We do support Okta SSO integration (and many other providers) in our on-premise product through generic OAuth2 mechanism - we don't use anything fancy, just clj-http and https://github.com/cemerick/friend (which we are using for regular authentication too)