Provides the ability to integrate with the Okta API and sync users and groups from Okta into your SilverStripe database.
Documentation for the Okta Users API can be found here Documentation for the Okta Groups API can be found here
SilverStripe 4.x
- Queued job to sync users from Okta into SilverStripe
- Queued job to sync groups from Okta into SilverStripe
- Configurable reschedule time for queued job (to sync at user defined intervals)
- Configurable mapping of SilverStripe database fields to Okta API fields
- Configurable cache lifetime for List Users API
- Configurable list of statuses to sync across
- CMS configurable filters to define which groups to store from the sync groups job
composer require nzta/silverstripe-okta-api
And you will need to add the following constants to your .env
file:
SS_OKTA_GATEWAY_REST_URL="https://<organisation>.okta.com/api/v1/"
SS_OKTA_API_TOKEN="<token>"
Where {organisation}
is your organisation's Okta sub domain and {token}
is your API token which can be
generated by following these instructions.
You can update your Member field mapping by adding the following to your mysite/_config/config.yml
:
OktaProfileMemberExtension:
okta_ss_member_fields_name_map:
CustomField: 'customField'
ExtraCustomField: 'profile.extraCustomField'
Where the CustomField
and ExtraCustomField
are the SilverStripe Member database field names
and customField
and profile.extraCustomField
are the keys in the object returned from
the Okta API for each user. The dot notation in profile.extraCustomField
allows you to
map to fields nested one level deep, e.g. the extraCustomField
key inside of a profile
top
level key.
Note: This replaces the default configuration so you will have to include the original Member fields, e.g. FirstName, Surname and Email, if they are required to be synced.
You can add/update additional queue jobs by adding the following to your mysite/_config/config.yml
:
SyncOktaUsersJob:
additional_job_list:
- 'AdditionalFirstJob'
- 'AdditionalSecondJob'
Where the AdditionalFirstJob
and AdditionalSecondJob
are the additional SilverStripe QueuedJobs
that you can run after the primary job (SyncOktaUsersJob
) finishes. You can set the public $schedule_after
static to delay when the additional jobs kicks off. Eg. setting public $schedule_after = 30
would mean
additional job would start 30 seconds after the main job finishes.
You can create filters in the CMS that define which groups should be saved into the SilverStripe database. These work by defining a key/value pair which a group from the Okta API should match. These filters are configured to be matched using an OR style filter, so you can create multiple filters and each group from the Okta API just needs to match one of the filters.
These filters can be created in the Okta Group Filters ModelAdmin and each filter has a Filter
and Value
field
which maps to the key/value pair respectively.