Integrations
Integrations
Breadcrumbs

Okta

This module allows synchronizing users from Okta Identity Cloud.

There are two synchronization modes depending on whether application-id is configured or not:

  • Application-filtered mode (with application-id): Anjana queries the /api/v1/apps/{id}/users endpoint to obtain only the users assigned to that application. Recommended when only a subset of the organization should have access.

  • Full organization mode (without application-id): Anjana queries the /api/v1/users endpoint and synchronizes all users of the Okta organization.

Part 1: Configuration in Okta Admin

To connect the API, we need an Admin Token (SSWS) and, optionally, the application identifier.

Step 1: Generate API Token (SSWS)

  1. Log in to your Okta admin console.

  2. Go to Security > API > Tokens.

  3. Click Create Token.

  4. Give it a descriptive name (e.g. Anjana Provisioning Token).

  5. Important: Copy and save the Token Value immediately. Okta will not show it again.

Step 2: Get the App ID (Optional — only for application-filtered mode)

This step is only necessary if you want to restrict synchronization to the users assigned to a specific application. If you omit application-id, Anjana will synchronize all users of the organization.

  1. Go to Applications > Applications.

  2. Select the application you created for Anjana (the same one used for SAML/OIDC Login).

  3. On the application's detail page, find the App ID.

    • Note: It is usually found in the browser URL (e.g. .../instance/apps/0oa123456789/general), or there may be a "Copy ID" button in the General section.

  4. Make sure the application has users or groups assigned in the Assignments tab.

Part 2: Configuration in application.yml

Edit Anjana's configuration file and include the data in the security.provisioning.providers.okta section.

Application-filtered mode (with application-id)

Only the users assigned to the specified application are synchronized.

YAML
security:
  provisioning:
    providers:
      okta:
        okta-prod:
          org-url: "https://dev-123456.okta.com"
          api-token: "00TwXyZ_SUPER_SECRET_TOKEN_..."
          # Application ID (Step 2)
          application-id: "0oa123456789abcdef"

Full organization mode (without application-id)

All users of the Okta organization are synchronized.

YAML
security:
  provisioning:
    providers:
      okta:
        okta-prod:
          org-url: "https://dev-123456.okta.com"
          api-token: "00TwXyZ_SUPER_SECRET_TOKEN_..."
          # application-id not configured → synchronization of the entire organization

Properties Summary

YAML Property

Description

Source in Okta

Required

org-url

Base URL of the organization.

Dashboard or browser URL.

Yes

api-token

SSWS security token.

Security > API > Tokens

Yes

application-id

App ID. If present, synchronizes only its assigned users. If absent, synchronizes the entire organization.

Applications > Select App > General (or URL)

No (optional)

Custom field mapping (field-mapping)

Anjana includes a default mapping that covers the usual cases. You can override any field by indicating the key of the Okta profile from which the value should be read. The keys are listed in order of priority: the first non-empty value is used.

App Mode vs. Org Mode: In full organization mode, Anjana reads Okta's standard SCIM profile (/api/v1/users). In application mode, it reads the Profile Editor profile (/api/v1/apps/{id}/users), whose fields are those you define in Okta — plus the special creds_userName field, which contains the app credentials.

Default mapping

Anjana Field

Default keys (priority order)

userName

email, login, creds_userName

email

email

firstName

given_name, firstName

lastName

family_name, lastName

phone

phone_number, mobilePhone

title

title

Available fields (SCIM profile — full organization mode)

Key

Description

email

Primary email address.

login

Login username (UPN in Okta).

firstName

First name.

lastName

Last name.

middleName

Middle name.

displayName

Display name.

nickName

Nickname.

honorificPrefix

Honorific prefix (e.g. Dr., Ms.).

honorificSuffix

Honorific suffix (e.g. Jr.).

mobilePhone

Mobile phone.

primaryPhone

Primary phone.

secondEmail

Secondary email.

title

Job title.

userType

User type.

department

Department.

organization

Organization.

division

Division.

costCenter

Cost center.

employeeNumber

Employee number.

manager

Name of the direct manager.

managerId

ID of the direct manager.

locale

Locale setting.

timezone

Time zone.

preferredLanguage

Preferred language.

streetAddress

Postal address.

city

City.

state

State or province.

zipCode

Postal code.

countryCode

Country code (ISO 3166-1 alpha-2).

postalAddress

Full formatted address.

creds_userName

(Application mode only) App credential username.

Configuration example

YAML
security:
  provisioning:
    providers:
      okta:
        okta-prod:
          org-url: "https://dev-123456.okta.com"
          api-token: "..."
          field-mapping:
            # Use login (UPN) as userName instead of email
            user-name: ["login"]
            # Read phone from the primary field with fallback to mobile
            phone: ["primaryPhone", "mobilePhone"]
            # Job title; if empty, use department
            title: ["title", "department"]