Okta✓ Verified

Okta is a cloud-based IAM platform that offers secure user authentication, SSO, and authorization. It simplifies identity management, access control, and provisioning for organizations. With Okta, businesses can enhance security, streamline user experiences, and enable seamless access to applications and data. It supports multifactor authentication and integrations with various systems, enabling secure digital transformation and centralized identity management. Versions: 8.0.0 P1

Overview

It is recommended that you review the Okta Collector Guide before proceeding with this connector configuration.

Connector Settings

Steps

1. Login to RSA Identity G&L console as System Administrator.
2. Navigate to AFX > Connectors.
3. Click on Create Connector and select the RESTful Web Service connector template.
4. Enter the details as shown below under General tab.
   
   
   
5. Click on the Settings tab and enter the required connection details.
   
   
   
6. Click on Add More Parameters.
7. Enter the details for scope as shown below and click OK.
   
   
   
8. Provide the offline_access okta.users.manage okta.groups.manage in the Scope field.
9. Similarly add another parameter state with value rsagl.
10. Click on Get OAuth 2.0 Access Token and authorize.
11. Click OK.

Supported Verbs

Create an Account

API Reference: https://developer.okta.com/docs/reference/api/users/#create-user-with-password

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Create an Account and configure as shown below.

Command Input Parameters

Parameter Name		Display Name	Mapping	Description
Account	✔️	Account Name	${AccountTemplate.Name}	Unique identifier for the user
LastName	✔️	Last Name	${AccountTemplate.LastName}	Family name of the user
FirstName	✔️	First Name	${AccountTemplate.FirstName}	Given name of the user
Password	✔️ 🔒	Initial Account Password	${AccountTemplate.Password}	Password which is required for login
Email	✔️	Email Address	${AccountTemplate.Email}	Primary email address of user
Activate	✔️	Activate Account Flag	false	Executes activation lifecycle operation when creating the user

🔒 = Encrypted ✔️ = Required

Command Code
Generate SessionToken
Method	POST
Path	api/v1/users?activate=${Activate}
Request Headers
Content-Type	application/json
Accept	application/json
Authorization	Bearer ${Settings.access_token}
Request Body
{ "profile": { "firstName": "${FirstName}", "lastName": "${LastName}", "email": "${Email}", "login": "${Account}" }, "credentials": { "password": { "value": "${Password}" } } }
Status Code
Expression Type	Status Code
Pattern
^[23]\d2$	0
^([45])\d2$	$1
Brief Response
Expression Type	Json Path
Expression	message
Detailed Response
Expression Type	Json Path
Expression
Status Code
Expression Type	Json Path
Expression
Content
Expression Type	Json Path
Expression
Message
Expression Type	Json Path
Expression
Detail
Expression Type	Json Path
Expression

3. Click OK.
4. Run the Test Connector Capabilities to verify the verb.

Add Account to Group

API Reference: https://developer.okta.com/docs/reference/api/groups/#add-user-to-group

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Add Account to Group and configure as shown below.
   The API call does not require a request body nor does it return a response (HTTP/1.1 204 No Content). To fulfill the connector requirements, the body must contain {} and Accept header must be set to */*.

Command Input Parameters

Parameter Name		Display Name	Mapping	Description
AccountId	✔️	Account ID	${Account.External_Id}	Unique identifier for the user
GroupId	✔️	Group ID	${Group.External_Id}	Unique identifier for the group

🔒 = Encrypted ✔️ = Required

Command Code
Generate SessionToken
Method	PUT
Path	api/v1/groups/${Group}/users/${Account}
Request Headers
Content-Type	application/json
Accept	*/*
Authorization	Bearer ${Settings.access_token}
Request Body
{}
Status Code
Expression Type	Status Code
Pattern
^[23]\d2$	0
^([45])\d2$	$1
Brief Response
Expression Type	Json Path
Expression	message
Detailed Response
Expression Type	Json Path
Expression

3. Click OK. 4. Run the Test Connector Capabilities to verify the verb.

Remove Account from Group

API Reference: https://developer.okta.com/docs/reference/api/groups/#remove-user-from-group

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Remove Account from Group and configure as shown below.
   The API call does not require a request body nor does it return a response (HTTP/1.1 204 No Content). To fulfill the connector requirements, the body must contain {} and Accept header must be set to */*.

Command Input Parameters

Parameter Name		Display Name	Mapping	Description
AccountId	✔️	Account ID	${Account.External_Id}	Unique identifier for the user
GroupId	✔️	Group ID	${Group.External_Id}	Unique identifier for the group

🔒 = Encrypted ✔️ = Required

Command Code
Generate SessionToken
Method	DELETE
Path	api/v1/groups/${Group}/users/${Account}
Request Headers
Content-Type	application/json
Accept	*/*
Authorization	Bearer ${Settings.access_token}
Request Body
{}
Status Code
Expression Type	Status Code
Pattern
^[23]\d2$	0
^([45])\d2$	$1
Brief Response
Expression Type	Json Path
Expression	message
Detailed Response
Expression Type	Json Path
Expression

3. Click OK. 4. Run the Test Connector Capabilities to verify the verb.

Disable an Account

API Reference: https://developer.okta.com/docs/reference/api/users/#deactivate-user

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Enable an Account and configure as shown below.
   The API call does not require a request body nor does it return a response (HTTP/1.1 204 No Content). To fulfill the connector requirements, the body must contain {} and Accept header must be set to */*.

Command Input Parameters

Parameter Name		Display Name	Mapping	Description
AccountId	✔️	Account ID	${Account.External_Id}	Unique identifier for the user

🔒 = Encrypted ✔️ = Required

Command Code
Generate SessionToken
Method	POST
Path	api/v1/users/${Account}/lifecycle/deactivate
Request Headers
Content-Type	application/json
Accept	*/*
Authorization	Bearer ${Settings.access_token}
Request Body
{}
Status Code
Expression Type	Status Code
Pattern
^[23]\d2$	0
^([45])\d2$	$1
Brief Response
Expression Type	Status Code
Pattern
SUCCESS	Shouldn't match
SUCCESS	Success
(.*)	Failed ($1)
Detailed Response
Expression Type	Json Path
Expression
Pattern
(.*)	Details: $1

3. Click OK. 4. Run the Test Connector Capabilities to verify the verb.

---

📓 References

• User API Documentation
• OAuth2 Scopes
• OAuth Setup
• Deactivate and delete user accounts