Okta Authorization Parameters

The Configuration page contains the Settings tab, the Schema tab, and the Provisioning Policies tab. For more information, refer to Configuration Tab.

Settings, Schema, and Provisioning Policies tabs on the Configuration page.

  • Settings tab - Use the configuration parameters below to complete the configuration on this tab.

This section contains information on the attributes that the connector uses to connect to and interact with the application. Each application type requires different information to create and maintain a connection.

Note
Attributes marked with an asterisk (*) are mandatory.

Okta Connection Settings

The host URL of Okta instance

Select the authentication type provided by Okta

  • API Token

  • OAuth 2.0

The maximum size of each dataset when querying large number of objects

Minimum value is 1 and maximum value is 200. Default: 200

Applicable if 'Authentication Type' is selected as 'API Token'

SSWS API token required for Okta authentication

Applicable if 'Authentication Type' is selected as 'OAuth 2.0'

Authorization grant to be used to obtain access token

URL for token generation

For example, https://{yourOktaDomain}/oauth2/v1/token.

Scopes that must be included while creating JWT tokens for operations on the Okta managed source

Multiple scopes must be provided as space-separated values. For example,

okta.users.read okta.users.manage okta.groups.read okta.groups.manage okta.schemas.read okta.roles.read okta.roles.manage okta.factors.read okta.factors.manage okta.apps.read okta.apps.manage okta.logs.read

Contains the algorithm that is used for signing the JWT assertion

For example,

{

"typ": "JWT",

"alg": "RS256"

}

JWT audience for authorization

JWT issuer for authorization

This value must be same as the client_id

JWT subject for authorization

This value must be same as the client_id

Private key text in PKCS#1 Privacy Enhanced Mail (PEM) format used to encrypt the JWT assertion. Confirm that the first line of the private key is -----BEGIN RSA PRIVATE KEY-----.

Important
The connector does not support private keys in PKCS#8 format. Do not use openssl genpkey, which generates a PKCS#8 key.

For OpenSSL 3.x, use the -traditional option to generate a PKCS#1 private key:

Copy 
openssl genrsa -traditional -out okta_private.pem 2048

For OpenSSL 1.x, generate a PKCS#1 private key:

Copy 
openssl genrsa -out okta_private.pem 2048

Generate the public key from the private key:

Copy 
openssl rsa -in okta_private.pem -pubout -out okta_public.pem

If you have a PKCS#8 private key that begins with -----BEGIN PRIVATE KEY-----, convert it to PKCS#1 format.

For OpenSSL 3.x:

Copy 
openssl rsa -in okta_private.pem -traditional -out okta_private_pkcs1.pem

For OpenSSL 1.x:

Copy 
openssl rsa -in okta_private.pem -out okta_private_pkcs1.pem

If your private key was originally provided in JWK format, convert it to PKCS#1 PEM format before you enter it.

Password for decrypting the private key

Aggregation Filter Settings

Optional condition to include a subset of Accounts during aggregation

For example: status eq "ACTIVE"

For more information on the Aggregation Filters supported on the managed system, refer to Supported Aggregation Filters.

Optional condition to include a subset of Groups during aggregation

By default the value is set as follows:

type eq "BUILT_IN" or type eq "OKTA_GROUP"

For more information on the Group Aggregation Filters supported on the managed system, refer to Supported Aggregation Filters.

Optional condition to include a subset of Applications during aggregation

For example: status eq "ACTIVE"

To test the connection:

  1. Select Test Connection. The test uses the settings provided to verify the connection to your application.

  2. Select Save.