# Okta (Classic)

![Okta_Logo_BrightBlue_Medium.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/6496666691597.png)
Okta is a platform as a service used for identity management (IDaaS). It is a customizable, secure, and drop-in solution to add authentication and authorization services to your applications. It provides scalable authentication built right into your application without the development overhead, security risks, and maintenance.

**The Relyance Okta integration helps with a) understanding personal data types stored in Okta and b) providing visibility into third-party vendors configured in Okta. This guide is for those customers using the older Okta Classic platform. If you're unsure whether you're using Okta Classic or Okta OIE, check out [this support article](https://help.okta.com/oie/en-us/Content/Topics/identity-engine/oie-get-started.htm?cshid=ext-oie-version) from Okta.**

In order to integrate Okta with Relyance AI you will need an **Okta Subdomain**, **Client ID**, and **Client Secret**.

#### In Okta:

![Okta-1.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/6499071163661.png)
![Okta-2.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/6499124898701.png)
![Okta-4.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/6499162953485.png)
You'll need to first create an OAuth 2.0 application.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/6496942406029/38586696214797.png)

1. Login to your Okta account.
2. Click on the **Applications** drop-down menu, and navigate to **Applications** menu item.
3. Click on **Add Application**.
4. Click on **Create New App**.
5. Select the **Open ID Connect** option.
6. Enter the following:

**Name**: Relyance (or whatever you would like it be)
**Logo** (optional): Attached to this guide. **Login Redirect URI's**: [https://root.relyance.ai/api/oauth2](https://root.relyance.ai/api/oauth2)
7. Click on **Save**.
8. Click on the **Edit Button** in the following screen.
9. Enable the **Refresh Token** checkbox.
The refresh token allows offline_access. It is a long-lived token that can be used to obtain a new access token when the original one expires.
10. Scroll down, and click on **Save**.
11. Scroll to the bottom and copy the **Client ID** and **Client Secret** to be used in Relyance AI.

![Okta-5.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/6499115011853.png)

![Okta-7.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/6499486384653.png)

12. Navigate to the **Assignments** tab.
13. Click on the **Assign to People** option.
14. Assign users that will use the Relyance App.
15. Click on **Done**.
16. Click on the **Okta API Scopes** tab.
17. Grant the following scopes:
    - okta.logs.read
    - okta.users.read
    - okta.apps.read
    - okta.idps.read
    - okta.authenticators.read
    - okta.orgs.read

    ![Okta-8.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/6499671489677.png)

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Find the **Okta** integration card and click it to open its connections.
5. Under **Authentication Method**, choose **Oauth2 / App Token**.
7. Paste the **Okta Subdomain** (Ex: **dev-456xxxx** to be used without -admin **)**, **Client ID**, and **Client Secret** into their respective fields.

![Okta-10.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/6499872643597.png)

8. If you wish to configure the Okta integration to discover vendors and add them automatically to the Relyance Data Inventory and Map, check **Enable Vendor Discovery**.
9. Click **Authenticate**.
10. At this point, you should see the following result on the Vendor Integrations page:

![Screenshot_2023-02-24_at_3.53.17_PM.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/13413129611021.png)

![Okta-11.png](https://assets.relyanceuat.xyz/images/docs/6496942406029/6500526647437.png)

11. Congratulations, you are now connected to **Okta**.

<!-- failure-modes:begin (generated from the integration catalog; do not hand-edit) -->

## If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. **A feature you enabled returns nothing.** Some scopes belong to a feature rather than to the connection: **Data subject requests** needs `okta.users.manage`. Turning the feature on after the connection exists does not widen the grant it already holds, so re-authenticate the connection.
2. **Authorised, then empty.** The connection carries an authorisation, not a password: it stops returning data if the account that granted it loses access, its own permissions narrow, or the grant is revoked at the vendor. None of that reports an error here -- the connection keeps its last status until the next scan.
3. **A credential rotated at the vendor is not picked up here.** **Client Secret** and **API Token** are stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.
4. **Check the address fields before suspecting the credentials.** **Subdomain**, **Public Key URL**, **Okta Subdomain** and 1 more identify which tenant, region or host to talk to. A wrong value there fails authentication and looks exactly like a bad secret.

<!-- failure-modes:end -->

<!-- auth-methods:begin (generated from the integration catalog; do not hand-edit) -->

## Authentication methods and fields

Pick one of these under **Authentication Method** on the connection wizard's **Authentication** step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

| Method | Required | Optional |
| --- | --- | --- |
| **Machine to Machine** | `Client ID`, `Subdomain`, `Public Key URL` | — |
| **Oauth2 / App Token** | `Client ID`, `Client Secret` (secret), `Okta Subdomain` | — |
| **Custom** | `API Token` (secret), `Subdomain` | — |
| **Sandbox Oauth2** | `Client ID`, `Client Secret` (secret), `Okta domain` | — |
| **Okta Classic** | `API Token` (secret), `Subdomain` | — |

<!-- auth-methods:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

### OAuth client credentials (M2M)

```hcl
resource "relyance_integration_connection" "okta_0" {
  vendor = "okta"
  name   = "<your connection name>"

  auth = {
    method = "oauth-client-credentials"
    params = {
      client_id = "<client_id>"
      subdomain = "<subdomain>"
      public_key_url = "<public_key_url>"
      data_storage_location = "us"
    }
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

### OAuth (browser authorization)

The **OAuth (browser authorization)** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example okta/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### API token

```hcl
resource "relyance_integration_connection" "okta_2" {
  vendor = "okta"
  name   = "<your connection name>"

  auth = {
    method = "api-token"
    params = {
      subdomain = "<subdomain>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      api_token = var.okta_api_token
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

### OAuth (browser authorization) — Sandbox Oauth2

The **OAuth (browser authorization) — Sandbox Oauth2** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example okta/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### API token — Okta Classic

```hcl
resource "relyance_integration_connection" "okta_4" {
  vendor = "okta"
  name   = "<your connection name>"

  auth = {
    method = "api-token-okta-classic"
    params = {
      subdomain = "<subdomain>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      api_token = var.okta_api_token
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->