Skip to main content

Okta✓ Verified

· 13 min read
Pradeep Kadambar
Pradeep Kadambar
Creator
Okta is a cloud-based IAM platform that offers secure user authentication, SSO, and authorization. It simplifies identity management, access control, and provisioning for organizations. With Okta, businesses can enhance security, streamline user experiences, and enable seamless access to applications and data. It supports multifactor authentication and integrations with various systems, enabling secure digital transformation and centralized identity management.

Identities ❌ | Accounts ✔️ | Groups ✔️ | App Roles ✔️ | Entitlements ❌

Users - Okta allows you to create and manage user accounts, including attributes like name, email, and profile information. Users can be assigned to various groups and roles.

Groups - Okta enables the creation of groups to organize users based on common attributes or roles. Groups help streamline user management and permissions assignment.

Group Members - Okta allows you to add users as members of specific groups. This helps control access to resources and streamline user provisioning and management.

Roles - Okta supports the definition and assignment of roles. Roles represent a collection of permissions or access privileges that can be granted to users or groups.

Role Members - Okta enables the assignment of users or groups as members of specific roles. This allows for fine-grained access control and authorization based on role-based permissions.

Application​

Steps

  1. Login to RSA G&L console as System Administrator.
  2. Navigate to Resources > Application.
  3. Click on Create Application and select Other Application.
  4. Enter the details as shown below.
    img
  5. Click Finish.

Account Collector​

This section explains the process for configuring an account collector for the Okta application. We will use the RSA G&L Generic REST collector for this purpose.

Steps

  1. Login to RSA G&L console as System Administrator.
  2. Navigate to Resources > Applications.
  3. Click on Okta.
  4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.

    img
  5. Click Next and enter the connection details.

    img
  6. Click Next. Select the data types that the collector will be collecting from Okta

    img
  7. Click Next. On the Account Data page, enter the following configurations.

    Alt text

    Alt text

    Alt text

Pagination

Okta uses RFC-8288 (Web Linking) based Pagination model.

Account Status Filter Options

For use with filter query parameter in the API call below.

Account StatusDescription
ACTIVEThis status indicates that the user account is currently active and can access resources within the system.
PROVISIONEDUsers with this status have been provisioned into the system but may not have completed their activation process. They typically need to perform additional steps to fully activate their account.
PASSWORD_EXPIREDUsers with this status typically need to reset their password before they can log in again. Their current password has expired, and they must create a new one to regain access.
SUSPENDEDSuspended users have had their access temporarily revoked. They cannot log in or access resources until their suspension is lifted.
LOCKED_OUTThis status indicates that the user's account has been locked due to multiple failed login attempts. Locked-out users cannot log in until their account is unlocked by an administrator or until a certain amount of time has passed.
Request
MethodGET
URL/api/v1/users
Query Parameters
filterstatus eq "ACTIVE" (Optional)
Request Headers
Acceptapplication/json
AuthorizationSSWS ${AuthenticationToken} (if using Okta-propriety SSWS API token authentication scheme)

Bearer ${AuthenticationToken} (if using OAuth2 authentication scheme)
Response Mappings
AccountId$.*.profile.login
Id$.*.id
Status$.*.status
LastLogin$.*.lastLogin
EmployeeNumber$.*.profile.employeeNumber
StatusChanged$.*.statusChanged
Email$.*.profile.email

  1. Click Next. On the Group Data page, enter the following configurations.

    Alt text

    Alt text


    Alt text

Group Type Options

For use with filter query parameter in the API call below.

Group TypeDescription
OKTA_GROUPGroup Profile and memberships are directly managed in Okta via static assignments or indirectly through Group rules.
APP_GROUPGroup Profile and memberships are imported and must be managed within the application that imported the Group. Active Directory and LDAP Groups also have APP_GROUP type.
BUILT_INGroup Profile and memberships are managed by Okta and can't be modified.
Request
MethodGET
URL/api/v1/groups
Query Parameters
filtertype eq "OKTA_GROUP" (Optional)
Request Headers
Acceptapplication/json
AuthorizationSSWS ${AuthenticationToken} (if using Okta-propriety SSWS API token authentication scheme)

Bearer ${AuthenticationToken} (if using OAuth2 authentication scheme)
Response Mappings
GroupId$.*.profile.name
Id$.*.id
Description$.*.profile.description
Type$.*.type
  1. Click Next. On the Account Group Membership page, enter the following configurations.

    Alt text

    Alt text

    Alt text

Request
MethodGET
URL/api/v1/groups/${Id}/users
Request Headers
Acceptapplication/json
AuthorizationSSWS ${AuthenticationToken} (if using Okta-propriety SSWS API token authentication scheme)

Bearer ${AuthenticationToken} (if using OAuth2 authentication scheme)
Response Mappings
AccountId$.*.profile.login
  1. Click Next. In the Map Collector Attributes to Account Attributes, map the collected account attributes.

