# Configuring the Okta SaaS Connector

To connect Okta to Agentic Fabric, you'll create a service app in Okta. This will allow Agentic Fabric to discover Okta applications and Admin API tokens and aggregate them as non-human identities.

!!! important

If your organization has already configured an Okta SaaS source, you can use the existing source for agent discovery. The fields will be prepopulated with the source's information. You can edit these fields to configure a new integration.

## Creating a Service App in Okta

1. Follow the Okta [product documentation](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#create-a-service-app-integration) to create a service app.
2. [Assign admin roles](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#assign-admin-roles-to-the-oauth-2-0-service-app) to the service app.
3. Generate a public/private JSON Web Key Set (JWKS) key pair using the [API](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#generate-the-jwk-using-the-api) or [Admin Console](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#generate-the-jwk-using-the-admin-console).
4. [Grant](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#grant-allowed-scopes) the service app the following mandatory scopes:

- `okta.logs.read`
    - `okta.users.manage`
    - `okta.groups.manage` 
    - `okta.appGrants.read` 
    - `okta.apiTokens.read`

Refer to the Okta [connector documentation](https://documentation.sailpoint.com/connectors/saas/okta/help/saas_connectivity/okta/required_permissions.html) for information on additional scopes that can be added.

5. [Create and sign](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#create-and-sign-the-jwt) the JWT.

## Connecting Okta to Agentic Fabric

1. Go to the **Connect Source** step of the Agentic Fabric onboarding experience.
2. Select **Okta SaaS** from the left pane.
3. In the **Okta SaaS** section, complete the following:

- In the **Source Name** field, enter a unique name for the source.

- In the **Source Owner** field, select the identity who will own the source.

- In the **Description** field, enter a unique description for the source to distinguish it from similar connections.

4. In the **Configure Authentication** section, complete the following:

- In the **Okta URL** field, enter the URL your organization uses to access Okta (`https://{yourOktaDomain}.com`).
    - In the **OAuth 2.0 Token URL** field, enter `https://{yourOktaDomain}/oauth2/v1/token`.
    - In the **Scope** field, enter the scopes granted to the service app. Each scope must be provided as a space-separated value.
    - In the **JWT Header** field, enter the JWT header that has the algorithm being used for signing the JWT assertion.
    - In the **Client ID** field, enter the client ID of the OAuth 2.0 service app you created. This is used as both the Issuer and Subject of the JWT, while the Audience is set automatically to the OAuth 2.0 token URL.
    - In the **Private Key** field, enter the private key text in PEM format.

!!! note

If your private key was originally provided in JWK format, convert it to PEM format before entering it.

- In the **Private Key Password** field, enter the private key password.

5. Select **Test Connection** to ensure the connection is successful.

6. If the test is successful, select **Aggregate** to run an aggregation for the source. Select **Exit** to skip this step. You can configure aggregations for the source's [datasets](../../../sources/datasets.md#configuring-dataset-aggregations) later in the source's configuration. For information about datasets specific to Okta, refer to the Okta [connector documentation](https://documentation.sailpoint.com/connectors/saas/okta/help/saas_connectivity/okta/datasets.html).

A **Completed** status is now displayed next to the source in the left panel.

7. Choose another connector to configure or select **Continue** to proceed to the next onboarding step.

Configuring the Okta SaaS Connector

To connect Okta to Agentic Fabric, you'll create a service app in Okta. This will allow Agentic Fabric to discover Okta applications and Admin API tokens and aggregate them as non-human identities.

Important

If your organization has already configured an Okta SaaS source, you can use the existing source for agent discovery. The fields will be prepopulated with the source's information. You can edit these fields to configure a new integration.

Creating a Service App in Okta

Follow the Okta product documentation to create a service app.
Assign admin roles to the service app.
Generate a public/private JSON Web Key Set (JWKS) key pair using the API or Admin Console.
Grant the service app the following mandatory scopes:
- okta.logs.read
- okta.users.manage
- okta.groups.manage
- okta.appGrants.read
- okta.apiTokens.read
Refer to the Okta connector documentation for information on additional scopes that can be added.
Create and sign the JWT.

Connecting Okta to Agentic Fabric

Go to the Connect Source step of the Agentic Fabric onboarding experience.
Select Okta SaaS from the left pane.
In the Okta SaaS section, complete the following:
- In the Source Name field, enter a unique name for the source.
- In the Source Owner field, select the identity who will own the source.
- In the Description field, enter a unique description for the source to distinguish it from similar connections.
In the Configure Authentication section, complete the following:
- In the Okta URL field, enter the URL your organization uses to access Okta (https://{yourOktaDomain}.com).
- In the OAuth 2.0 Token URL field, enter https://{yourOktaDomain}/oauth2/v1/token.
- In the Scope field, enter the scopes granted to the service app. Each scope must be provided as a space-separated value.
- In the JWT Header field, enter the JWT header that has the algorithm being used for signing the JWT assertion.
- In the Client ID field, enter the client ID of the OAuth 2.0 service app you created. This is used as both the Issuer and Subject of the JWT, while the Audience is set automatically to the OAuth 2.0 token URL.
- In the Private Key field, enter the private key text in PEM format.
  
  Note
  
  If your private key was originally provided in JWK format, convert it to PEM format before entering it.
- In the Private Key Password field, enter the private key password.
Select Test Connection to ensure the connection is successful.
If the test is successful, select Aggregate to run an aggregation for the source. Select Exit to skip this step. You can configure aggregations for the source's datasets later in the source's configuration. For information about datasets specific to Okta, refer to the Okta connector documentation.

A Completed status is now displayed next to the source in the left panel.
Choose another connector to configure or select Continue to proceed to the next onboarding step.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.