Setting up Okta

RoundUp Early Childhood supports Okta for staff single sign-on. It also accepts SCIM provisioning from Okta, which creates and removes RoundUp staff accounts — see section 4. This guide is for the Okta administrator at a center that already uses RoundUp.

Every center connects its own Okta org — RoundUp never holds a shared identity provider on your behalf, and the credentials you create below stay scoped to your center.

1. Before you start

You need two things:

• An Okta administrator account in your organization's Okta org.
• A RoundUp director account. Open the RoundUp app and go to Marketplace → Okta — every value this guide tells you to copy comes from that screen, and every value it tells you to paste goes into it.

Read the values from that screen rather than from this page: they are generated for your center, and the URLs can change as our infrastructure moves. The screen shows each one with a tap-to-copy button.

2. Single sign-on (OIDC)

When this is finished, your staff sign in to RoundUp from their Okta dashboard, or by choosing "Sign in with Okta" on the RoundUp sign-in screen. Once Okta is connected, RoundUp refuses a password for every staff account at your center, directors included; families are unaffected. If a change on the Okta side ever stops everyone signing in, email support@roundupece.com.

Step 1 — Create the app integration in Okta

In the Okta Admin Console, either install RoundUp ECE from the Okta Integration Network, or create a new OIDC — Web Application integration. Set the grant type to Authorization Code.

If Okta asks for a Center ID during installation, paste the Center ID shown on the RoundUp Okta screen. That value is how Okta tells us which center a sign-in belongs to.

Step 2 — Paste RoundUp's URLs into Okta

• Sign-in redirect URI — copy it from the RoundUp Okta screen.
• Initiate login URI — copy it from the same screen. It carries your Center ID, so use the one shown to you rather than one from another center.
• Sign-out redirect URI — leave empty. RoundUp does not use Okta-initiated sign-out.
• Scopes — openid, profile, email. RoundUp reads only the signed-in person's name and email address.

Step 3 — Paste Okta's details into RoundUp

Back on the RoundUp Okta screen, enter:

• Okta org URL — your org's issuer, for example https://example.okta.com. If your org uses a custom sign-in domain, use that domain instead. It must be the issuer your org actually asserts; see Troubleshooting if sign-in is refused.
• Client ID and Client secret — from the app integration you created in step 1. The secret is stored encrypted and is never shown again.

Save, then use Test Okta sign-in on that screen to confirm the round trip works.

Step 4 — Assign your staff in Okta

Assign the app to the staff who should have access. Sign-on alone does not create RoundUp accounts: a staff member can only sign in if they already have an active, invited account at your center. Assigning someone in Okta who has no RoundUp account will not let them in — invite them in RoundUp first, or turn on provisioning (below) so that assigning them creates the account. An invited staff member does not need to open the invite email first: their first Okta sign-in activates the account.

3. Single sign-on with SAML instead

Most organizations should skip this section. The OIDC setup above already signs your staff in. Use SAML only if your organization standardizes on it. RoundUp saves a SAML certificate only alongside the OIDC details from section 2, so complete that section first; beyond that, configuring both does not add anything.

Step 1 — Create a SAML app integration in Okta

Enter these two values, which the RoundUp Okta screen shows with a tap-to-copy button:

• Single sign-on URL (Okta may call this the Assertion Consumer Service URL).
• Audience URI (the SP entity ID).

Set the Name ID format to EmailAddress and the application username to the staff member's email address. Assertions must be signed — we reject an unsigned assertion rather than trusting it.

Step 2 — Give RoundUp your signing certificate

Okta shows an X.509 signing certificate for the app. Copy it and paste it into the SAML card on the RoundUp Okta screen, then save. Until that certificate is saved, SAML sign-in stays off and nothing changes for your staff.

You can paste it with or without the -----BEGIN CERTIFICATE----- lines. A truncated paste is not reported as an error: it is discarded, and it clears any certificate saved before. After saving, the note under the field should read SAML sign-in is set up. If it does not, copy the certificate again.

Step 3 — Assign staff and test

Assign the app in Okta as you would for OIDC. The same rule applies: sign-on does not create accounts, so a staff member needs a RoundUp account at your center — invite them in RoundUp, or provision them from Okta.

4. Provisioning (SCIM 2.0)

Provisioning lets Okta create a staff account when someone is assigned the app, and remove their access the day they are unassigned or deactivated. A new account arrives as an invited staff member at your center — they get the invitation email, and can sign in with Okta straight away without opening it.

One thing it does not do: once an account exists, later changes to the person's name in Okta are not copied into RoundUp. Edit the staff record in RoundUp if a name changes.

Step 1 — Get your provisioning credentials

On the RoundUp Okta screen, find the Provision staff from Okta (optional) card, which appears once the sign-on details from section 2 are saved. It shows a SCIM connector base URL and an Authorization (bearer token), both specific to your center.

Step 2 — Configure provisioning in Okta

In your app integration, turn on provisioning and enter:

• SCIM connector base URL — as shown on the RoundUp screen.
• Unique identifier field for users — userName (the staff member's email address).
• Supported provisioning actions — Push New Users, Push Profile Updates, and Deactivate Users.
• Authentication mode — HTTP Header (or Bearer). Paste the authorization token from the RoundUp screen.

