Configure Okta permissions

Before setting up the Okta data source for Data Access, configure the underlying data source with the required permissions to allow Data Access to synchronize users and groups.

Data Access authenticates to Okta by using an Okta API token. The token inherits the permissions of the admin role that is assigned to the user or service account that creates the token. We recommend that you create a dedicated service account with a custom admin role that is scoped to only the permissions that are specified in the following steps.

Steps

To configure Okta permissions for Data Access:

  1. In the Okta Admin Console, record your Okta domain (for example, mydomain.okta.com) for later use.
  2. Go to Security > Administrators > Roles, and then create a custom admin role that grants the following permissions.
    PermissionPurpose

    okta.users.read

    To view users and their details.

    okta.groups.read

    		To view groups and their details.
  3. If you want Data Access to push group changes back to Okta (controlled by the Enable Group Editing option in Data Access), add the following permissions to the role.
    PermissionPurpose

    okta.groups.manage

    To manage groups.

    okta.groups.members.manageTo manage group membership.
  4. If you want to configure application data source mappings in Data Access (controlled by the Application data source mapping option in Data Access), add the following permission to the role.
    Note Application data source mappings are used to associate Okta groups that are actively pushed through Okta's SCIM Group Push feature with specific Collibra data sources. The following permission is exercised only when groups are actively pushed to a configured application.
    PermissionPurpose
    okta.apps.read

    To read the Group Push mappings from your configured Okta applications.

  5. If you want Data Access to synchronize Okta applications and manage application-user assignments (controlled by the Enable Applications option in Data Access), add the following permissions to the role.
    Note  If you already added okta.apps.read in the previous step for application data source mapping, you do not need to add it again; the same permission satisfies both features.
    PermissionPurpose
    okta.apps.read

    To read Okta applications so that they can be synchronized as data objects.

    okta.apps.manage

    To assign and unassign users to and from applications, and to manage application group-push mappings.

  6. Create a service account, and then assign the custom admin role to it.
  7. In the Okta Admin Console, go to Security > API > Tokens > Create token, create an Okta API token as the service account, and then record the token value for later use.

What's next

Create Okta connection