Guidance for Okta connector
Read the following information for guidance and best practices when using an Okta connector in your flows.
Authentication
To authorize the connector:
- You must be assigned to the Okta Workflows OAuth app.
- You must have Super Admin credentials.
You also need the following information for authorizing your Okta account:
- Domain: Your Okta org domain. For example, if the URL of your Okta org is https://yourcompany.okta.com, then your domain is yourcompany.okta.com.
- Client ID and Client Secret: The client ID and client secret from your Okta Workflows OAuth app. To find these values, go to
Types of accounts
The account used to create the connection must have the Super Admin credentials.
Supported scopes
In the Okta Workflows Console:
- Go to . A list of available scopes appears.
- Click the Grant button for one or more scopes that you want to grant. A success message appears.
When adding scopes to an existing connection, you need to reauthorize your connection.
List of available scopes in the Okta connector
Scopes marked with an asterisk (*) aren't configurable through the Okta Workflows OAuth app.
- openid*
- profile*
- email*
- phone*
- address*
- groups*
- offline_access*
- okta.apps.manage
- okta.apps.read
- okta.clients.manage
- okta.clients.read
- okta.clients.register
- okta.eventHooks.manage
- okta.eventHooks.read
- okta.events.read
- okta.factors.manage
- okta.factors.read
- okta.groups.manage
- okta.groups.read
- okta.idps.manage
- okta.idps.read
- okta.inlineHooks.manage
- okta.inlineHooks.read
- okta.linkedObjects.manage
- okta.linkedObjects.read
- okta.logs.read
- okta.policies.manage
- okta.policies.read
- okta.roles.manage
- okta.roles.read
- okta.schemas.manage
- okta.schemas.read
- okta.users.manage
- okta.users.read
- okta.trustedOrigins.manage
- okta.trustedOrigins.read
- okta.identitySources.read
- okta.identitySources.manage
- okta.governance.accessCertifications.manage
- okta.governance.accessCertifications.read
- okta.governance.accessRequests.manage
- okta.governance.accessRequests.read
- okta.devices.manage
- okta.devices.read
- okta.deviceAssurance.manage
- okta.deviceAssurance.read
- okta.networkZones.manage
- okta.networkZones.read
Best practices
The following information provides more configuration information for Okta cards.
Search System Log Options
- In the Keyword field, the query parameter q is used to perform keyword matching against the attribute values for a Log Events object. All input keywords must be matched exactly (keyword matching is case-insensitive). See System Log.
- No values are returned when using a keyword match on an attribute with a null.
- The eq operator is used to concatenate each key and value pair, and combines different keys with an operator. To use other operators, use the Custom Filter field to build your own expression. Those pre-defined fields and the Custom Filter field are concatenated using the and operator. See System Log.
Get Users Groups
The following examples show configurations for obtaining the first 200 groups and for streaming.
First 200 Records
This flow captures the first 200 groups that a user joined on a monthly basis.
-
Parent flow
-
Helper flow
Stream Records
This flow updates one Custom Field value for all the groups that a specific user joined.
-
Parent flow
-
Helper flow