Test the connector configuration in Okta before saving. RoundUp manages users only — there are no groups to push.

What provisioning does, and does not, do

• Director and administrator roles never come from Okta. They are only ever granted from inside RoundUp, so an Okta administrator cannot grant elevated access to your center through the connector.
• Deactivating removes their access. Unassigning or deactivating a user in Okta removes them from your center's staff and signs out any session they have open, within about a minute — including on a shared classroom tablet. The record of what they did — attendance they took, notes they wrote — is retained for your licensing and compliance obligations.
• Your center's owner cannot be deprovisioned through Okta, so a misconfigured rule cannot lock your center out of its own account.
• Only your center is affected. The token identifies your center, and cannot read or change another center's staff.

5. Choosing the role staff arrive with

By default a provisioned staff member arrives as a teacher. If you would rather decide per person or per group, RoundUp publishes its assignable roles to Okta as entitlements, and you can grant one when you assign someone:

• Lead teacher — runs a classroom: attendance, daily reports, and family updates for their room.
• Teacher — classroom staff, with the same day-to-day tools. The default.
• Assistant teacher — supports a classroom with a narrower set of permissions.

Director and administrator are deliberately not on this list. Those roles are granted inside RoundUp by someone who already administers your center, so no identity provider — and no one who gains access to your Okta org — can grant administrative access to your center's records through provisioning. If you need to promote someone, do it in the app.

6. Passwords stop working

Once Okta is connected, your staff can no longer sign in with a RoundUp password. That includes you, and every director and administrator at the center. The sign-in screen offers "Sign in with Okta" and the password field stops being an alternative.

This is the reason to connect Okta at all. If a password still worked, every account you connected Okta to centralise would keep a second, unmanaged way in — and unassigning someone in Okta would not take away their access to children's records.

Parents and classroom kiosk devices are unaffected: parents have no account in your org, and a shared tablet cannot complete a browser sign-in.

Staff you have already invited do not need to open their invite email first. Their first Okta sign-in activates the account.

7. If Okta stops working

Everyone now signs in through Okta, so a broken connection is a center that cannot sign in — including the director who would go and disconnect it. Two things handle that.

Most failures fix themselves. If the client secret expires or is rotated in Okta, or a SAML signing certificate runs out, RoundUp notices the first time Okta refuses a sign-in for that reason and puts your center back on passwords until the connection is repaired. No call, no waiting.

For anything else, ask us to open a window. Some breakages look healthy from our side — a certificate rotated but not expired, staff unassigned from the app, a redirect URI changed in Okta. Email support@roundupece.com; we re-enable password sign-in for your center for a few hours so you can get in and fix the connection, and it ends by itself.

8. Ending someone's sessions

RoundUp supports Okta's Universal Logout. If a device is lost or an account is suspected compromised, ending the person's session from Okta signs them out of RoundUp too, within about a minute, rather than leaving the session open until it expires.

This ends sessions only. It does not remove the person from your center — they can sign in again afterwards. To remove someone, deactivate or unassign them in Okta with provisioning set up (section 4), which removes their membership and signs their devices out.

9. Troubleshooting

"This sign-in came from a different Okta org than the one connected to your center."

The org URL saved in RoundUp does not match the issuer your Okta org actually asserts. This is most common when the org uses a custom sign-in domain: the org may assert https://login.example.com while https://example.okta.com was saved, or the reverse. Open https://<your-org-domain>/.well-known/openid-configuration and use the exact value of its issuer field. This message means the two values differ; it does not mean anything is compromised.

"This center hasn't finished connecting Okta yet."

The org URL, client ID, or client secret is missing in RoundUp. Re-enter all three on the Okta screen — the secret must be re-entered if it was never saved.

A staff member is assigned in Okta but cannot sign in

They have no RoundUp account at your center under that email address. Either invite them in RoundUp, or set up provisioning so Okta creates the account. Sign-on deliberately refuses to create accounts on its own.

An invitation that was sent and never opened is NOT this problem — that account can sign in with Okta, and doing so activates it. If they see this message, check the address on their staff record against the one Okta asserts, character by character.

The whole center is being asked for a password again

That is RoundUp telling you the Okta connection has stopped working: the client secret has expired or been rotated, or a SAML certificate has run out. Staff can keep working on their passwords in the meantime. Re-enter the credential on the Okta screen and the button comes back.

"This Okta integration works with RoundUp ECE childcare centers."

The sign-in link is pointing at a center that is not a RoundUp center, or the Center ID in the link is wrong. Re-copy the initiate login URI from your center's Okta screen.

"The Okta SAML assertion could not be verified."

Usually the signing certificate: either it was never saved in RoundUp, or Okta has since rotated it and RoundUp still holds the old one. Copy the current certificate from your Okta app and paste it in again. It can also mean the assertion was unsigned — RoundUp requires signed assertions and will not accept an unsigned one.

"This center hasn't finished connecting Okta SAML yet."

No signing certificate has been saved. Paste it into the SAML card on the RoundUp Okta screen.

10. Support

• Email: support@roundupece.com
• Phone: +1 (458) 273-4336
• Hours: normal business hours, Pacific Time.

For help with a connection that will not complete, include your center name and the exact message shown on screen.