Provisioning
The Okta connector supports provisioning, allowing you to create and manage accounts and entitlements in Okta directly from SailPoint.
Prerequisite: Your system is configured for provisioning.
When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.
When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.
For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.
Important
This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.
Default Create Account Attributes
The following generators create required information for a new Okta account. You might need to edit the contents.
| Account Attribute | Generator | Description |
|---|---|---|
| login | Identity Attribute | Unique ID (username) used as login |
| Identity Attribute | Primary Email of the user | |
| firstName | Identity Attribute | First name of the user |
| lastName | Identity Attribute | Last name of the user |
| activate | Static Value | Checked to set the status as provisioned, unchecked to set status as staged |
| password | Generator | Login password for the user |
| middleName | Disable | Middle name(s) of the user |
| secondEmail | Disable | Secondary email address of the user that is used for account recovery |
| displayName | Disable | The display name that can be used for the user |
| title | Disable | User's title. For example: "Sr. General Manager" |
| honorificPrefix | Disable | Honorific prefix(es) of the user. For example: "Dr., Mrs., Mr." |
| honorificSuffix | Disable | Honorific suffix(es) of the user. For example: "MD, PhD, MSCSW" |
| profileUrl | Disable | URL of the user's Online profile |
| primaryPhone | Disable | Primary phone number of the user |
| mobilePhone | Disable | Mobile phone number of user |
| streetAddress | Disable | Street address component of the user's address |
| city | Disable | City or locality component of the user's address |
| state | Disable | State or region component of the user's address |
| zipCode | Disable | ZIP code or postal code component of the user's address |
| countryCode | Disable | Country name component of the user's address |
| postalAddress | Disable | Mailing address component of the user's address |
| preferredLanguage | Disable | The user's preferred written or spoken language |
| locale | Disable | The user's default location for the purpose of localizing items such as currency, date/time format, numerical representations, etc. |
| timezone | Disable | The user's time zone |
| userType | Disable | Used to identify the type of the user, such as "Employee" or "Contractor" |
| employeeNumber | Disable | Unique identifier for the user assigned by the organization or company |
| costCenter | Disable | Cost center assigned to the user |
| organization | Disable | The user's organization |
| division | Disable | The user's division |
| department | Disable | The user's department |
| manager | Disable | The name of the user's manager |
| managerId | Disable | ID of the user's manager |
| providerName | Disable | The name of the credential provider |
| providerType | Disable | The type of the credential provider |
Note
Custom attributes of the User profile from Okta can be populated using the Discover Schema functionality.
The Okta Source supports the Credential Provider User (for example, Federation/Social Provider user) in the Okta managed system. Users with a FEDERATION or SOCIAL authentication provider do not support a password credential and must be authenticated using a trusted Identity Provider. While creating an Okta user, if the providerName attribute is not configured or an invalid value is provided, both the provider type and name are set as OKTA.
Account Status
To verify the status of the created user, refer to the following table.
| Activate Checkbox | Password | Provider Type | Status on the Okta Managed System | Source Status |
|---|---|---|---|---|
| Unchecked | Provided/Not Provided | Empty | STAGED | Disabled |
| Checked | Not Provided | Empty | Pending user action | Enabled |
| Checked | Provided | Empty | PASSWORD_EXPIRED | Enabled |
| Unchecked | Not Provided | FEDERATION/SOCIAL | STAGED | Disabled |
| Checked | Not Provided | FEDERATION/SOCIAL | ACTIVE | Enabled |
Assignment of User Type While Creating a User
The Okta Source now supports assignment of a user type while creating a user in the Okta managed system.
Also, the source supports aggregation of the type of the user with type_name and type_displayName attributes that define the name and display name of the assigned user type, respectively.
You must manually add the type_name and type_displayName attributes to the account schema. Refer to this document: Adding Attributes to a Source Schema.
In the Create Account section of the Okta source UI, set up the following attribute.
| Account Attribute | Generator | Description |
|---|---|---|
| type_name | Disable | The name of the Okta user type. This type_name attribute is case-sensitive and it is referred to as 'variable name' of user type in the managed Okta system. |
Additional Information
This section contains information on additional attributes you can use to set up your provisioning policy.
The Okta connector now supports a configurable delay for single-account aggregation prior to executing update operations.
To configure this delay, add the following entry to the source XML using the REST API:
In the body of the Patch, use the form-data as follows:
Custom Attributes
To provision custom attributes you have created in the Okta system, add a matching attribute into the provisioning policy. For example, if you have the custom attributes; customAttr1 and customAttr2 on Okta and you need to provision them, you need to add customAttr1 and customAttr2 to the provisioning plan as well.
To add custom attributes, refer to Adding Attributes to Create Account Page for Sources.
Account Status
The following table contains information on the status of created accounts:
| Activate Checkbox | Password | Status on the Okta Managed System | Source Status |
|---|---|---|---|
| false | Provided/Not Provided | STAGED | Disabled |
| true | Not Provided | Pending user action | Enabled |
| true | Provided | PASSWORD_EXPIRED | Enabled |
By default, the activate field value in Create Account section is true.
Account Status for Federation Provider
The following table contains information on the attributes used to configure a federation provider.
| Activate Checkbox | Password | Provider Type | Status on the Okta Managed System | Source Status |
|---|---|---|---|---|
| Unchecked | Not Provided | FEDERATION/SOCIAL | STAGED | Disabled |
| Checked | Not Provided | FEDERATION/SOCIAL | ACTIVE | Enabled |
Support to Recovery Question and Answer in Provisioning
The Okta source can provision a recovery question and answer along with an account in the Okta native system.
Add the following attributes in the Create Account section in the Okta configuration interface for an Okta account.
| Account Attribute | Generator | Description |
|---|---|---|
| recoveryQuestion | Disable | The recovery question for the user |
| recoveryAnswer | Disable | The answer for the recovery question |
The following table contains information on the status of accounts.
| Activate Checkbox | Password | Recovery Question and Answer | Status on the Okta Managed System | Source Status |
|---|---|---|---|---|
| Unchecked | Provided | Not provided | STAGED | Disabled |
| Checked | Not Provided | Provided | Pending user action | Enabled |
| Checked | Provided | Provided | ACTIVE | Enabled |
Send Email Updates for Enable Account Provisioning Policy
When enabling a deprovisioned user, the system will not send an activation email to the user if the sendEmail attribute is set to false in the enable operation provisioning policy. The default value is true.
Note
For more information, contact SailPoint Services.
Setting a Password in Permanent Mode
The Okta source supports the ability to set a password in Permanent mode while creating a new account. In the Okta system, in the Create Account section, configure setPasswordInPermanentMode. Set the value to true for creation of an account in Active mode. It sets a password in Permanent mode for the newly created account. By default, an account is created in the PASSWORD_EXPIRED mode.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.