# SailPoint Okta SSO Discovery Connector Documentation > Okta SSO Discovery Connector Documentation # Documentation # Additional Settings Schedule discovering applications connected to the Okta SSO instance on these configuration pages. You can modify and manage scheduling aggregation directly within the interface. ## Discovery Settings 1. In the **Additional Settings** section, select **Discovery Settings**. 2. To aggregate enterprise applications that are connected to your discovery source, select **Start Discovering**. The aggregation begins immediately and occurs once. 3. Select **Enable Schedule** to schedule recurring aggregations. > **Screenshot** > > [![Discovery Settings]()]() 4. Select the **Frequency** from the dropdown, and enter the time of day. - **Daily** - Aggregation occurs once per day at the time selected. 1. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. - **Weekly** - Aggregation occurs once per week on the day and time selected. 1. Select a **Day** of the week, Sunday - Saturday, from the dropdown. 2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. - **Monthly** - Aggregation occurs once per month on the date and time selected. 1. Select a **Date** of the month, 1 - 28, from the dropdown. 2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. > **Note** > > The time zone (GMT offset) for the entitlement aggregation schedule is determined by the time zone set for the connected virtual appliance cluster. 5. Select **Save**. ## Latest Application Discovery Information about the most recent application discovery is displayed under **Latest Application Discovery**. ## Discovery Activity To view the list of all enterprise application aggregations on this source, select **Discovery Activity**. When applications are being aggregated, an entry is added to the Discovery Activity section. This includes information like the admin who started the aggregation (for manual aggregations), the date and time the aggregation occurred, the number of objects scanned, and its current status. Aggregations are ordered by most recent aggregation task. You can also sort by status to quickly find success, warning, error, and terminated tasks. > [!NOTE] > > **Screenshot** > > [![Discovery Activity]()]() # Connecting SailPoint and Okta SSO To connect SailPoint and Okta SSO, perform the following tasks: ## Adding Discovery Connector in SailPoint Discovery connectors have categories that encompass a group of discovery sources to find enterprise applications. You can automatically discover enterprise applications using discovery sources, which search for applications your organization has on-boarded or can on-board. For more information, refer to [Discovering Enterprise Applications](). 1. Go to **Admin \> Connections \> Discovery Connectors**. 2. Select **Create Connector**. 3. Select **Connector Category**. 4. Select **Continue**. 5. Search for a source type and select **Configure**. 6. Review the directions and select **Start Connector Setup**. 7. Review the pre-populated source name, source owner, and description. To update, select **Edit**. > **Note** > > Source name must be unique. 8. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 9. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** page. 10. Select **Finish**. A test connection is performed in the background. 11. If the test connection is successful, your source is created, and you are prompted to run a discovery. - If you want to discover applications now, select **Discover**. - **Additional Settings \> Discovery Settings** - The latest application discovery history is shown. - **Additional Settings \> Discovery Activity** - Discovered applications are listed. - If you want to discover applications later, select **Cancel**. As no discovery has taken place, in the source details: - **Additional Settings \> Discovery Settings** - The latest application discovery history is blank. - **Additional Settings \> Discovery Activity** - No discovered applications are listed. You are navigated to the **Sources** page, where the source created is listed. ## Base Configuration Provide the base configuration parameters. Information you entered in the Connector Setup dialog is automatically entered into the fields in the Base Configuration page. You can edit this information, if necessary. > [!NOTE] > > Ensure that the name and description of each connector is unique. 1. Enter a descriptive **Connector Name** for the connection. 2. Enter the **Description** that provides details necessary to distinguish it from similar connection sources. 