The application implements no SSO. There is no SAML, OIDC, or SCIM code in the codebase — a search for any of them returns nothing.This page documents the deployment pattern that achieves the same control, rather than describing a feature that does not exist.

​
Why the proxy pattern actually fits here

Because Scienter is self-hosted, authentication can be enforced in front of it by infrastructure you already run and already trust. For a single-tenant internal deployment this is not a workaround — it is the same architecture most internal tools use, and it keeps identity in your IdP where it belongs.

​
Setting it up with Okta

1

Create an OIDC app in Okta

Create a Web application with the authorization code flow. Set the redirect URI to your proxy’s callback (for oauth2-proxy, https://your-host/oauth2/callback).Assign the Okta groups that should have access.
2

Put the proxy in front of both ports

The dashboard (3101) and the engine (8777) are separate listeners. Both need covering — protecting only the dashboard leaves the engine’s data endpoints open.
3

Bind the services to loopback

The proxy should be the only thing that can reach them:
Confirm neither service is reachable on a public interface after the proxy is deployed.
4

Set the engine's tunnel token as a second layer

state/config.json
The proxy handles identity; this token means a request that somehow bypasses the proxy still fails. Two layers, for the reason limits are doubled elsewhere in this system: a control that exists in only one place disappears when that place has a bug.
5

Map Okta groups to platform roles manually

There is no automatic role mapping. The proxy authenticates the person; it does not tell the application who they are.Workspace roles (owner, admin, analyst, viewer) are assigned inside the application and must be kept in sync with your IdP groups by hand. A departure removed in Okta still holds its workspace role until someone removes it there too.
Include workspace membership in your offboarding checklist. See Org accounts.

​
What this pattern gives you, and what it does not

That last row is the significant limitation. The audit log records the application’s actor, not the Okta identity, so correlating an audit entry to an employee requires joining on the application’s user record.

​
Equivalent providers

The same pattern works with Entra ID, Google Workspace, or any OIDC provider. Common proxies: Cloudflare Access, oauth2-proxy, AWS ALB with OIDC, Pomerium, Teleport.
Scienter publishes impersonal market signals of general and regular circulation. Nothing here is investment, legal, or tax advice, or a recommendation to buy, sell, or hold any asset. Scienter is not a registered investment adviser or broker-dealer. Trading digital assets can result in the total loss of your funds — see Disclaimers for the full text.