UL.

Select the Express Configuration button.

You are prompted for your Sonar Express Configuration ID.

Enter the organization identifier used for Express Configuration.

  1. Enter your Sonar Express Configuration ID, in the following format org-<enterprise-uuid> . You can retrieve the ID from SonarQube Cloud:

    1. In SonarQube Cloud, retrieve your enterprise.

    2. Go to Administration > SSO & Provisioning. The SSO & Provisioning page opens.

    3. Expand the Single sign-on & Domain configuration section and select Okta Express Configuration.

    4. Copy the Sonar Express Configuration ID and paste it into the Sonar Express Configuration ID window. Select Continue.

Select the Okta Express Configuration button and then the Copy tool in front of the Sonar Express Configuration ID field.

  1. SonarQube Cloud authentication page opens with options to login. Make sure you login using the DevOps platform that is linked to your SonarQube Cloud enterprise admin account.

  2. Authorize the app as a SonarQube Cloud enterprise administrator. This creates a SSO connection in your SonarQube Cloud enterprise.

Select the Accept button.

  1. Review the permissions requested and select Accept to authorize the connection. Once authorization is complete, you are redirected back to Okta. The SSO and Universal Logout configuration is applied automatically. See the Using Okta Express Configuration section for more information.

Step 3: Add the groups attribute mapping

Regardless of your chosen provisioning method, you must configure the groups attribute in the OIDC payload. If you use SCIM provisioning, ensuring this value aligns with the data SCIM transmits to SonarQube Cloud is essential. See Group setup is mandatory for more details.

Proceed as follows:

  1. In Okta, go to the Sign On tab of your SonarQube Cloud integration.

  2. In Settings > Sign on methods, select the link Configure profile mapping.

Select the Configure profile mapping link.

  1. Close the dialog to open the Profile Editor page.

  2. Select the Add Attribute button. The Add Attribute dialog opens.

  3. In the dialog, set the following parameters:

    • Data type: Select string array

    • Display name: Enter Groups

    • Variable name: Enter userGroups

    • Enum: not selected

    • Attribute required: Select Yes

    • Attribute type: Select Group

    • Group Priority: Select Use Group Priority

  4. Select Save. The group's attribute is added.

  5. Select the Mappings button. The User Profile Mappings dialog opens.

  6. Select the tab Okta User to <SonarQube Cloud integration>.

  7. Enter the following expression:

With this expression, all your groups in Okta will be included (and available during Just-in-Time provisioning login for automatic group synchronization). You can adjust this expression if necessary.

  1. To preview the attribute for your application enter the Okta user name in the preview textbox. The preview shows groups that the user belongs to in Okta.

Enter a user to the preview.

  1. Click Exit Preview.

  2. Select Save Mappings and then Apply updates.

Step 4: Assign users and groups

  1. In Okta, go to the Assignments tab of your SonarQube Cloud integration.

  2. Select Assign > Assign to People or Assign to Groups.

  3. Select the users or groups you want to give access to SonarQube Cloud and select Assign.

  4. Select Done.

Step 5: Verify the setup

Verify Okta dashboard SSO

  1. As the assigned test user, sign into the Okta dashboard.

  2. Select the SonarQube Cloud app tile. The name of the app is what you have configured for its label in Using Okta Express Configuration.

  3. Verify that you are signed in to SonarQube Cloud without being prompted for additional credentials.

Verify SSO through SonarQube Cloud's login page

  1. Navigate to your SonarQube Cloud login page.

  2. Select the SSO option.

  3. Enter the enterprise key.

  4. Verify that you are redirected to Okta for authentication and then signed into SonarQube Cloud.

Next steps

To set up SCIM, go to Set up SCIM.

To terminate your SSO setup, go to Invite users to sign in .

It's recommended to verify your company's email domain to avoid one-time email verification during SSO login. See Domain verification

Related pages

Related online learning

PreviousSSO restrictionsNextEditing or deleting SSO configuration

Last updated

Was this helpful?