Integrate Okta Org2Org with Okta

There are two ways to secure the provisioning connection for the Org2Org spoke to hub org model:

  • With OAuth 2.0: You can configure the connection between orgs with OAuth 2.0 by using the Okta API. See Securing API connections between orgs with OAuth 2.0 for instructions.

  • With an API token: The following steps to integrate the Okta Org2Org for provisioning uses an API token to secure the org to org connection.

    Okta Super Admin permissions are required to create the API token. If you do not have Okta Super Admin permissions, you can't define the provisioning settings.

This procedure assumes the Okta Org2Org app is being installed on the Okta connected org. A connected org is an org that is connected to a central Okta org. You can use Okta Org2Org to connect multiple orgs to a central Okta org. This methodology is also known as hub and spoke. The hub is the central Okta org and each connected org is a spoke.

  1. If you haven't added the Okta Org2Org app to the connected Okta org, add it now:

    1. In the Admin Console, go to ApplicationsApplications.

    2. Click Add Application.
    3. In the search field, enter Org2Org, and select Okta Org2Org.
    4. Click Add.
    5. Complete the fields on the General Settings page and click Next.
    6. In the Sign on methods section of the Sign-On Options pane, select a sign on option.
    7. Click Done.
    8. If you selected SAML 2.0 as your sign on method, click the Sign On tab, click View SAML setup Instructions and follow the instructions to complete the set up.
  2. Create the API token on the central Okta org:
    1. In the Admin Console, go to Security > API.
    2. Click the Tokens tab and click Create Token.
    3. Enter a descriptive name for the token and click Create Token.
    4. Copy the token value to your clipboard or a text editor.
    5. Click OK, got it.

  3. In the Admin Console, go to ApplicationsApplications.

  4. Select Okta Org2Org from the list of applications.
  5. Click the Provisioning tab, click Configure API Integration, and select the Enable API Integration check box.
  6. Complete these fields:
    • Security token: Paste the security token you copied in step 2 d.
    • Prefer Username Over Email: Optional. Select this option if you don't want to use an email address as the username.
    • Import Groups: Optional. Clear the check box if you do not want to import groups from the connected org.
  7. Optional. Click Test API Credentials to test the API integration.
  8. Click Save.

  9. Optional. Change the provisioning settings from the central Okta org to the connected org:

    1. Click the Provisioning tab and select To App in the SETTINGS list.
    2. Click Edit.
    3. Select the Create Users, Update User Attributes, Deactivate Users, or Sync Password check boxes to enable the functionality.
    1. Click Save.
  10. Optional. Change the provisioning settings from the connected org to the central Okta org:
    1. Click the Provisioning tab and select To Okta in the SETTINGS list.
    2. Click Edit in the General, User Creation & Matching, Profile & Lifecycle Sourcing, or Import Safeguard areas to edit the settings.

      3. When you select Allow Okta Org2Org to source Okta users in the Profile & Lifecycle Sourcing area, the connected org is the source for user profile data. When you import Okta users into your connected org, updates made to user properties in the connected org are applied to other apps that the user is assigned.

    1. Click Save.
  11. Optional. Assign users or groups to the connected Okta Org2Org app:
    1. Click the Assignments tab, click Assign, and select Assign to People or Assign to Groups.
    2. Click Assign next to the user or group name or enter the user or group name in the search field and click Assign.
    3. Complete the mandatory and optional fields.

      4. You must select an option in the Initial status list. This attribute determines the status of the user in the connected org when they are created, linked, or reactivated. When active_with_pass or pending_with pass is selected, a temporary password is generated for the user. When Okta Password Sync is enabled, the temporary user password is overwritten when the user signs in.

    4. Click Save and Go Back and Done.
  12. Optional. Push new Okta groups to the connected org. See Manage Group Push.