Okta

Connect Okta to Trustle to get insight into over-privileged accounts and unused accounts, and to adopt just-in-time access management.

Prerequisites

• An Okta account with the Super Admin role. Only Super Admins can grant API scopes to an app.
• Access to the Okta Admin Console.

Configure Okta

Step 1: Create an App Integration

1. From the Admin Console, select Applications, then Applications again from the left menu.

   

2. Click Create App Integration.

   

3. Choose the API Services option and click Next.

   

4. Give the app integration a name and click Next.

5. Okta opens the app integration configuration page.

Step 2: Generate a Private Key

1. On the app integration configuration page, select the General tab.
2. In the Client Credentials section, click Edit.
3. Under Client Authentication, select Public Key / Private Key.
4. In the Public Keys section, click Add Key.
5. In the Add a public key dialog, click Generate New Key.
6. Select For client authentication (sig) from the dropdown.
7. Copy the private key immediately in JSON format (JWK). Okta shows it only once and does not store it. Copy the entire JSON object, not the PEM format.
8. Store the private key securely. You need it in Step 4.
9. Click Done.
10. Click Save on the General tab.

Step 3: Grant the Application Okta API Scopes

1. On the app integration configuration page, select the Okta API Scopes tab.
2. Grant the following scopes to the application:
   • okta.groups.read
   • okta.groups.manage
   • okta.users.read
   • okta.users.manage
3. Return to the General tab and note the Client ID and your Okta Domain. Find the domain in the URL. It typically looks like organization.okta.com.

Note

Only users with the Super Admin role can grant scopes to an app. If you do not have Super Admin permissions, contact your Okta administrator.

Step 4: Collect Credentials

Collect these values from the app integration configuration page:

• Organization URL: the URL in your browser’s address bar when you are logged into the Okta Admin Console, for example https://your-org.okta.com. Include the https:// prefix.
• Client ID: on the General tab, in the Client Credentials section.
• Private Key: the private key you copied in Step 2, in JSON format. Trustle uses the private key, not the client secret, to authenticate.

Connect in Trustle

1. Go to the Connections page in Trustle from the left menu.
2. Under Identity Providers, find the Okta logo and choose Connect.
3. Fill in the connection form:
   1. Connection Name: enter a descriptive name, for example My Okta Connection.
   2. Description: optional. Enter a description.
   3. Org URL: paste the organization URL you collected.
   4. Client ID: paste the client ID you collected.
   5. Private Key: paste the private key you collected, in JSON format.
4. If you want to use Okta as your Trustle identity provider, check Use as Identity Provider.
5. Click Test Connection.
6. After the test succeeds, click Save Connection.