    Alt text
  2. Click Next. In the Map Collector Attributes to Group Attributes, map the collected group attributes.

    Alt text
  3. Click Next. In the Map Collector Attributes to Group Attributes, map the collected group attributes.

    Alt text
  4. Click Next. In the User Resolution Rules, map the user to account.

    Alt text
  5. Click Next. In the Member Account Resolution Rules, map the account attribute.

    Alt text
  6. Click Finish. Use the Test function to make sure the configurations are accurate.

Entitlement Collector​

This section explains the process for configuring an entitlement collector to collect applications from Okta. We will use the RSA G&L Generic REST collector for this purpose.

Steps

  1. Login to RSA G&L console as AveksaAdmin.
  2. Navigate to Resources > Applications.
  3. Click on Okta.
  4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.

    Alt text
  5. Click Next and enter the connection details as shown in Step 5 of Account Collector.
  6. Click Next. Select the data types that the collector will be collecting from Okta.

    Alt text
  7. Click Next. On the App Role Data page, enter the following configurations.

    Alt text

    Alt text

Request
MethodGET
URL/api/v1/apps
Request Headers
Acceptapplication/json
AuthorizationSSWS ${AuthenticationToken} (if using Okta-propriety SSWS API token authentication scheme)

Bearer ${AuthenticationToken} (if using OAuth2 authentication scheme)
Response Mappings
ApplicationRoleId$.*.label
Id$.*.id
Name$.*.name
Status$.*.status
  1. Click Next. On the App-Role Account Membership collection page, enter the following configurations.

    Alt text

    Alt text

Request
MethodGET
URL/api/v1/apps/${Id}/users
Request Headers
Acceptapplication/json
AuthorizationSSWS ${AuthenticationToken} (if using Okta-propriety SSWS API token authentication scheme)

Bearer ${AuthenticationToken} (if using OAuth2 authentication scheme)
Response Mappings
Account Identifier$.*.id
  1. Click Next. On the App-Role Group Membership collection page, enter the following configurations.

    Alt text

    Alt text

Request
MethodGET
URL/api/v1/apps/${Id}/groups
Request Headers
Acceptapplication/json
AuthorizationSSWS ${AuthenticationToken} (if using Okta-propriety SSWS API token authentication scheme)

Bearer ${AuthenticationToken} (if using OAuth2 authentication scheme)
Response Mappings
Group Identifier$.value.*.memberName
  1. Click Next. In the Map Collector Attributes to App Role Attributes, map the collected account attributes.
  2. Click Next. In the Account Evaluation, map the account collector to account value.

    Alt text
  3. Click Next. In the Group Evaluation, map the account collector to group value.

    Alt text
  4. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

Authentication​

Token​

This section explains the process of setting up RSA G&L ADC with token authentication.

Steps

  1. Login to RSA G&L console as System Administrator.
  2. Create or Edit a generic REST ADC/EDC that will be using Token authentication.
  3. On the Connection Details page, configure the following.
    Alt text
  4. Save the collector configuration. Use the Test function to make sure the configurations are accurate.

OAuth2​

This section explains the process of setting up RSA G&L ADC and EDC to acquire the OAuth2 token dynamically from Okta.

Steps

  1. Login to RSA G&L console as System Administrator.
  2. Create or Edit a generic REST ADC/EDC that will be using OAuth2 authentication.
  3. On the Connection Details page, configure the following.

    Alt text
Request
Client IDCLIENT_ID
Client SecretCLIENT_SECRET
Authentication URLhttps://instance.okta.com/oauth2/v1/authorize
Access Token URLhttps://instance.okta.com/oauth2/v1/token
Scopeoffline_access - Requests a refresh token used to obtain more access tokens.
okta.users.read - Allows the app to read the existing users' profiles and credentials.
okta.roles.read - Allows the app to read administrative role assignments for users.
okta.groups.read - Allows the app to read information about groups and their members.

&state=rsagl must be added at the end of the scope
  1. Click on Get OAuth 2.0 Access Token.
  2. Click on Proceed For Authorization.

    Alt text
  3. Login to Okta account.

    Alt text
  4. The below message indicates that RSA G&L has successfully acquired a token.

    Alt text
  5. Click Close.
  6. Save the collector configuration. Use the Test function to make sure the configurations are accurate.

Application Setup​

This section explains the process of setting up a service account in Okta for use within the collections process.

Steps

  1. Login to Okta dashboard, https://instance.okta.com/admin/dashboard.
  2. From the main menu, navigate to Security > API. 
  3. Under Tokens tab, click on Create token button.
    Alt text
  4. Provide a suitable name and click Create token.
    Alt text
  5. Copy the token and retain it for use with G&L.
    Alt text
  6. Click OK.

References​

COL011