I am new to Okta and I just heard of this. A partner company (client) wants to use their existing Okta accounts to login to my application (via keycloak).

I have a developer Okta account and I successfully added Okta OIDC identity provider and it is working.

My problem now is how will I apply this for production.

After adding the Okta identity provider, the okta login button is created automatically on the login page.

I think there are 2 ways I can implement to production:

(1) Create okta account for production and do similar configurations I did in developer okta account.

Pros: 1 button for okta login.
Cons: Need to invite and add external okta users (and non-okta) to the application-client of my okta account. If there are hundred okta users in the partner company, there will be too many invitations or add users to do.

(2) Ask partner-company to create my-app application client in their okta account and ask for the okta account URL and client-id so that I can get the client information needed to add as identity provider in my-keycloak app.

Pros: No need to register for production okta account.
Cons: 1 okta login button per partner company using okta. If there are 5 partner companies who wish to use their okta accounts to my app (keycloak), there will also be 5 okta login buttons (one for each partner-company).

My ideal use-case is to have only 1 button for okta login, but any partner-company can use their existing okta user accounts to login to my-app via keycloak. No need to do invitations or manually creating account, username, password so that an existing Okta account can be use to my-app. It would be like automatically adding a new account in my-app using the existing Okta user’s credentials OR using that existing Okta accounts and giving it access to my-app.

Just like in Google, sign-in once in Google and can access different applications.

Is this possible?