Supported Features

The Okta source supports the multi-valued factors attribute related to the Multi-Factors attribute in the Okta managed system. The Okta source can aggregate and provision the factors attribute. Provisioning this attribute maps to the Enroll Multi-Factors operation in the Okta managed system.

factors data is aggregated as shown in the following example:

• Attribute Name – factors

• Attribute Value – factorType=sms ; provider=OKTA , factorType=push ; provider=OKTA, factorType=token:software:totp ; provider=OKTA

Applications

If the applications schema is configured, use the following parameters to fine tune the application's aggregation.

• Filter Conditions for Applications – This is an optional condition to bring a subset of Applications during aggregation. For example, status eq "ACTIVE". Refer to the Update Source (Partial) for more information.

• Application Page Size – Sets the maximum size of each dataset when querying a large number of applications by adding the entry key as follows:

  <entry key="appsPageSize" value= "200">

  The default value is 200.

  For more information, refer to Update Source (Partial).

• Disable Application Caching - To skip creation of application cache, set noAppCaching to true.

  Copy

  <entry key="noAppCaching">
   <value>
    <Boolean>true</Boolean>
   </value>
  </entry>

  For more information, refer to Update Source (Partial).

• Enable Application Skinny User - (Applicable only for caching the approach of account partitioning aggregation) – Enables the skinny_user endpoint to bring applications connected to user in Okta connector by adding the entry key as follows:

  <entry key="applicationSkinnyUsers" value= "true">

  For more information, refer to Update Source (Partial).

groupTargetsHelpDeskAdmin

If the groupTargetsHelpDeskAdmin schema is configured, use the following parameters to fine tune the application's aggregation.

• Filter conditions for groupTargetsHelpDeskAdmin – This is an optional condition to bring a subset of groupTargetsHelpDeskAdmin during aggregation. For example, type eq "BUILT_IN". For more information, refer to the Update Source (Partial).

  <entry key="groupTargetAggFilter" value="type eq &quot;BUILT_IN&quot;"/>

Aggregation

By default, for the Okta source the applicationsManagedByRole attribute is not a part of the account schema. To add this attribute to the existing schema, refer to Adding Attributes to a Source Schema. The applicationsManagedByRole attribute is a multi-valued entitlement attribute, and it aggregates the APP Target and APP Target Instance for APP_ADMIN assigned to a user separated by the delimeter, ###.

Add the applicationsManagedByRole attribute in the account schema as follows:

<AttributeDefinition entitlement="true" managed="true" multi="true" name="applicationsManagedByRole" type="string">

<Description>APP Target and APP Instance Target of APP_ADMIN role connected to user.</Description>

</AttributeDefinition>

Provisioning

Supports add/remove of applicationsManagedByRole attribute.

Aggregation

By default, for the Okta source the groupTargetsHelpDeskAdminRole attribute is not a part of the account schema. To add this attribute to the existing schema, refer to Adding Attributes to a Source Schema. The groupTargetsHelpDeskAdminRole attribute is a multi-valued entitlement attribute, and it aggregates the Group Target for the HELP_DESK_ADMIN role assigned to a user.

Add the groupTargetsHelpDeskAdminRole attribute to the account schema as follows:

<AttributeDefinition entitlement="true" managed="true" multi="true" name="groupTargetsHelpDeskAdminRole" schemaObjectType="group" type="string">
<Description>Group target of HELP_DESK_ADMIN connected to user</Description>
</AttributeDefinition> 

Provisioning

You can add or remove groupTargetsHelpDeskAdminRole attribute via provisioning.

The Okta source supports aggregation of custom roles directly associated with both accounts and groups in the following format:

RoleName#ResourceSetName

In order to leverage this functionality, you need to add these attributes into the account and group schemas:

• Attribute Name – customRoles

• Property Type – string

• Select the Entitlement, Multivalued , and Managed checkboxes.

The Okta source also supports the addition and removal of Custom Roles from the user.

The Okta connector supports the aggregation and provisioning of custom attributes belonging to User Profile. In order to leverage this functionality, user needs to add these attributes into the account:

• Attribute Name - customAttribute

• Type - string

The Okta source supports the aggregation of Standard roles associated with Groups.

In order to leverage this functionality, you need to add these attributes into the group schema:

• Attribute Name – roles

• Property Type – string

• Select the Entitlement, Multivalued , and Managed checkboxes.

Enabling a User Account from IdentityIQ also activates a user in Okta. Disabling a User Account from IdentityIQ will either suspend or deprovision a user in Okta depending on your provisioning configuration.

Account Update is supported for the suspended/deprovisioned account while performing the Enable operation.

To enable account update during the enable operation, add the following entry to the application XML using the application Debug page:

<entry key="updateAccountWithEnableOperation">
    <value>
        <Boolean>true</Boolean>
    </value>
</entry>