This connector integrates with Okta for AWS federation through Okta groups. It’s useful for organizations that use the SAML to AWS app config in Okta, wherein Okta mints a SAML cert with correct group memberships to drive IAM roles for the federated user.

Capabilities

• Sync user identities from Okta to ConductorOne

• Promote identities from application users to ConductorOne users

• Resources supported:

  • Application assignments for the configured AWS Okta app
  • Groups assigned to the AWS app

• Provisioning supported:

  • AWS app group membership

Depending on the permissions of the Okta API token, ConductorOne has different functionality that it can provide. See the next section for more information.

API token permissions and ConductorOne capabilities

ConductorOne’s capabilities depend on the permissions of the API token used to set up the connector:

Add a new Okta AWS Federation connector

This task requires either the Connector Administrator or Super Administrator role in ConductorOne.

1. In ConductorOne, click Connectors > Add connector.

2. Search for Okta AWS Federation and click Add.

3. Choose how to set up the new Okta AWS Federation connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   A Okta AWS Federation connector owner must have the following permissions:

   • Connector Administrator or Super Administrator role in ConductorOne
   • Read Only Admin or Super Admin role in Okta

5. Click Next.

Next steps

• If you are the connector owner, proceed to Configure your Okta AWS Federation connector for instructions on integrating Okta AWS Federation with ConductorOne.

• If someone else is the connector owner, ConductorOne will notify them by email that their help is needed to complete the setup process.

Configure your Okta AWS Federation connector

A user with the Connector Administrator or Super Administrator role in ConductorOne and Read Only Admin or Super Admin role in Okta AWS Federation must perform this task.

You can skip Steps 1 and 2 and proceed to Step 3 if you already have an API token generated with Super Admin, Read Only Admin or a combination of Read Only/App Admin/Group Admin privileges. To learn more about Okta roles, visit https://help.okta.com/en/prod/Content/Topics/Security/administrators-admin-comparison.htm

(Optional) Step 1: Create a service account for the API token

If desired, you can create a service account user in Okta that has the permissions for the API token.

1. Navigate to Directory > People and click Add person.

   

2. Enter the necessary user details to create a user. You might want to use identifiers that make it easily recognizable as a service account, such as First Name: ReadOnly, Last Name: ServiceUser.

3. Set the Password for the account and store it securely in a vault.

   

4. Navigate to Security > Administrator and click Add administrator.

   

5. Enter the email address for your newly created Service Account to select the user.

6. Select the administrator roles to grant: Read Only Admin, Super Administrator, or a combination of Read Only + Application Admin + Group Admin.

   

7. Click Add Administrator.

Step 2: Create an API token

When creating an API token, Okta assigns the permissions of the currently logged-in user to the token. If, for example, you wish to use a Read Only Admin-scoped API token, you must log in to Okta as a user with the Read Only Admin role assigned.

1. Log into Okta with the account you’ll use to generate the API token. The account must have Read Only Administrator, Super Administrator, or a combination of Read Only/App Admin/Group Admin privileges. The permissions on the API token affects what features and functionality are available from ConductorOne. Before you begin, review the chart in API permissions and ConductorOne capabilities to make sure you’re creating a token with the right permissions for your needs.

2. In the Okta console, navigate to Security > API and click Tokens.

   

3. Click Create Token.

4. Give your token a name, such as ConductorOne, and click Create Token.

5. Copy and save the new API token.

Step 3: Add your Okta AWS Federation credentials to ConductorOne

1. In ConductorOne, navigate to the Okta AWS Federation connector by either:

   • Clicking the Set up connector link in the email you received about configuring the connector.

   • Navigate to Connectors > Okta AWS Federation (if there is more than one Okta AWS Federation listed, click the one with your name listed as owner and the status Not connected).

2. Find the Settings area of the page and click Edit.

3. Enter your Okta domain (the URL of your Okta instance is <YOUR DOMAIN>.okta.com) into the Okta domain field.

4. Paste your API token into the API token field.

5. Paste the ID of the AWS app in Okta into the AWS Okta app ID field.

6. Click Save.

7. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Okta AWS Federation connector is now pulling access data into ConductorOne.