Connecting SailPoint and Okta SSO

To connect SailPoint and Okta SSO, perform the following tasks:

Adding Discovery Connector in SailPoint

Discovery connectors have categories that encompass a group of discovery sources to find enterprise applications. You can automatically discover enterprise applications using discovery sources, which search for applications your organization has on-boarded or can on-board. For more information, refer to Discovering Enterprise Applications.

Go to Admin > Connections > Discovery Connectors.
Select Create Connector.
Select Connector Category.
Select Continue.
Search for a source type and select Configure.
Review the directions and select Start Connector Setup.
Review the pre-populated source name, source owner, and description. To update, select Edit.

Note

Source name must be unique.
(Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

Note

To add a Credential Provider in SailPoint, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.
Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the Connection Settings page.
Select Finish. A test connection is performed in the background.
If the test connection is successful, your source is created, and you are prompted to run a discovery.
- If you want to discover applications now, select Discover.
  - Additional Settings > Discovery Settings - The latest application discovery history is shown.
  - Additional Settings > Discovery Activity - Discovered applications are listed.
- If you want to discover applications later, select Cancel. As no discovery has taken place, in the source details:
  - Additional Settings > Discovery Settings - The latest application discovery history is blank.
  - Additional Settings > Discovery Activity - No discovered applications are listed.
  You are navigated to the Sources page, where the source created is listed.

Base Configuration

Provide the base configuration parameters. Information you entered in the Connector Setup dialog is automatically entered into the fields in the Base Configuration page. You can edit this information, if necessary.

Note

Ensure that the name and description of each connector is unique.

Enter a descriptive Connector Name for the connection.
Enter the Description that provides details necessary to distinguish it from similar connection sources.
In Connector Owner, enter the name of the owner responsible for administrating, operating and managing the source system.
Select Save.

Connection Settings

Your source needs to authenticate with the Okta managed system to connect and interact with it. The process to configure authentication changes depending whether you authenticate with an API Token or OAuth 2.0.

Authenticate with an API Token

Configure your source to authenticate with Okta using an API Token.

Screenshot

Enter the Okta URL of the host. For example, https://{yourOktaDomain}.com.
Select the API Token radio button.
In API Token, enter the Single Sign-On Web System (SSWS) API token required for Okta authentication.

Note

SSWS specifies the proprietary authentication scheme Okta uses.
Select Save.

Authenticate with OAuth 2.0

Configure your source to authenticate with Okta using OAuth 2.0.

Note

For more information on retrieving some of the credentials used in this process, refer to Implement OAuth for Okta with a Service App.

Screenshot

Enter the Okta URL of the host. For example, https://{yourOktaDomain}.com.
Select Client Credentials for the Grant Type. Currently, this is the only grant type supported.
Enter the OAuth 2.0 Token URL for token generation. For example:

https://{yourOktaDomain}/oauth2/v1/token
Enter the Scopes that must be included while creating JWT token for appropriate operations on the Okta managed system. Scopes must be provided as a space-separated value. For example:

okta.users.read okta.users.manage okta.groups.read okta.groups.manage okta.schemas.read okta.roles.read okta.roles.manage okta.factors.read okta.factors.manage okta.apps.read okta.apps.manage okta.logs.read
Enter the JWT Header that has the algorithm being used for signing the JWT assertion. For example:
```
{
    "typ": "JWT",
    "alg": "RS256"
}
```
Enter the JWT Audience for authorization.
Enter the JWT Issuer for authorization. This value must be same as the client_id.
Enter the JWT Subject for authorization. This value must be same as the client_id.
Enter the Private Key text in PKCS#1 Privacy Enhanced Mail (PEM) format to encrypt the JWT assertion. Confirm that the first line of the private key is -----BEGIN RSA PRIVATE KEY-----.

Important

The connector does not support private keys in PKCS#8 format. Do not use openssl genpkey, which generates a PKCS#8 key.

For OpenSSL 3.x, use the -traditional option to generate a PKCS#1 private key:
```
openssl genrsa -traditional -out okta_private.pem 2048
```
For OpenSSL 1.x, generate a PKCS#1 private key:
```
openssl genrsa -out okta_private.pem 2048
```
Generate the public key from the private key:
```
openssl rsa -in okta_private.pem -pubout -out okta_public.pem
```
If you have a PKCS#8 private key that begins with -----BEGIN PRIVATE KEY-----, convert it to PKCS#1 format:

For OpenSSL 3.x:
```
openssl rsa -in okta_private.pem -traditional -out okta_private_pkcs1.pem
```
For OpenSSL 1.x:
```
openssl rsa -in okta_private.pem -out okta_private_pkcs1.pem
```
If your private key was originally provided in JWK format, convert it to PKCS#1 PEM format before you enter it.
Enter the Private Key Password to decrypt the private key that was used for assertion.

Note

The private key password may be referenced as a "KID" or KEY ID in Okta.
Select Save.

Review and Test

Perform a test to confirm the connection to SailPoint.

Go to Review and Test.
Confirm that the entries in each field are correct.

If you note any mistakes, return to the section and make corrections.
Select Test Connection.

SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to Discovered Applications in the SailPoint user interface.

For more information, refer to Application Onboarding in the SailPoint SaaS documentation.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.