Single sign-on for editors
Editors sign in to the Umbraco backoffice with their Okta account, so access follows the same identity policies, MFA and joiner-mover-leaver process as the rest of your estate.
Product · Included in support agreements
Okta sign-in for the Umbraco backoffice
Crumpled OktaWho lets editors and administrators sign in to Umbraco with their Okta account. It maps Okta groups to Umbraco user groups and can switch off local passwords, so backoffice access follows your central identity policies.
Why connect the Umbraco backoffice to Okta?
Separate CMS passwords are a common finding in security and vendor reviews: shared accounts, no MFA, and leavers who still have access weeks later. Connecting Umbraco to Okta puts the CMS under the same controls as everything else.
Crumpled OktaWho is the package we use to do that, and it is a natural companion to our DevSecOps service for regulated clients.
What does Crumpled OktaWho do?
Accounts linked automatically
A matching Umbraco user is created or linked on first sign-in, so there is no separate password to issue, reset or leave behind.
Okta groups mapped to Umbraco groups
Map Okta group names to Umbraco user groups. Mappings can overwrite manual changes, so removing someone in Okta removes their rights in Umbraco.
Local login can be switched off
Deny username and password login entirely, or redirect straight to Okta so the standard login screen is never shown.
Configured, not coded
Authority, client, callback path, default culture, login button and security options all come from configuration, with a JSON schema for editor tooling.
Group assignment is logged
Optional extra logging records which Umbraco groups each user was given, helping with access reviews and audits.
Works with Hosting Kit environments
Client secrets come from Key Vault like every other secret in our Azure environments, with nothing stored in source control.
Built for Umbraco 17
Version 2 targets Umbraco 17 LTS on .NET 10 and is built on Okta's own ASP.NET Core library. Version 1 remains for Umbraco 13.
How setup works
-
Register
Create an OpenID Connect application in Okta and note the authority, client ID and secret.
-
Install
Add the package, then two lines in Program.cs to register the login provider.
-
Configure
Set the credentials and group mappings in configuration, with the secret held in Key Vault.
-
Sign in
Editors choose the Okta button, or are redirected automatically, and arrive in the backoffice.
Crumpled OktaWho questions
Who is Crumpled OktaWho for?
Organisations that already use Okta as their identity provider and want Umbraco editors and administrators to sign in the same way as every other business system. It suits regulated and enterprise teams, such as financial and professional services, where central identity control and access reviews are expected.
Is Crumpled OktaWho open source?
No. It is Crumpled Dog's own private package, and its licence is included in our support agreements.
Which Umbraco versions does it support?
Version 2 supports Umbraco 17 LTS on .NET 10. Version 1 supports Umbraco 13.
Does it support SAML?
Today it uses OpenID Connect. SAML and OAuth 2.0 support are on the roadmap but not available yet.
Can we keep local logins as a fallback?
Yes. Local login stays enabled unless you choose to deny it, and you can also redirect straight to Okta once you are confident in the setup.
Ask about OktaWho
Bring your Umbraco editors into Okta
Included in our support agreements. Tell us about your Umbraco and Okta setup and we will reply within one working day.