On-prem connector for generic databases

Early Access release

The on-prem connector for generic databases provides an out-of-the-box solution for connecting on-premises databases with the Okta Identity Governance platform. This connector uses the Okta Okta On-prem SCIM agent to manage users and entitlements in various database systems. This enhances security and simplifies governance by eliminating the need for custom integrations.

The integration with Okta enables core identity governance capabilities. This includes access request, access certification, user provisioning and de-provisioning, and segregation of duties (SoD) for your on-premises database environments.

This connector supports provisioning and Entitlement Management for Oracle, MySQL, PostgreSQL, IBM Db2 LUW, and Microsoft SQL Server relational database management systems.

System requirements

To install the on-prem connector for generic databases, ensure that your system meets the hardware and software requirements. See System requirements for On-prem Connector - Generic Databases.

Provisioning and entitlement features

This connector supports the following capabilities:

  • Create users: Automatically creates a user in the on-premises database when the user is assigned to the app in Okta.
  • Update users: Syncs any changes made to a user's profile in Okta to the database.
  • Provision/de-provision users: Manages the active or inactive state of user accounts in the database.
  • Manage entitlements: Assigns or removes user entitlements from the database through Okta.
  • Import users and entitlements: Performs manual and scheduled imports of user and entitlement data from the database into Okta.

Before you begin

  • Gather the following information to use a database account with the On-prem Connector:
    • Username for the database account
    • Password for the database account
    • Type of database
    • IP/Domain name
    • Port number
    • Name of the database

Download the JDK and JDBC Packages

  • Download JDK version 21 from a trusted source and upload it to your Linux server.
  • Download the required JDBC driver (for example, Oracle OJDBC) and upload it to your Linux server.

Enable the database connector features

  1. In the Admin Console , go to Settings > Features.
  2. In the Early access section, enable the following options:
    1. On-prem connector for generic databases
    2. OPP Agent with SCIM 2.0 support
    3. Enable the Okta On-Prem SCIM Agent

Configure the on-prem connector for generic databases

After you've installed and configured the necessary components, you can configure the app in your Admin Console.

  1. In the Admin Console, go to Applications and Resources > Applications.

  2. Click Browse App Catalog.
  3. Search for and select On-prem Connector for Generic Databases, and then click Add Integration.
  4. Configure your general settings, and then click Next.
  5. Configure your sign-on options, and then click Done.
  6. Go to the General tab and click Edit in the Entitlement management section.
  7. From the Entitlement management dropdown list, select Enabled.
  8. Click Save. It may take a few moments for the feature to become enabled, after which you can refresh the page to view the Governance tab.
  9. Go to the Provisioning tab. Click Enable provisioning.
  10. Select the Okta On-Prem SCIM Agent that you installed, and click Next.
  11. Click Next.
  12. Enter your database connection details such as username, password, and type.
  13. Click Connect agents.
  14. Define schema and import settings.
  15. Define provisioning actions.
  16. Map app attributes on the Provisioning page.

Define schema and import settings

  1. Go to the Provisioning tab.
  2. Under Integration, select Okta section. Click Edit next to Schema discovery & Import.
  3. For Get Users, select Enabled.
  4. Select SQL Statement or Stored Procedure.
  5. Enter the query or the procedure and the user ID.
  6. For Get All Entitlements, select Enabled.
  7. Under Basic Information, configure the following:
    • Resource Type: The name that Okta uses to identify this entitlement type, for example Roles or Groups.
    • Description (optional): A label to distinguish this entitlement type.
  8. Under Query Configuration, select SQL Statement or Stored Procedure, then enter the SQL statement or stored procedure that retrieves all values for this entitlement type from your database.
  9. Under Field Mapping, enter the following:
    • Entitlement ID: The database column used as a unique identifier for the entitlement.
    • Entitlement Display: The database column used as the entitlement label.
  10. Under Entitlement values per user, select one of the following:
    • Multiple values per user: Users can hold more than one value of this entitlement type at the same time.
    • Single value per user: Each user holds exactly one value of this entitlement type.
  11. To define an additional entitlement type, select Add Another and repeat the previous four steps.
  12. Click Save.
  13. In the Confirm entitlement settings dialog, review the configuration, then select Confirm and Save.
  14. After schema discovery is successful, select Edit next to Schema discovery & Import to configure user-specific queries.
  15. In the User Specific Import section, enable Get Entitlement. For each entitlement type, select SQL Statement or Stored Procedure and enter the SQL statement or stored procedure that retrieves entitlements for a specific user.
  16. Select Save.

Define Incremental Import settings

  1. Go to the Provisioning tab.
  2. Under Integration, select the Database Operations section, and then click Edit next to Schema Discovery & Import.
  3. EnableGet Users.
  4. Select SQL Statement or Stored Procedure.
  5. Enter the query and provide user ID column name.
  6. Optional. In the Account Status Attribute box, enter the name of the status column for the user in your database. Then, enter the value that corresponds to and active status. If you skip this step, Okta treats all users that you import through Incremental Import as active users.
  7. Enable Incremental Import.
  8. Select SQL Statement or Stored Procedure.
  9. To filter for users that were modified after the previous successful import, enter the query, and use a question mark (?) as a placeholder for the last imported time.
  10. In the Database Field box for the placeholder, enter the name of the timestamp column from your database.
  11. In the Timestamp Column box, enter the same timestamp column name.
  12. Click Save.

Database requirements

  • Your database tables must support soft deletion. Incremental Import relies on this history to detect which records changed. Permanently deleting rows instead of marking them as deleted causes Incremental Import to lose track of that history.
  • Each table must include a timestamp column that updates automatically to the current time whenever a row is written or modified. Incremental Import uses this timestamp to identify records that changed since the last import.
  • Your user and entitlement data might reside in separate tables. If so, your database must explicitly update the timestamp on the User table whenever an entitlement configuration changes. Incremental Import can't detect entitlement-only changes unless the User table's timestamp reflects them.
  • The column that your getUser query fetches must match the column after you configure Incremental Import. Don't change the fetched column after you configure Incremental Import, because doing so can cause data loss.
  • Without the Active Status Attribute and its value, Okta doesn't deactivate users, even when a user's status is inactive in your database.

Define provisioning actions

  1. Go to the To App section and click Edit.
  2. Enable your desired provisioning options. For example: Create User, Update User, Deactivate User.
  3. Provide the necessary SQL statements or stored procedures for each operation (for example: INSERT, UPDATE, DELETE).
  4. Map the parameters in your SQL statements or stored procedures to the appropriate user attributes from Okta.
  5. Click Save.