[keycloak-user] Okta as IdP, Keycloak as SP, end-app is node.js w/openid-connect

So, I’m trying to figure this one out, see if it’s possible. Maybe I’m just not using the right re-directs.. Anyways, keycloak is version 3.0.0, on centos 7.3.1611 I’ve got my App able to use Okta from app -> keycloak -> okta – but the customer has a requirement to use the Okta portal, click on the app, and be auto-logged in (after account creation). What I am not seeing, or understanding perhaps, is which URL I should be using to redirect for SSO from Okta -> go through keycloak then onto my App. Is this even possible? Thanks in advance. Eric