> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Connect Okta identity, application assignment, policy, audit, and entitlement data.

Forge authenticates to Okta as an OAuth 2.0 API Service application using a
customer-owned RSA key. The connector collects directory and access context;
it does not use a long-lived Okta SSWS token.

## Access

Create an API Service application with these read scopes:

```text theme={"system"}
okta.apps.read
okta.users.read
okta.groups.read
okta.roles.read
okta.logs.read
okta.policies.read
okta.networkZones.read
okta.orgs.read
okta.governance.entitlements.read
okta.governance.principalSettings.read
okta.governance.operations.read
```

The Forge connection stores the Okta domain, OAuth client ID, public JWK
fingerprint, validated scopes, and validation status. The RSA private JWK is
write-only and stored as a Forge-managed secret.

## Collection

| Object                | Okta API coverage                                             |
| --------------------- | ------------------------------------------------------------- |
| Users and groups      | Directory identities and group records                        |
| Applications          | Application catalog and sign-on mode                          |
| Assignments           | User and group assignments for selected target applications   |
| Authorization servers | Servers and API scopes                                        |
| Governance            | Entitlements, entitlement values, and user entitlement values |
| Security context      | System Log, sign-on policies, network zones, and group rules  |

Application assignments and entitlement collection are bounded by the app
targets selected on the connection. Forge retains native Okta IDs and resolves
users and groups to directory identities when a safe match exists.

## Setup

1. Create the Okta API Service app, grant the scopes above, and add the public
   half of the RSA key.
2. In **Settings → Integrations → Okta**, save the tenant domain, client ID,
   and private JWK.
3. Run **Validate** and confirm each capability reports `healthy` or a precise
   missing-permission state.
4. Select the Okta applications whose assignments and entitlements should be
   inventoried.
5. Run the first inventory collection and compare record counts with Okta.

Changing the Okta domain or client ID after key material is saved requires key
rotation. This prevents an existing private key from silently being rebound to
a different OAuth client.

## Verification

| Check           | Expected result                                                       |
| --------------- | --------------------------------------------------------------------- |
| OAuth assertion | Okta accepts the client assertion and returns the granted scopes      |
| Directory       | Known user and group retain their native Okta IDs                     |
| App target      | Selected app returns its user and group assignments                   |
| Entitlement     | Available governance values resolve to the selected app and principal |
| Audit           | Recent System Log records are collected without secret material       |

Disabling the connection stops future collection. Remove the public key or
delete the API Service app in Okta to revoke provider-side access.