Setting up Okta

RoundUp Early Childhood supports Okta for staff single sign-on, and for provisioning staff accounts through SCIM. Both are optional, and a center can use sign-on alone. This guide is for the Okta administrator at a center that already uses RoundUp.

Every center connects its own Okta org — RoundUp never holds a shared identity provider on your behalf, and the credentials you create below stay scoped to your center.

1. Before you start

You need two things:

• An Okta administrator account in your organization's Okta org.
• A RoundUp director account. Open the RoundUp app and go to Marketplace → Okta — every value this guide tells you to copy comes from that screen, and every value it tells you to paste goes into it.

Read the values from that screen rather than from this page: they are generated for your center, and the URLs can change as our infrastructure moves. The screen shows each one with a tap-to-copy button.

2. Single sign-on (OIDC)

When this is finished, your staff sign in to RoundUp from their Okta dashboard, or by choosing "Sign in with Okta" on the RoundUp sign-in screen. They never set a RoundUp password.

Step 1 — Create the app integration in Okta

In the Okta Admin Console, either install RoundUp ECE from the Okta Integration Network, or create a new OIDC — Web Application integration. Set the grant type to Authorization Code.

If Okta asks for a Center ID during installation, paste the Center ID shown on the RoundUp Okta screen. That value is how Okta tells us which center a sign-in belongs to.

Step 2 — Paste RoundUp's URLs into Okta

• Sign-in redirect URI — copy it from the RoundUp Okta screen.
• Initiate login URI — copy it from the same screen. It carries your Center ID, so use the one shown to you rather than one from another center.
• Sign-out redirect URI — leave empty. RoundUp does not use Okta-initiated sign-out.
• Scopes — openid, profile, email. RoundUp reads only the signed-in person's name and email address.

Step 3 — Paste Okta's details into RoundUp

Back on the RoundUp Okta screen, enter:

• Okta org URL — your org's issuer, for example https://example.okta.com. If your org uses a custom sign-in domain, use that domain instead. It must be the issuer your org actually asserts; see Troubleshooting if sign-in is refused.
• Client ID and Client secret — from the app integration you created in step 1. The secret is stored encrypted and is never shown again.

Save, then use Test Okta sign-in on that screen to confirm the round trip works.

Step 4 — Assign your staff in Okta

Assign the app to the staff who should have access. Sign-on alone does not create RoundUp accounts: a staff member can only sign in if they already have an active, invited account at your center. Assigning someone in Okta who has no RoundUp account will not let them in — invite them in RoundUp first, or set up provisioning below so Okta creates the account for you.

3. Single sign-on with SAML instead

Most organizations should skip this section. The OIDC setup above already signs your staff in. Use SAML only if your organization standardizes on it — you do not need both, and configuring both does not add anything.

Step 1 — Create a SAML app integration in Okta

Enter these two values, which the RoundUp Okta screen shows with a tap-to-copy button:

• Single sign-on URL (Okta may call this the Assertion Consumer Service URL).
• Audience URI (the SP entity ID).

Set the Name ID format to EmailAddress and the application username to the staff member's email address. Assertions must be signed — we reject an unsigned assertion rather than trusting it.

Step 2 — Give RoundUp your signing certificate

Okta shows an X.509 signing certificate for the app. Copy it and paste it into the SAML card on the RoundUp Okta screen, then save. Until that certificate is saved, SAML sign-in stays off and nothing changes for your staff.

You can paste it with or without the -----BEGIN CERTIFICATE----- lines. If the paste was truncated, saving tells you straight away instead of failing later during a sign-in.

Step 3 — Assign staff and test

Assign the app in Okta as you would for OIDC. The same rule applies: sign-on does not create accounts, so a staff member needs an active RoundUp account at your center — invite them, or set up provisioning below.

4. Provisioning (SCIM 2.0)

Provisioning lets Okta create a staff account when someone joins, keep their name in step, and deactivate their access the day they leave. It is optional and independent of sign-on.

