Okta

This article includes information on adding Okta as an integration to sync objects to Oblique. To use Okta as an identity provider to authenticate to Oblique, see Single sign-on.

When you connect an Okta tenant to Oblique, Oblique will automatically sync the tenant’s users and their profile attributes, its groups, and its apps and their assignments.

As you add or remove users, groups, or app assignments in Okta, these changes are automatically synced to Oblique. If connected in read-write mode, Oblique can also change Okta group membership. Oblique doesn’t change Okta app assignments.

You can add multiple Okta tenants to Oblique. These function as separate integrations and are distinguished by their tenant base URI and Okta organization ID.

Supported options

Oblique syncs the following from your Okta tenant. In read-write mode, Oblique can also change Okta group membership.

Okta object	Oblique object	Capability
Users	Users	Read-only
Profile attributes	User attributes	Read-only
Users	Accounts	Read-only
Groups	Resources	Read-only
Apps	Resources	Read-only
Group membership	Entitlements	Read-write
App assignments for users	Entitlements	Read-only
App assignments for groups	Entitlements	Read-only

Oblique also syncs active group rules and group push mappings for apps.

Users

Oblique syncs each user in your Okta directory as an Oblique user.

Oblique uses the following profile attributes from Okta to identify users:

• id
• firstName
• lastName
• email
• secondEmail

Attributes

Oblique syncs the following profile attributes from Okta as user attributes:

• employeeNumber
• userType
• manager
• managerId
• title
• department
• division
• organization
• costCenter
• primaryPhone
• city

Oblique also syncs custom profile attributes with the data type string. Custom profile attributes are attributes defined by your organization in Okta that aren’t part of the default Okta user profile.

Accounts

Oblique also syncs each user in your Okta directory as an Oblique account.

Okta accounts are matched to Oblique users by id.

Account matching

Resources

Oblique syncs the following from Okta as resources:

• Each group in your Okta tenant
• Each app in your Okta tenant

A group deleted in Okta is soft deleted in Oblique.

Oblique reads both individual and group app assignments as entitlements.

The Okta integration doesn’t read information about roles in Okta.

Add Okta integration

Oblique connects to Okta through an API Service Integration, authenticating with OAuth 2.0 client credentials issued by Okta. You can install the integration from the Okta Integration Network in either read-only or read-write mode.

Prerequisites

You must be an admin to add an integration.

To install this integration, you must be an Okta administrator with a administrator role that allows you to install API Service Integrations, such as a Super Administrator.

Requested Okta API scopes

The Oblique app is installed with these scopes:

Okta API scope	What Oblique uses it for
okta.orgs.read	Identify which Okta org the connection belongs to
okta.users.read	Import users and their attributes, status, and last sign-in
okta.groups.manage	Import groups and their memberships, and change their members
okta.apps.read	Import applications and their assignments

A read-only integration requests okta.groups.read instead of okta.groups.manage. The Okta app still has the manage scope, but the access tokens Okta issues to Oblique are limited to read.

Configuration steps

Adding the Okta integration requires adding Oblique as an API Service integration in Okta, and then sharing the generated client ID and secret with Oblique.

You can read more about adding an API service integration in Okta’s documentation.

Install the Oblique app in Okta

In Okta’s Admin Console, navigate to Applications > API Services Integrations:

1. Select Add Integration.
2. Search for and select Oblique. Select Next.
3. Review the requested Okta API scopes. Select Install & Authorize.
4. Copy the client secret that is provided. It will not be shown again. Store this securely. You will need to provide this to Oblique. Select Done.
5. Under Client Credentials, also copy the Okta Domain and Client ID.

Connect the integration in Oblique

1. Navigate to the Integrations page.
2. Select Add integration.
3. Select Okta.
4. Enter your Okta Domain as the Okta domain base URI, such as https://example.okta.com. Enter your Client ID and your Client secret from the installation.
5. Under Connect, select Read-write to let Oblique manage Okta group membership, or Read-only to only use your Okta org as a source, and not as a destination. By default, this is read-write.
6. Select Add integration.

Change Okta integration

You can change the Okta integration’s scopes or its credentials.

Change Okta integration scopes

To change your integration from read-only to read-write, or vice versa, remove the integration and then add it again.

Change Okta integration credentials

You must be an admin to replace an integration's credentials.

If the integration’s credentials expire, are revoked, or need rotating, replace them without removing the integration. From the integration’s detail page:

1. Navigate to the Settings tab.
2. Under Connection, select Replace OAuth client credentials….
3. Paste the new values and select Replace OAuth client credentials.

Oblique uses the new credentials from the next sync. You will still need to revoke the old credentials in Okta.

Manage entitlements

In read-write mode, the Okta integration lets Oblique manage access in your Okta tenant. This is done by updating Okta group membership. An entitlement for an Oblique group or team to an Okta group is flattened and written in Okta as an individual entitlement for each member’s account.

Grant access

Caution

Oblique can’t manage Okta groups for some source types. Native Okta groups (group source type BUILT_IN), like the “Everyone” Okta group, and application groups (group source type APP_GROUP) must be managed in Okta.

Oblique can’t assign users or groups to Okta apps. To give access to an Okta app through Oblique, assign the app to an Okta group in Okta, and grant access to that group in Oblique.

Remove Okta integration

You must be an admin to remove an integration.

To remove an Okta integration, from the integration’s detail page:

1. Navigate to the Settings tab.
2. At the bottom of the page, under Delete integration, select Delete integration….
3. In the confirmation dialog, type the text to confirm, then select Delete integration.

This will immediately stop all syncing and remove all resources from the integration. Access that Oblique granted in Okta stays as it is.

Caution

Removing the integration doesn’t revoke Oblique’s access to Okta. To revoke it, remove the Oblique API Service Integration from your Okta tenant.

Troubleshooting

Adding the integration reports that the domain is already in use

Each Okta tenant can only be connected to an Oblique tenant once. Check the Integrations page for an existing integration with the same domain base URI.

Oblique isn’t writing access to Okta

Verify if you connected Oblique to Okta as a read-only integration. From the integration detail, under Settings, look under Connection, then Permissions.

Change the Okta integration scopes to start writing access changes.

Get help

If a problem isn’t covered here, contact support.