Okta Admin v2

Provides integration with the Okta Management API for administering users, groups, and group membership in an Okta organization. Use it to list and look up users and groups, create and update them, delete them, and assign or unassign users to and from groups.

Revision History

0.0.0.12 - Initial release.

Connection

This Connection identifies the Okta organization and stores the credentials used by every Okta Admin method. Choose an Authentication mode; only the properties for the selected mode are shown.

Setup Notes

• The Okta Admin Node is available on Cloud and compatible local Runtime clusters.
• For ServiceAppOAuth, in the Okta Admin Console, create an API Services app integration that uses public key / private key client authentication, register the public key that matches your private JWK, and note its client ID and key ID.
• Grant the Okta API scopes the service app needs, and enter the same scopes in Scope:
  • User reads require okta.users.read. User writes require okta.users.manage.
  • Group reads require okta.groups.read or okta.groups.manage. Group and membership writes require okta.groups.manage.
• Assign the service app an admin role, and a resource set where applicable, that allows the operations you intend to run. A granted scope does not give the service app an admin role by itself.
• The Node requests access tokens from the organization authorization server and supports Demonstrating Proof of Possession (DPoP) when it is required by the service app. Tokens are renewed automatically when they expire or are rejected.
• In ApiToken mode, the token acts with the permissions of the admin who created it. If Okta rejects the token, replace it in the Connection.
• Test Connection performs a read-only request for one user, so it requires user read access. A successful test does not confirm the permissions needed for other operations.

Methods

Each method exposes templates for a fixed set of Okta Management API operations. Select a template to populate the stable OperationId and the operation-specific Options and Items fields. Template names come from the Okta API, and each template description shows its HTTP method and path.

List

Lists users, groups, or related records. The Node pages through results automatically and emits one row for each record.

Available templates:

• List all users (GET /api/v1/users) - Lists users in the organization.
• List all groups (GET /api/v1/users/{id}/groups) - Lists the groups a user belongs to.
• List all assigned app links (GET /api/v1/users/{id}/appLinks) - Lists the app links assigned to a user.
• List all groups (GET /api/v1/groups) - Lists groups in the organization.
• List all member users (GET /api/v1/groups/{groupId}/users) - Lists the users in a group.

Get

Gets one user or group.

Available templates:

• Retrieve a user (GET /api/v1/users/{id}) - Gets a user by ID, login, or unambiguous login shortname.
• Retrieve a group (GET /api/v1/groups/{groupId}) - Gets a group by ID.

Create

Creates users or groups, one for each row in Items.

Available templates:

• Create a user (POST /api/v1/users) - Creates a user.
• Add a group (POST /api/v1/groups) - Creates an Okta group.

Update

Updates a user or replaces a group profile, using each row in Items as one request.

Available templates:

• Update a user (POST /api/v1/users/{id}) - Partially updates a user. Only the fields you supply are changed.
• Replace a group (PUT /api/v1/groups/{groupId}) - Replaces the profile of an Okta group.

Delete

Deletes one user or group.

Available templates:

• Delete a user (DELETE /api/v1/users/{id}) - Deletes or deactivates a user.
• Delete a group (DELETE /api/v1/groups/{groupId}) - Deletes an Okta group.

AddMember

Assigns a user to a group. Select the Assign a user to a group template (PUT /api/v1/groups/{groupId}/users/{userId}).

RemoveMember

Unassigns a user from a group. Select the Unassign a user from a group template (DELETE /api/v1/groups/{groupId}/users/{userId}).

Usage Notes

• Options accepts only the route and query values shown by the selected template. Paging is managed by the Node, so limit, after, and expand are not available.
• Route values such as id, groupId, and userId must be supplied explicitly. The values me, ., and .. are rejected.
• Options applies to the whole invocation. For Update, every row in Items targets the user or group identified in Options. To update several different users or groups, run the Node once per target, for example inside a For Each.
• List follows Okta's next-page links automatically. A q query is a bounded lookup that Okta does not page, so use search or filter for larger result sets. User search results are eventually consistent.
• An unfiltered List all users request does not return users with the DEPROVISIONED status.
• The List templates show sample search, filter, and q expressions, but samples are not applied unless you enter a value.
• Enter string and integer list fields, such as groupIds in Create a user, as comma-separated values. Quote values that contain commas, quotes, or line breaks, and double any embedded quotes. Spaces are preserved, and an empty value produces an empty list.
• fields in List all users uses Okta's projection syntax, for example id,status,profile:(firstName,lastName), rather than a comma-separated list.
• Create, Update, Delete, AddMember, and RemoveMember responses include Flowgear.IsSuccess, Flowgear.Message, and Flowgear.Request. Failed rows also include Okta's errorCode, errorSummary, errorLink, errorId, and errorCauses when Okta returns them.
• When an individual item is rejected, for example because of a validation error or a target that does not exist, the Node returns a failed row and continues with later items. Authentication, permission, connection, and other request-wide failures stop the operation.
• An HTTP 403 failure usually means the Connection lacks the required access. For ServiceAppOAuth, check the requested and granted scopes and the service app's admin role and resource set.
• User credentials and passwords, custom profile attributes, and fields that Okta marks as read-only cannot be supplied in Items. Unknown fields are rejected.
• Group writes apply to Okta-owned groups. Groups imported from directories such as Active Directory remain subject to Okta's restrictions.
• Get and List return records as Okta provides them, including profile and _links. An empty collection returns no rows.

Known Issues

• Calling Delete a user on a user that is not yet deactivated deactivates the user instead of deleting it. To permanently delete the user, run Delete a user again. The Node never issues the second request automatically.
• A successful response means Okta accepted the request. It does not confirm that downstream provisioning to connected applications has finished.
• Two List templates share the Okta name List all groups. Use the template description to distinguish them: GET /api/v1/groups lists groups in the organization, and GET /api/v1/users/{id}/groups lists the groups for one user.

See also

• Handle Partial Batch Failures.
• For Each.
• Okta Management API reference.