Step 1 — Get your provisioning credentials

On the RoundUp Okta screen, open the Provision staff from Okta card. It shows a SCIM connector base URL and an authorization token, both specific to your center.

Step 2 — Configure provisioning in Okta

In your app integration, turn on provisioning and enter:

• SCIM connector base URL — as shown on the RoundUp screen.
• Unique identifier field for users — userName (the staff member's email address).
• Supported provisioning actions — Push New Users, Push Profile Updates, and Deactivate Users.
• Authentication mode — HTTP Header (or Bearer). Paste the authorization token from the RoundUp screen.

Test the connector configuration in Okta before saving. RoundUp manages users only — there are no groups to push.

What provisioning does, and does not, do

• New accounts arrive as teachers. Director and administrator roles are only ever granted from inside RoundUp, so an Okta administrator cannot grant elevated access to your center through the connector.
• Deactivating removes access, not history. Unassigning or deactivating a user removes their access to your center and signs out their active sessions. The record of what they did — attendance they took, notes they wrote — is retained for your licensing and compliance obligations.
• Your center's owner cannot be deprovisioned through Okta, so a misconfigured rule cannot lock your center out of its own account.
• Only your center is affected. The token identifies your center, and cannot read or change another center's staff.

5. Choosing the role staff arrive with

By default a provisioned staff member arrives as a teacher. If you would rather decide per person or per group, RoundUp publishes its assignable roles to Okta as entitlements, and you can grant one when you assign someone:

• Lead teacher — runs a classroom: attendance, daily reports, and family updates for their room.
• Teacher — classroom staff, with the same day-to-day tools. The default.
• Assistant teacher — supports a classroom with a narrower set of permissions.

Director and administrator are deliberately not on this list. Those roles are granted inside RoundUp by someone who already administers your center, so no identity provider — and no one who gains access to your Okta org — can grant administrative access to your center's records through provisioning. If you need to promote someone, do it in the app.

6. Ending someone's sessions

RoundUp supports Okta's Universal Logout. If a device is lost or an account is suspected compromised, ending the person's session from Okta signs them out of RoundUp too, without waiting for their session to expire.

This ends sessions only. It does not remove the person from your center — they can sign in again afterwards. To remove someone, unassign or deactivate them in Okta with provisioning set up, or remove them in RoundUp.

7. Troubleshooting

"This sign-in came from a different Okta org than the one connected to your center."

The org URL saved in RoundUp does not match the issuer your Okta org actually asserts. This is most common when the org uses a custom sign-in domain: the org may assert https://login.example.com while https://example.okta.com was saved, or the reverse. Open https://<your-org-domain>/.well-known/openid-configuration and use the exact value of its issuer field. This message means the two values differ; it does not mean anything is compromised.

"This center hasn't finished connecting Okta yet."

The org URL, client ID, or client secret is missing in RoundUp. Re-enter all three on the Okta screen — the secret must be re-entered if it was never saved.

A staff member is assigned in Okta but cannot sign in

They have no active RoundUp account at your center. Either invite them in RoundUp, or set up provisioning so Okta creates the account. Sign-on deliberately refuses to create accounts on its own.

"This Okta integration works with RoundUp ECE childcare centers."

The sign-in link is pointing at a center that is not a RoundUp center, or the Center ID in the link is wrong. Re-copy the initiate login URI from your center's Okta screen.

"The Okta SAML assertion could not be verified."

Usually the signing certificate: either it was never saved in RoundUp, or Okta has since rotated it and RoundUp still holds the old one. Copy the current certificate from your Okta app and paste it in again. It can also mean the assertion was unsigned — RoundUp requires signed assertions and will not accept an unsigned one.

"This center hasn't finished connecting Okta SAML yet."

No signing certificate has been saved. Paste it into the SAML card on the RoundUp Okta screen.

8. Support

• Email: support@roundupece.com
• Phone: +1 (458) 273-4336
• Hours: normal business hours, Pacific Time.

For help with a connection that will not complete, include your center name and the exact message shown on screen.