Okta

Okta connects with a domain and an API token rather than an OAuth redirect. Governax then registers an Event Hook in your Okta org for you, so there is no webhook configuration to do by hand.

Before you start#

Creating the API token#

1. 1

   Open your Okta admin console

   Go to Security, then API, then the Tokens tab.

2. 2

   Create a token

   Name it something identifiable, such as Governax, so it is obvious later what it belongs to.

3. 3

   Copy the value immediately

   Okta shows the token once. If you lose it, delete it and create another.

Connecting#

1. 1

   Open the entity's Integrations page and choose Okta

   Confirm you are on the entity that should own this Okta org.

2. 2

   Enter the domain and the token

   There is no redirect to Okta. The form submits directly and the page returns to a connected state on success.

3. 3

   Governax verifies and configures

   The token is encrypted and stored, an Event Hook is created in your Okta org, Okta verifies that hook by calling it, and the initial user snapshot begins. All of this happens inside the one request, so a failure is reported to you rather than discovered later.

The Event Hook Governax creates#

You will see a new Event Hook in your Okta admin console named after your entity. It points at a URL unique to this connection:

https://<governax>/api/webhooks/okta/<connection-id>

Each connection has its own URL and its own authorisation secret, sent by Okta as a header on every delivery. Because the secret is derived per connection, a value captured from one customer cannot be replayed against another. Governax verifies it on every delivery before doing anything with the payload.

Events captured#

Governax subscribes to 24 Okta System Log event types, producing these ledger events:

Not captured: routine authentication and session events. Okta's System Log records every sign-in; recording those in a governance ledger would bury the access changes that matter.

Okta is the connector with the most complete attribution: its events carry login identifiers that are normally email addresses, so both actor and subject are usually populated.

Disconnecting#

Disconnecting deactivates and deletes the Event Hook in your Okta org using the stored token, then marks the connection dead. Nothing is left behind in Okta except the API token itself, which you should delete in the Okta console if you are revoking access properly.

Troubleshooting#

General connector behaviour is covered in Connecting a tool.