Supported integrations

Integrations connect Oblique with external systems in your organization. Oblique can both pull information from and push access decisions back to integrations.

Supported integrations

Access integrations

Oblique supports the following access integrations, maps their objects to Oblique concepts, and lets you manage access from Oblique where noted. All objects below are synced to Oblique in pull mode (read only), but only those marked can be managed by Oblique in push mode (read/write):

Integration	Object	Maps to	Manage in Oblique
Okta	Users	Users, accounts	❌
	User attributes	User attributes	❌
	Groups	Resources	✅
	Group rules	n/a	❌
	Group membership	Entitlements	✅
	Apps	Resources	❌
	App assignments (individual)	Entitlements	✅
	App assignments (group)	Entitlements	❌
	Push groups	n/a	❌
Google	Users	Users, accounts	❌
	Groups	Resources	✅
	Group membership	Entitlements	✅
	OAuth apps	n/A	❌
GitHub	Members	Accounts	❌
	Teams	Resources	❌
	Team membership	Entitlements	❌
Slack	Members	Accounts	❌

Notification integrations

Oblique supports sending notifications in the following ways:

• Slack. Oblique has a Slack app that can be used to send notifications about requests made in Oblique, and approve requests made in Oblique from Slack.

Supported attributes

Attributes help match users from different systems, identify users on their profiles, and create attribute-based groups.

Attributes cannot be edited in Oblique. To update an attribute, update it in the integration it is from.

Oblique currently supports the following user attributes:

Attribute	Required	Supported sources	Can be used for attribute-based groups
First name	Yes	Okta (firstName), Google	No
Last name	Yes	Okta (lastName), Google	No
Email	Yes	Okta (email), Google	No
Secondary email	No	Okta (secondEmail)	No
UUID	Yes	Okta (id)	Yes
Employee number	No	Okta (employeeNumber)	Yes
User type	No	Okta (userType)	Yes
Manager	No	Okta (manager)	Yes
Manager ID	No	Okta (managerId)	Yes
Title	No	Okta (title)	Yes
Department	No	Okta (department)	Yes
Division	No	Okta (division)	Yes
Organization	No	Okta (organization)	Yes
Cost center	No	Okta (costCenter)	Yes
Phone	No	Okta (primaryPhone)	Yes
City	No	Okta (city)	Yes

Core attributes

User profiles show information about all user attributes. Certain attributes are used are displayed as part of the user profile, including name, email, manager, and title.

Oblique currently supports the following core attributes and source integrations:

Core attribute	Supported sources
Title	Okta (title)
Manager	Okta (managerId or manager)

By default, Oblique uses the first integration you connect that provides each core attribute. The source integration for a core attribute can be changed.

Manager

Oblique syncs both the managerId and manager user attributes from Okta. If the managerId is an Okta userId, it will be used as the core attribute for manager. Otherwise, if the manager attribute is an email, it is used instead.

Change source integration for core attributeChange the integration used as the source for a core attribute.

Custom Okta user attributes

Custom user attributes are attributes defined by your organization in Okta ↗ that are not part of the default Okta user profile attributes.

For an Okta integration, Oblique automatically detects, imports and syncs custom user attributes from Okta that have the data type string. Oblique does not currently support custom user attributes with other data types. These custom user attributes are included on a user’s profile and can be used for creating attribute-based groups.

Admins can filter out users from the sync by adding rules to ignore users by attribute. Both profile and custom attributes are supported.

1. Navigate to the Integrations page.
2. Select the Okta integration.
3. Select Settings.
4. Under Ignore users by attribute, add a rule to ignore users by attribute key and value (for example: email and user@example.com).
5. Select Save.

Any user that matches any of the rules will be ignored during the sync. A previously synced user that matches the rule will not be synced, but will remain in Oblique.

Profile photo

User profiles include a profile photo. Oblique will use the profile photo from the identity provider from which the user authenticated to Oblique. It cannot be changed in Oblique, and must be edited in the identity provider.

Using attributes

Attribute matching

Oblique uses attributes to uniquely match users imported from different systems.

Both email addresses and user IDs are used to match users:

• When a match is found with new email addresses, those emails are added as secondary emails to the existing user profile.
• If a user ID matches but emails differ, Oblique treats them as the same user and adds the new emails.
• If neither emails nor ID match any existing user, Oblique creates a new user profile.

Attribute visibility on user profiles

User attributes on profile pages are only visible to the user themselves and to Oblique admins. Other users, including managers, cannot see them.

Caution

Attribute-based groups, their rules, and their membership are visible to all users, so any user can see which users meet the criteria for each group.

Attribute-based groups

Attributes can be used to create attribute-based groups. This helps create groups of users that share a common attribute, such as all users in the same department.

Create an attribute-based groupLearn more about creating attribute-based groups.

Accounts

Accounts correspond to subjects in integrations. These are matched to users in Oblique, so that the entitlements attached to that account count as access held by that user.

Accounts cannot be edited in Oblique. To update an account, update it in the integration it is from.

Account matching

Oblique uses email address to uniquely match accounts imported from integrations to users in Oblique. Matching is sticky, so that if the account’s email later changes, the account remains matched to the user.

A user can have more than one account matched to them in an integration, for example someone who is in the organization with both a work and a personal account. Since synced entitlements are account-level, a user can also have multiple entitlements for the same team through different accounts.

Syncing

Oblique syncs user and group membership changes within minutes. Other changes may sync less frequently due to external API rate limits. For example, in a large Okta instance, external changes to apps assignments may take hours to reflect in Oblique.