Skip to content

Integrating SailPoint with Okta

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

This SailPoint connector manages Okta accounts using a REST API provided by Okta. This document is designed to give specific information about requirements and field definitions needed to configure a working instance of an Okta source.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

Refer to Supported Features for more information.

Prerequisites

  • Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.

  • To ensure proper functionality of the Okta Source, a minimum CCG version of 1041 is required.

  • The Okta source must manage Users, Groups, and Roles using the REST API provided by Okta. By default, the applications attribute is not a part of the account schema. To add this attribute to the existing schema, refer to Adding Attributes to a Source Schema.

For API Token Authentication

An administrative user must be granted an Okta API token to authenticate.

Note

Okta API tokens generated from these steps are valid for 30 days and automatically refresh with each API call. Tokens that are not used for 30 days will expire.

To generate an Okta API token:

  1. Go to Create an API token in the Okta Developer documentation.
  2. Sign in to your Okta organization as a user with super administrator privileges. API tokens have the same permissions as the user who creates them. If the user permissions change, the API token permissions also change.
  3. On the Developer Console, select Tokens from the API menu.
  4. On the administrator's UI (Classic UI), go to Security > API > Tokens.
  5. Select Create Token and provide a name for the token.
  6. Note the API token for future references.

For OAuth 2.0 Authentication

To use Okta OAuth 2.0 authentication:

  1. Create a service application in Okta.

    Note

    For information on creating a service application on Okta, refer to Implement OAuth for Okta with a service app in the Okta Developer documentation.

  2. Grant the required OAuth scopes to the service application.

  3. Configure the Okta source as per the detail of service application.

    Note

    Refer to Authenticate with OAuth 2.0 for OAuth 2.0 configuration.

Required Permissions

Create an Okta account with privileges to manage the Okta accounts you want to aggregate. Okta provides different levels of permission that provide create, update, and delete account capability.

Review the permission model below and create your account accordingly. Generate the Okta API token with this account that can be used for authentication. For example, you can create an account with Super Admin/Org Admin/Group Admin permissions.

Connector Operation Super Admin Org Admin Group Admin App Admin Read-only Admin Help-desk Admin
Test Connection Yes Yes Yes Yes Yes Yes
Aggregate Standard Attributes Yes Yes Yes Yes Yes Yes
Aggregate Groups Attribute Yes Yes No Yes Yes No
Aggregate Roles Attribute Yes No No No No No
Aggregate Factors Attribute Yes Yes Yes No Yes Yes
Aggregation of Custom Roles Yes No No No No No
Aggregation of Applications Yes No No Yes Yes No
Delta Aggregation Yes Yes No Yes Yes No
Create Users Yes Yes Yes No No No
Enable/Disable Users Yes Yes Yes No No No
Unlock Accounts Yes Yes Yes No No Yes
Password Resets/Change password Yes Yes Yes No No No
Pass-through Authentication Yes Yes Yes Yes Yes Yes
Management of APP Target and APP Instance Target for APP_ADMIN Role Yes No No No No No
Management of Group Target for HELP_DESK_ADMIN Role Yes No No No No No
Add/Remove Groups Yes Yes No No No No
Add/Remove Applications Yes No No Yes No No
Add/Remove Roles Yes No No No No No
Create/Update/Delete group Yes Yes No No No No

OAuth 2.0 Authentication

Note

The service application created in Okta must have the "Admin Roles" defined as outlined in the "API Token Authentication" section above along with scopes defined in below table.

Operation Scopes
Mandatory Scopes okta.logs.read okta.users.manage okta.groups.manage
Additional Scopes to Manage the roles okta.roles.manage
Additional Scopes to Manage factors okta.factors.manage
Additional Scopes to Manage applications okta.apps.manage
Additional Scopes for Discover Schema okta.schemas.manage

Minimum Permissions

Auth Method What Needs the Role Minimum Role Minimum Scopes (Read-Only Discovery)
API Token The Okta user whose token is used Read-Only Administrator (sufficient for discovery), Organization Administrator OR Super Administrator n/a (token inherits the user's permissions)
OAuth 2.0 The API Services App Read-Only Administrator (sufficient for discovery), Organization Administrator OR Super Administrator okta.users.read okta.apps.read

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.