This is an updated and improved version of the Okta connector! If you’re setting up Okta with ConductorOne for the first time, you’re in the right place.

Capabilities

Syncing standard and custom org roles requires a super admin token.

Available hosting methods

Choose the hosting method that best suits your needs:

Gather Okta credentials

Each setup method requires you to pass in credentials generated in Okta. Gather these credentials before you move on.

API token permissions and ConductorOne capabilities

ConductorOne’s capabilities depend on the permissions of the API token used to set up the connector:

Instead of generating a new API token, you can use an existing API token generated with Super Admin, Read Only Admin or a combination of Read Only/App Admin/Group Admin privileges. To learn more about Okta roles, visit https://help.okta.com/en/prod/Content/Topics/Security/administrators-admin-comparison.htm

(Optional) Create a service account for the API token

A user with the Read Only Admin or Super Admin role in Okta must perform this task.

If desired, you can create a service account user in Okta that has the permissions for the API token.

1. Navigate to Directory > People and click Add person.

   

2. Enter the necessary user details to create a user. You might want to use identifiers that make it easily recognizable as a service account, such as First Name: ReadOnly, Last Name: ServiceUser.

3. Set the Password for the account and store it securely in a vault.

   

4. Navigate to Security > Administrator and click Add administrator.

   

5. Enter the email address for your newly created Service Account to select the user.

6. Select the administrator roles to grant: Read Only Admin, Super Administrator, or a combination of Read Only + Application Admin + Group Admin.

   

7. Click Add Administrator.

Create an API token

When creating an API token, Okta assigns the permissions of the currently logged-in user to the token. If, for example, you wish to use a Read Only Admin-scoped API token, you must log in to Okta as a user with the Read Only Admin role assigned.

1. Log into Okta with the account you’ll use to generate the API token. The account must have Read Only Administrator, Super Administrator, or a combination of Read Only/App Admin/Group Admin privileges. The permissions on the API token affects what features and functionality are available from ConductorOne. Before you begin, review the chart in API permissions and ConductorOne capabilities to make sure you’re creating a token with the right permissions for your needs.

2. In the Okta console, navigate to Security > API and click Tokens.

   

3. Click Create Token.

4. Give your token a name, such as ConductorOne, and click Create Token.

5. Copy and save the new API token.

That’s it! Next, move on to the instructions for your chosen setup method.

Set up an Okta cloud-hosted connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in ConductorOne
• Access to the set of Okta credentials generated by following the instructions above

1. In ConductorOne, click Connectors > Add connector.

2. Search for Okta v2 and click Add.

3. Choose how to set up the new Okta connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter your Okta domain (the URL of your Okta instance is <YOUR DOMAIN>.okta.com) into the Okta domain field.

8. Paste your API token into the API token field.

9. Optional. If desired, click the checkbox to Sync custom roles.

10. Optional. If desired, click the checkbox to Skip secondary emails when syncing user information.

11. Click Save.

12. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Okta connector is now pulling access data into ConductorOne.

Set up an Okta cloud-hosted connector using Terraform

As an alternative to the cloud-hosted setup process described above, you can use Terraform to configure the integration between Okta and ConductorOne.

See the ConductorOne Okta v2 integration resource page in the ConductorOne Terraform registry for example usage and the full list of required and optional parameters.

Set up an Okta self-hosted connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in ConductorOne
• Access to the set of Okta credentials generated by following the instructions above

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals. This data is immediately available in the ConductorOne UI for access reviews and access requests.

Why use Kubernetes? Kubernetes provides automated deployment, scaling, and management of your connectors. It ensures high availability and reliable operation of your connector services.

Step 1: Configure the Okta connector

1. In ConductorOne, navigate to Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Okta connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Okta connector deployment:

Secrets configuration

# baton-okta-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-okta-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>
  
  # Okta credentials
  BATON_API_TOKEN: <Okta API token>
  BATON_DOMAIN: <Your Okta domain>

  # Optional: include if you want ConductorOne to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-okta.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-okta
  labels:
    app: baton-okta
spec:
  selector:
    matchLabels:
      app: baton-okta
  template:
    metadata:
      labels:
        app: baton-okta
        baton: true
        baton-app: okta
    spec:
      containers:
      - name: baton-okta
        image: ghcr.io/conductorone/baton-okta:latest
        args: ["service"]
        imagePullPolicy: IfNotPresent
        envFrom:
        - secretRef:
            name: baton-okta-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run ConductorOne connectors (if desired):

   kubectl create namespace baton-okta
   

2. Apply the secret configuration:

   kubectl -n baton-okta apply -f baton-okta-secrets.yaml
   

3. Apply the deployment:

   kubectl -n baton-okta apply -f baton-okta.yaml
   

Step 4: Verify the deployment

1. Check that the deployment is running:

   kubectl -n c1 get pods
   

2. View the connector logs:

   kubectl -n c1 logs -l app=baton-${baton-okta}
   

3. Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Okta connector to. Okta data should be found on the Entitlements and Accounts tabs.

That’s it! Your Okta connector is now pulling access data into ConductorOne.

What’s next?

If Okta is your company’s identity provider (meaning that it is used to SSO into other software), the connector sync will automatically create applications in ConductorOne for all of your SCIMed software. Before you move on, review the Create applications page for important information about how to set up connectors for the SCIMed apps.