Skip to main content

Check out Port for yourself 

Okta

Port's Okta integration allows you to model Okta identity and access management resources in your software catalog and ingest data into them.

Overview​

This integration allows you to:

  • Map and organize your desired Okta resources and their metadata in Port (see supported resources below).
  • Watch for Okta object changes (create/update/delete) in real-time, and automatically apply the changes to your entities in Port.
  • Track user and group relationships for better access management visibility.

Supported resources​

The resources that can be ingested from Okta into Port are listed below. It is possible to reference any field that appears in the API responses linked below in the mapping configuration.

  • Users - User accounts and their profile information
  • Groups - User groups and their memberships

Prerequisites​

Create an Okta API token​

  1. Log in to your Okta admin console.
  2. Navigate to Security > API > Tokens.
  3. Click Create Token.
  4. Provide a name for your token (e.g., "Port Integration").
  5. Click Create Token.
  6. Copy the generated token and save it securely.
Token Security

Store your API token securely and never share it. The token provides access to your Okta data.

Okta Domain​

Your Okta domain is the subdomain of your Okta organization URL. For example, if your Okta URL is https://dev-123456.okta.com, your domain would be dev-123456.okta.com.

Setup​

Choose one of the following installation methods:
Not sure which method is right for your use case? Check the available installation methods.

Using this installation option means that the integration will be hosted by Port, with a customizable resync interval to ingest data into Port.

Live event support

This integration supports live events, allowing real-time updates to your software catalog without waiting for the next scheduled sync.

Supported live event triggers

User:

  • user.lifecycle.create
  • user.lifecycle.activate
  • user.lifecycle.deactivate
  • user.lifecycle.suspend
  • user.lifecycle.unsuspend
  • user.lifecycle.delete
  • user.account.update_profile

Group:

  • group.lifecycle.create
  • group.lifecycle.delete
  • group.lifecycle.update

Group Membership:

  • group.user_membership.add
  • group.user_membership.remove
Self-hosted installation

Alternatively, you can install the integration using the Self-hosted method to update Port in real time using webhooks.

Installation

To install, follow these steps:

  1. Go to the Data sources page of your portal.

  2. Click on the + Data source button in the top-right corner.

  3. Click on the relevant integration in the list.

  4. Under Select your installation method, choose Hosted by Port.

  5. Configure the integration settings and application settings as you wish (see below for details).

Application settings

Every integration hosted by Port has the following customizable application settings, which are configurable after installation:

  • Resync interval: The frequency at which Port will ingest data from the integration. There are various options available, ranging from every 1 hour to once a day. If a sync is still in progress when the next one is due, the new sync will be skipped (up to 24 hours delay).
    This ensures that all kinds are fully synchronized and that cleanup of stale entities always takes place at the end of each sync.

  • Send raw data examples: A boolean toggle (enabled by default). If enabled, raw data examples will be sent from the integration to Port. These examples are used when testing your mapping configuration, they allow you to run your jq expressions against real data and see the results.

Integration settings

Every integration has its own tool-specific settings, under the Integration settings section.
Each of these settings has an ⓘ icon next to it, which you can hover over to see a description of the setting.

Port secrets

Some integration settings require sensitive pieces of data, such as tokens.
For these settings, Port secrets will be used, ensuring that your sensitive data is encrypted and secure.

When filling in such a setting, its value will be obscured (shown as ••••••••).
For each such setting, Port will automatically create a secret in your organization.

To see all secrets in your organization, follow these steps.

Limitations

  • The maximum time for a full sync to run is based on the configured resync interval. For very large amounts of data where a resync operation is expected to take longer, please use a longer interval.

Port source IP addresses

When using this installation method, Port will make outbound calls to your 3rd-party applications from static IP addresses.
You may need to add these addresses to your allowlist, in order to allow Port to interact with the integrated service:

54.73.167.226  
63.33.143.237  
54.76.185.219
Advanced integration configuration

For advanced configuration such as proxies or self-signed certificates, click here.

