Okta connector configuration

Prerequisites: an Okta test organization, a dedicated pilot user, and a verified Presence control-plane member with integrations:manage. A tenant API key cannot install the connector. Arrange this control-plane access with support before setup.

For a custom API Services app, register an RSA public JWK, retain its private JWK and kid, grant okta.users.manage, and assign an admin role/resource set that permits session clearing for pilot users. For an OIN API Service test instance, use the client ID and one-time client secret from the authorized instance instead. OIN publication is pending.

Submit exactly one credential method to the installation API. Supported organization URLs are HTTPS origins on okta.com, okta-emea.com or oktapreview.com. Presence verifies the token grant before activation. The credential remains encrypted and is used for token renewal; setup is not proof that session revocation works.

Capture inline_signing_secret and event_hook_authorization from the first successful response in your secret manager. An idempotent retry returns the installation without secrets. If setup values are lost or credentials change, disable the installation and create a new one with a new idempotency key; revoke the old instance in Okta.

Your trusted workflow must call the returned inline endpoint before session.start, application.access, group.assignment or admin_role.assignment. Send an opaque event ID, actor ID and target resource ID, plus evidence for a Presence session already bound to that action. Sign the exact JSON bytes using the returned inline secret; timestamps have a five-minute window.

Continue only for permit. Hold require_step_up for verification or review, and refuse deny. An effective BLOCKED verdict also attempts to clear the actor's Okta sessions and OAuth tokens. Revocation failure still denies, with session_revoked=false. Shadow mode may downgrade a true block and therefore does not establish live enforcement.

Optionally create an Okta Event Hook using the returned event endpoint and exact Authorization value. Presence echoes X-Okta-Verification-Challenge as JSON and accepts deliveries with 204. Event Hooks reconcile events after they occur; they cannot prevent the originating action.

Before rollout, verify the token exchange and renewal, block a controlled operation for the dedicated pilot user, confirm session_revoked and the actual Okta session effect, retry the same event, reject changed bytes, and exercise hook verification/delivery. Check downstream application sessions separately. Remove the Presence connector and revoke its Okta credentials to disconnect.