3. In **Connector Owner**, enter the name of the owner responsible for administrating, operating and managing the source system. 4. Select **Save**. ## Connection Settings Your source needs to authenticate with the Okta managed system to connect and interact with it. The process to configure authentication changes depending whether you authenticate with an API Token or OAuth 2.0. ### Authenticate with an API Token Configure your source to authenticate with Okta using an API Token. > [!NOTE] > > **Screenshot** > > [![Authenticate with an API Token]()]() 1. Enter the **Okta URL** of the host. For example, `https://{yourOktaDomain}.com`. 2. Select the **API Token** radio button. 3. In **API Token**, enter the Single Sign-On Web System (SSWS) API token required for Okta authentication. > **Note** > > SSWS specifies the proprietary authentication scheme Okta uses. 4. Select **Save**. ### Authenticate with OAuth 2.0 Configure your source to authenticate with Okta using OAuth 2.0. > [!NOTE] > > For more information on retrieving some of the credentials used in this process, refer to [Implement OAuth for Okta with a Service App](). > [!NOTE] > > **Screenshot** > > [![Authenticate with OAuth 2.0]()]() > > [![Authenticate with OAuth 2.0]()]() > > [![Authenticate with OAuth 2.0]()]() 1. Enter the **Okta URL** of the host. For example, `https://{yourOktaDomain}.com`. 2. Select **Client Credentials** for the **Grant Type**. Currently, this is the only grant type supported. 3. Enter the **OAuth 2.0 Token URL** for token generation. For example: `https://{yourOktaDomain}/oauth2/v1/token` 4. Enter the **Scopes** that must be included while creating JWT token for appropriate operations on the Okta managed system. Scopes must be provided as a space-separated value. For example: `okta.users.read okta.users.manage okta.groups.read okta.groups.manage okta.schemas.read okta.roles.read okta.roles.manage okta.factors.read okta.factors.manage okta.apps.read okta.apps.manage okta.logs.read` 5. Enter the **JWT Header** that has the algorithm being used for signing the JWT assertion. For example: ```json { "typ": "JWT", "alg": "RS256" } ``` 6. Enter the JWT **Audience** for authorization. 7. Enter the JWT **Issuer** for authorization. This value must be same as the `client_id`. 8. Enter the JWT **Subject** for authorization. This value must be same as the `client_id`. 9. Enter the **Private Key** text in PKCS\#1 Privacy Enhanced Mail (PEM) format to encrypt the JWT assertion. Confirm that the first line of the private key is `-----BEGIN RSA PRIVATE KEY-----`. > **Important** > > The connector does not support private keys in PKCS\#8 format. Do not use `openssl genpkey`, which generates a PKCS\#8 key. For OpenSSL 3.x, use the `-traditional` option to generate a PKCS\#1 private key: ```text openssl genrsa -traditional -out okta_private.pem 2048 ``` For OpenSSL 1.x, generate a PKCS\#1 private key: ```text openssl genrsa -out okta_private.pem 2048 ``` Generate the public key from the private key: ```text openssl rsa -in okta_private.pem -pubout -out okta_public.pem ``` If you have a PKCS\#8 private key that begins with `-----BEGIN PRIVATE KEY-----`, convert it to PKCS\#1 format: For OpenSSL 3.x: ```text openssl rsa -in okta_private.pem -traditional -out okta_private_pkcs1.pem ``` For OpenSSL 1.x: ```text openssl rsa -in okta_private.pem -out okta_private_pkcs1.pem ``` If your private key was originally provided in JWK format, convert it to PKCS\#1 PEM format before you enter it. 10. Enter the **Private Key Password** to decrypt the private key that was used for assertion. > **Note** > > The private key password may be referenced as a "KID" or KEY ID in Okta. 11. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Discovering Applications with Okta SSO The SailPoint Okta SSO Discovery Connector retrieves detailed information about applications configured within Okta. This connector enables continuous application discovery, providing visibility into application inventory, ownership, and usage across the enterprise. These insights help organizations prioritize and focus their governance efforts on the highest-impact applications. For guidance on creating an Okta SSO Discovery Connector, refer to [Base Configuration](). ## Supported Features The Okta SSO connector supports the following features: - Test Connection - Discover Application ## Prerequisites ### For API Token Authentication An administrative user must be granted an Okta API token to authenticate. > [!NOTE] > > Okta API tokens generated from these steps are valid for 30 days and automatically refresh with each API call. Tokens that are not used for 30 days will expire. To generate an Okta API token: 1. Go to [Create an API token]() in the Okta Developer documentation. 