Okta SSO is used heavily inside my company to access internal sites, but if there's a way to whitelist, or the user sees a popup the first time and allows Okta cookies after that, this problem is taken care of.