Configuration​

Port integrations use a YAML mapping block to ingest data from the third-party api into Port.

The mapping makes use of the JQ JSON processor to select, modify, concatenate, transform and perform other operations on existing fields and values from the integration API.

Default mapping configuration​

This is the default mapping configuration for this integration:

Default mapping configuration (click to expand)
resources:
- kind: okta-user
  selector:
    query: 'true'
    include_groups: true
    include_applications: true
    fields: "id,status,created,activated,lastLogin,lastUpdated,profile:(login,firstName,lastName,displayName,email,title,department,employeeNumber,mobilePhone,primaryPhone,streetAddress,city,state,zipCode,countryCode)"
  port:
    entity:
      mappings:
        identifier: .id
        title: .profile.displayName // .profile.firstName + " " + .profile.lastName // .profile.login
        blueprint: '"okta-user"'
        properties:
          login: .profile.login
          email: .profile.email
          firstName: .profile.firstName
          lastName: .profile.lastName
          displayName: .profile.displayName
          title: .profile.title
          department: .profile.department
          employeeNumber: .profile.employeeNumber
          mobilePhone: .profile.mobilePhone
          primaryPhone: .profile.primaryPhone
          streetAddress: .profile.streetAddress
          city: .profile.city
          state: .profile.state
          zipCode: .profile.zipCode
          countryCode: .profile.countryCode
          status: .status
          created: .created
          activated: .activated
          lastLogin: .lastLogin
          lastUpdated: .lastUpdated
        relations:
          groups: .groups[]?.id
- kind: okta-group
  selector:
    query: 'true'
  port:
    entity:
      mappings:
        identifier: .id
        title: .profile.name
        blueprint: '"okta-group"'
        properties:
          name: .profile.name
          description: .profile.description
          type: .type
          created: .created
          lastUpdated: .lastUpdated
        relations:
          members: .users[]?.id

Examples​

To view and test the integration's mapping against examples of the third-party API responses, use the jq playground in your data sources page. Find the integration in the list of data sources and click on it to open the playground.

Additional examples of blueprints and the relevant integration configurations:

User​

User blueprint (click to expand)
{
  "identifier": "okta-user",
  "title": "Okta User",
  "icon": "Okta",
  "schema": {
    "properties": {
      "login": {
        "title": "Login",
        "type": "string"
      },
      "email": {
        "title": "Email",
        "type": "string",
        "format": "email"
      },
      "firstName": {
        "title": "First Name",
        "type": "string"
      },
      "lastName": {
        "title": "Last Name",
        "type": "string"
      },
      "displayName": {
        "title": "Display Name",
        "type": "string"
      },
      "title": {
        "title": "Job Title",
        "type": "string"
      },
      "department": {
        "title": "Department",
        "type": "string"
      },
      "employeeNumber": {
        "title": "Employee Number",
        "type": "string"
      },
      "mobilePhone": {
        "title": "Mobile Phone",
        "type": "string"
      },
      "primaryPhone": {
        "title": "Primary Phone",
        "type": "string"
      },
      "streetAddress": {
        "title": "Street Address",
        "type": "string"
      },
      "city": {
        "title": "City",
        "type": "string"
      },
      "state": {
        "title": "State",
        "type": "string"
      },
      "zipCode": {
        "title": "ZIP Code",
        "type": "string"
      },
      "countryCode": {
        "title": "Country Code",
        "type": "string"
      },
      "status": {
        "title": "Status",
        "type": "string",
        "enum": ["ACTIVE", "INACTIVE", "PASSWORD_EXPIRED", "LOCKED_OUT", "SUSPENDED", "DEPROVISIONED"]
      },
      "created": {
        "title": "Created Date",
        "type": "string",
        "format": "date-time"
      },
      "activated": {
        "title": "Activated Date",
        "type": "string",
        "format": "date-time"
      },
      "lastLogin": {
        "title": "Last Login",
        "type": "string",
        "format": "date-time"
      },
      "lastUpdated": {
        "title": "Last Updated",
        "type": "string",
        "format": "date-time"
      }
    },
    "required": ["login", "email"]
  },
  "calculationProperties": {},
  "relations": {
    "groups": {
      "title": "Groups",
      "target": "okta-group",
      "required": false,
      "many": true
    }
  }
}
Mapping configuration (click to expand)
createMissingRelatedEntities: true
deleteDependentEntities: true
resources:
  - kind: okta-user
    selector:
      query: "true"
      include_groups: true
      include_applications: true
    port:
      entity:
        mappings:
          identifier: .id
          title: .profile.displayName // .profile.firstName + " " + .profile.lastName // .profile.login
          blueprint: '"okta-user"'
          properties:
            login: .profile.login
            email: .profile.email
            firstName: .profile.firstName
            lastName: .profile.lastName
            displayName: .profile.displayName
            title: .profile.title
            department: .profile.department
            employeeNumber: .profile.employeeNumber
            mobilePhone: .profile.mobilePhone
            primaryPhone: .profile.primaryPhone
            streetAddress: .profile.streetAddress
            city: .profile.city
            state: .profile.state
            zipCode: .profile.zipCode
            countryCode: .profile.countryCode
            status: .status
            created: .created
            activated: .activated
            lastLogin: .lastLogin
            lastUpdated: .lastUpdated
          relations:
            groups: .groups[]?.id

