Skip to main content
Version: 10.3

Managing Okta Credentials

Use the openit_idpconnectorconsole utility to manage Okta credentials for data collection.

Open iT saves the credential file, idpconnector.db, in the OpeniT directory, which is by default in C:\ProgramData\OpeniT in Windows and /var/tmp/OpeniT in Unix.

You can:

Requirements​

  • An Open iT Core Client connected to an Open iT Core Server or a coexistent Open iT Core setup
  • Okta Credentials:
    • Okta Domain – The URL of your organization's Okta environment, used to connect to the Okta API.
      Example: https://company.okta.com
    • Okta API Token – An API token used to authenticate requests to the Okta API. The token expires after 30 days of inactivity; the 30-day expiration period is renewed each time the token is used. The account that creates the token must remain active and have the permissions required to access the requested Okta data.

Add and Verify an Okta Credential​

Follow these steps to configure and validate a credential.

Step 1: Open Command Prompt​

  1. Open a command prompt with Administrator level privileges.

Step 2: Navigate to the bin Directory​

  1. Go to the bin directory, which is by default in C:\Program Files\OpeniT\Core\bin, run the command:

    Command Syntax
    cd <bin_dir>
    Example
    cd C:\Program Files\OpeniT\Core\bin

Step 3: Add Okta Credentials​

  1. Run the following command:

    Command Syntax
    openit_idpconnectorconsole okta credential add

  2. Enter the required details when prompted:

    • Domain
    • Api Key

    Example
    Domain: https://company.okta.com
    Api Key: AbC******************

Step 4: (Optional) Add Multiple Okta Accounts​

If you need to collect sign-in logs from multiple Okta accounts, use the --name parameter:

Command Syntax
openit_idpconnectorconsole okta credential add --name <name>

where <name> is the name of the account you want to use for data collection.

Example
openit_idpconnectorconsole okta credential add --name okta1

Step 5: Verify the Credentials​

  1. Verify the default credential:

    Example
    openit_idpconnectorconsole okta credential verify

  2. Verify a named credential:

    Example
    openit_idpconnectorconsole okta credential verify --name <name>

    where <name> is the name of the account you want to verify.

  3. Confirm that the output indicates a successful connection:

    Sample Output
    Connection verified successfully.

    If the output shows Connection verification failed., see Troubleshooting for steps to resolve the issue.

note

Open iT securely stores credentials in the idpconnector.db file in the OpeniT directory, which is by default in C:\ProgramData\OpeniT. API Keys are encrypted before they are written to the database.

When using the --name parameter, Open iT stores named credentials in the same database, allowing multiple accounts to be managed from a single location.

Additional Credential Management​

Update a Credential​

Step 1: Open Command Prompt​

  1. Open a command prompt with Administrator level privileges.

Step 2: Navigate to the bin Directory​

  1. Go to the bin directory, which is by default in C:\Program Files\OpeniT\Core\bin, run the command:

    Command Syntax
    cd <bin_dir>
    Example
    cd C:\Program Files\OpeniT\Core\bin

Step 3: Update Okta Credentials​

  1. Run the following command:
Command Syntax
openit_idpconnectorconsole okta credential update

For named credentials:

Command Syntax
openit_idpconnectorconsole okta credential update --name <name>

Delete a Credential​

Step 1: Open Command Prompt​

  1. Open a command prompt with Administrator level privileges.

Step 2: Navigate to the bin Directory​

  1. Go to the bin directory, which is by default in C:\Program Files\OpeniT\Core\bin, run the command:

    Command Syntax
    cd <bin_dir>
    Example
    cd C:\Program Files\OpeniT\Core\bin

Step 3: Update Okta Credentials​

  1. Run the following command:
Command Syntax
openit_idpconnectorconsole okta credential delete

For named credentials:

Command Syntax
openit_idpconnectorconsole okta credential delete --name <name>
note

The --name parameter applies to all actions (add, update, delete, verify). If not specified, the default credential, <default>, is used.

Troubleshooting​

Connection verification failed​

If the credential verification returns Connection verification failed, follow the troubleshooting steps below to help identify and resolve the issue.

Step 1: Verify the Okta Domain​

Confirm that the configured value is the correct base URL for the customer's Okta organization, for example:

https://company.okta.com

Step 2: Verify the Okta API Token​

Confirm that the configured API token is correct and has not expired or been revoked. If necessary, create a new token from the Okta Admin Console or Security > API > Tokens.

The API token inherits the permissions of the administrator account that created it. Refer to Okta’s official guide.

Step 3: Verify the Token outside Open iT​

Test whether the Okta credentials can access the Okta API directly using a REST client such as Postman.

Example Request
GET https://<okta-domain>/api/v1/users?limit=1

Add the following headers:

Example Request
Authorization: SSWS <API_TOKEN>
Accept: application/json

If the request succeeds with 200 OK, the domain and token are valid for that request. If the request also fails outside Open iT, review the Okta configuration or token permissions before retrying the Open iT credential verification.

Step 4: Check the Permissions of the Token Owner​

Ensure that the Okta administrator account that created the token has sufficient permissions to access the information required by the integration. Okta API tokens operate using the privileges of their creator.

Step 5: Check Network Connectivity​

Ensure that the machine running Open iT can establish an HTTPS connection to the configured Okta domain. Check for:

  • Firewall restrictions
  • Proxy requirements
  • DNS resolution issues
  • SSL/TLS inspection or certificate problem

Step 6: Retry Credential Verification​

After addressing any identified issues, run:

Example
openit_idpconnectorconsole okta credential verify

If the problem persists, please reach out to support@openit.com for further assistance.