2. Sign in to your Okta organization as a user with super administrator privileges. API tokens have the same permissions as the user who creates them. If the user permissions change, the API token permissions also change. 3. On the Developer Console, select **Tokens** from the API menu. 4. On the administrator's UI (Classic UI), go to **Security \> API \> Tokens**. 5. Select **Create Token** and provide a name for the token. 6. Note the API token for future references. ### For OAuth 2.0 Authentication To use Okta OAuth 2.0 authentication: 1. Create a service application in Okta. > **Note** > > For information on creating a service application on Okta, refer to [Implement OAuth for Okta with a service app]() in the Okta Developer documentation. 2. Grant the required OAuth scopes to the service application. 3. Configure the Okta source as per the detail of service application. > **Note** > > Refer to [Authenticate with OAuth 2.0]() for OAuth 2.0 configuration. ## Required Permissions Okta provides different levels of permission. Review the permission model below and create your account accordingly. Generate the Okta API token with this account that can be used for authentication. For example, you can create an account with Super Admin/Org Admin/Group Admin permissions. # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Test Connection Failures with OAuth 2.0 Authentication While performing a test connection, it fails with following errors: - The following error message displays: `[ InvalidRequestException ] [ Error details ] Request execution failed. HTTP Error code : 400, Okta Error code : invalid_client, errorSummary : Invalid value for 'client_id' parameter., errorCauses:[].` Resolution - Ensure that the **Issuer** is correct and it is the same as the **Client ID** of the service application created in Okta. - The following error message displays: `[ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 401, Okta Error code : invalid_client, errorSummary : The subject claim for client_assertion is not a valid client_id., errorCauses:[].` Resolution - Ensure that the **Subject** is correct and it is the same as the **Client ID** of the service application created in Okta. - The following error message displays: `[ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 401, Okta Error code : invalid_client, errorSummary : The audience claim for client_assertion must be the endpoint invoked for the request., errorCauses:[].` Resolution - Ensure that the URL provided in **Audience** is correct for authorization. - The following error message displays: `[ InvalidConfigurationException ] Failed to decrypt the private key. class org.bouncycastle.asn1.pkcs.PrivateKeyInfo cannot be cast to class org.bouncycastle.openssl.PEMKeyPair` Resolution - The private key must be in PKCS\#1 format. Confirm that the first line of the private key is `-----BEGIN RSA PRIVATE KEY-----`. A key that begins with `-----BEGIN PRIVATE KEY-----` is PKCS\#8 and is not supported. For generation and conversion commands, refer to [Authenticate with OAuth 2.0](). ## Operations Failed with an Error Message While performing any operation with OAuth 2.0 Authentication Type, it fails with the following error message: `[ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 403, Okta Error code : , errorSummary : , errorCauses:[].` Resolution - Ensure that the appropriate scopes are provided to the Okta service application and the same are provided in the `scope` configuration parameter. ## Test Connection Failing with Error Message When performing a test connection, it fails and the following error displays: `Exception: sailpoint.connector.ConnectionFailedException: [ ConnectionFailedException ] [ Possible suggestions ] a) Make sure Okta instance is reachable. b) Make sure there is a smooth connectivity between Identity Server and Okta instance. [ Error details ] Failed to connect to the Okta instance.` If there is a firewall between SailPoint and the Okta tenant, it is likely causing the blocking the connection. Resolution - Verify if there are any firewall rules present in your environment that are blocking the Okta URL, FQDN, or IP address. If the rules are blocking this communication, unblock them.