Group​

Group blueprint (click to expand)
{
  "identifier": "okta-group",
  "title": "Okta Group",
  "icon": "Okta",
  "schema": {
    "properties": {
      "name": {
        "title": "Name",
        "type": "string"
      },
      "description": {
        "title": "Description",
        "type": "string"
      },
      "type": {
        "title": "Type",
        "type": "string",
        "enum": ["BUILT_IN", "OKTA_GROUP", "APP_GROUP"]
      },
      "created": {
        "title": "Created Date",
        "type": "string",
        "format": "date-time"
      },
      "lastUpdated": {
        "title": "Last Updated",
        "type": "string",
        "format": "date-time"
      }
    },
    "required": ["name"]
  },
  "calculationProperties": {},
  "relations": {
    "members": {
      "title": "Members",
      "target": "okta-user",
      "required": false,
      "many": true
    }
  }
}
Mapping configuration (click to expand)
createMissingRelatedEntities: true
deleteDependentEntities: true
resources:
  - kind: okta-group
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          identifier: .id
          title: .profile.name
          blueprint: '"okta-group"'
          properties:
            name: .profile.name
            description: .profile.description
            type: .type
            created: .created
            lastUpdated: .lastUpdated
          relations:
            members: .users[]?.id

Webhook configuration​

The Okta integration supports real-time updates through webhooks. When using the self-hosted installation method, the integration will automatically:

  1. Create an Event Hook in your Okta organization
  2. Configure the webhook to send user and group change events
  3. Process incoming webhook events to update Port entities in real-time

Webhook events​

The integration listens for the following Okta events:

  • user.lifecycle.create
  • user.lifecycle.activate
  • user.lifecycle.deactivate
  • user.lifecycle.suspend
  • user.lifecycle.unsuspend
  • user.lifecycle.delete
  • user.account.update_profile
  • group.user_membership.add
  • group.user_membership.remove
  • group.lifecycle.create
  • group.lifecycle.delete
  • group.lifecycle.update

Limitations​

  • The integration currently supports users and groups only
  • Custom Okta attributes are not automatically mapped but can be added to the configuration
  • Webhook verification is optional but recommended for production environments

Troubleshooting​

Common Issues​

  1. Authentication Errors: Verify your Okta API token has the correct permissions and is not expired
  2. Domain Issues: Ensure your Okta domain is correctly formatted (e.g., dev-123456.okta.com)
  3. Webhook Failures: Check that your self-hosted integration is accessible from the internet for webhook delivery
  4. Rate Limiting: Okta has API rate limits; the integration handles this automatically with retries