Skip to main content
Version: Next Gen

Okta

Last updated on

This guide will walk you through setting up an Okta directory integration. The Okta directory integration supports two main use cases:

  • SCIM User Provisioning: This enables Okta users to be automatically synced over to Beyond Identity by means of SCIM.
  • Registration Syncing: This feature facilitates a passwordless experience by enabling Okta to redirect users to Beyond Identity, bypassing the username/password input screen. However, if this redirect occurs before a Passkey is linked to the employee's device, authentication may fail. Registration Syncing allows Beyond Identity to inform Okta when it is appropriate to route users to Beyond Identity.

Legend​

In the following sections, a color-coded indicator has been added to a heading to help identify whether the steps should be performed using Beyond Identity or a different application.

🔵 Beyond Identity: Actions to be performed in the Beyond Identity platform are highlighted in blue.

🟠 Okta: Actions to be performed in the Okta platform are highlighted in orange.

🟠 Create a Beyond Identity Group​

To enable specific users to authenticate passwordlessly with Beyond Identity, you shold create a group and include those users in it.

🟠 Generate an API Token​

In order for users to be appropriately routed to Beyond Identity from Okta, Beyond Identity must notify Okta when a user successfully binds a Passkey onto their device. This notification is facilitated through the byndidRegistered attribute, which you would have configured previously. It is necessary for Beyond Identity to possess an Okta API token in order to communicate the update to Okta.

🟠 Create a SCIM Application​

🔵 Create a Directory Integration​

In order to create an Okta Directory Integration, navigate to Directory > Directory Integrations > Add Directory Integration and click on Okta.

1. Generate Credentials​

The Okta SCIM application you created will expect a bearer token. Select Bearer Token and click on Generate.

important

Keep the bearer token and SCIM URL in a safe place as you will need them to configure the Okta SCIM application you already created.

Credentials TypeDescriptionWhat it Looks Like
Client CredentialsUpon selection, you will be provided with a client_id and client_secret.Generic SCIM Client Credentials
Bearer TokenIf you select bearer token, you will see a token displayed.Generic SCIM Bearer Token

2. Configure the Registration Attribute​

Finish configuring your Okta directory integration by entering your Okta domain as well as the API token you created in above.

Okta Registration Sync

🟠 Finish Configuring the Okta SCIM Application​

Configure the SCIM application in Okta with the SCIM URL and bearer token you generated in the Beyond Identity directory integration. After you've configured provisioning, enable the following actions:

  • Create Users
  • Deactivate Users

🟠 Synchronize Users via SCIM​

Push the group you created above to Beyond Identity. Once this is done, all users in the Beyond Identity group will show up in Beyond Identity under Directory > Identities.