Okta

Overview

The Okta connector registers an event hook in your org, so Tessel hears about lifecycle and membership changes as they happen. Each event arrives typed, with the actor, target user and outcome attached, and it appears in the trace of the run it started.

Teams use it to open laptop and account requests when a user is created, to strip access from Slack, Google Workspace and Salesforce when someone is deactivated, and to page security when Okta flags a risky sign-in.

Event coverage

• user.lifecycle.create, user.lifecycle.activate and user.lifecycle.deactivate

• group.user_membership.add and group.user_membership.remove

• user.risk.detect and user.session.start for security workflows

How event hooks work

Tessel creates an event hook pointed at a regional endpoint and answers Okta's one-time verification request. Okta then posts batches of events, which Tessel splits, checks against the schema and delivers in order. Duplicate deliveries are dropped by event ID.

POST /api/v1/eventHooks
{
  "name": "Tessel",
  "events": { "type": "EVENT_TYPE",
    "items": ["user.lifecycle.create", "user.lifecycle.deactivate"] },
  "channel": { "type": "HTTP", "version": "1.0.0",
    "config": { "uri": "https://eu-1.hooks.tessel.dev/okta" } }
}

POST /api/v1/eventHooks
{
  "name": "Tessel",
  "events": { "type": "EVENT_TYPE",
    "items": ["user.lifecycle.create", "user.lifecycle.deactivate"] },
  "channel": { "type": "HTTP", "version": "1.0.0",
    "config": { "uri": "https://eu-1.hooks.tessel.dev/okta" } }
}

POST /api/v1/eventHooks
{
  "name": "Tessel",
  "events": { "type": "EVENT_TYPE",
    "items": ["user.lifecycle.create", "user.lifecycle.deactivate"] },
  "channel": { "type": "HTTP", "version": "1.0.0",
    "config": { "uri": "https://eu-1.hooks.tessel.dev/okta" } }
}

Offboarding safety

Suspend and session actions can sit behind an approval step. A named person, plus a backup, confirms in Slack or Teams before Tessel calls Okta, and the decision is stored in the trace.

Permissions needed

Create an API service app in Okta that signs in with a private key. Grant only the scopes your workflows use. Write scopes are needed only for the create, group and suspend actions.

• okta.users.read and okta.groups.read for lookups

• okta.users.manage and okta.groups.manage for write actions

• okta.eventHooks.manage to create and verify the hook