Okta

Trustle reads users, groups, group members, and the apps each user can open from Okta. Trustle can add and remove group members, deactivate users, and remove app assignments.

Prerequisites

• An Okta account with the Super Admin role. Only a Super Admin can grant API scopes to an app.

Configure Okta

Step 1: Create an API Services app

1. In the Okta Admin Console, go to Applications → Applications.

   

2. Click Create App Integration.

   

3. Select API Services. Click Next.

   

4. Enter a name, for example Trustle. Click Save.

Step 2: Generate a private key

1. On the app page, select the General tab.
2. In Client Credentials, click Edit.
3. In Client Authentication, select Public Key / Private Key.
4. In Public Keys, click Add Key, then Generate New Key.
5. Select For client authentication (sig).
6. Copy the private key in JSON format, not PEM. The Trustle form asks for JSON. Copy the whole object, from { to }.
7. Click Done. Then click Save.

Caution

Okta shows the private key once. If you lose it, generate a new key pair.

Step 3: Grant permissions

1. Select the Okta API Scopes tab.

2. Click Grant for each scope you need:

   Permission	Required	What Trustle does with it
   okta.users.read	Yes	Imports users and the apps they gave access to.
   okta.users.manage	Yes	Deactivates users and removes app access that a user gave.
   okta.groups.read	Yes	Imports groups and their members.
   okta.groups.manage	Yes	Adds people to groups and removes them.
   okta.apps.read	Optional	Shows every app assigned to a user. Without it, Trustle shows only apps the user consented to.
   okta.logs.read	Optional	Shows the date each user last opened each app. Without it, the date stays empty.
   okta.apps.manage	Optional	Removes apps assigned directly to a user. Without it, Trustle can remove only apps that come from a group.

Step 4: Assign an admin role

Scopes tell Okta which API calls the app can make. An admin role tells Okta which data the app can see. The app needs both.

1. Select the Admin roles tab. Click Edit assignments.

2. Select the role for what you want Trustle to do:

   Role	What Trustle can do
   Read-Only Administrator	Import users, groups, and assigned apps.
   Group Administrator	Also add and remove group members, and deactivate users in those groups.
   Application Administrator	Also remove apps assigned directly to a user.

3. Click Save Changes.

Step 5: Collect the values for Trustle

Trustle field	Where to find it in Okta	Example
Org URL	The Admin Console address without -admin	https://your-org.okta.com
Client ID	General tab → Client Credentials	0oa1b2c3d4e5f6g7h8i9
Private Key (JWK)	The JSON key from Step 2	{"kty":"RSA", …}

Connect in Trustle

1. In Trustle, go to Connections.
2. Under Identity Providers, find Okta and click Connect.
3. Enter a Connection Name, for example Okta production. Description is optional.
4. Enter the values from Step 5.
5. Select Use as Identity Provider if Okta is the source of your users. Trustle allows one identity provider at a time.
6. Click Test Connection.
7. After the test passes, click Save Connection.

Note

Test Connection checks that Trustle can sign in. It does not check every permission. Do the steps in Verify after the first sync.

Verify

1. On the Connections page, open the Okta connection.
2. Wait for the first sync to finish.
3. Check that the user count matches the number of users in Okta.

If something is missing, see Troubleshooting.

Security notes

Note

• Use a dedicated app integration for Trustle only.
• Grant only the scopes and the admin role for the features you use.
• Store the private key in a secret manager. Never commit it to a repository.
• Rotate the key pair on your normal schedule. Then paste the new private key into the Trustle connection.

Troubleshooting

Test Connection fails

• Org URL: use https://your-org.okta.com. Do not use the -admin address. Do not add a slash or a path at the end.
• Client ID: it must match the Client ID on the General tab.
• Private Key (JWK): paste the whole JSON key, from { to }.
• Scopes: if the error says consent_required, the app is missing one of the four required scopes. Okta then refuses all four. Grant them in Step 3.

Test Connection passes, but the sync imports no users or fails with E0000006

The app has scopes but no admin role. Okta then returns an empty user list, so Test Connection passes. Other calls, such as the group list, fail with 403 and E0000006 (“You do not have permission to perform the requested action”).

Do Step 4. Then run the sync again.

Assigned apps or last-used dates are missing

• Assigned apps: grant okta.apps.read. The admin role must include apps. Read-Only Administrator does.
• Last-used dates: grant okta.logs.read.

Trustle shows the data after the next sync.

Trustle cannot remove an app

Grant okta.apps.manage. Then assign an admin role that can manage apps, for example Application Administrator. Access that comes from a group does not need this. Trustle removes the user from the group instead.

Trustle cannot deactivate a user

The admin role cannot manage that user. Assign a role that can deactivate users, for example Group Administrator for the groups that contain the user.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the Org URL and the Client ID. Never send a secret, key, or token.