Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.iru.com/llms.txt

Use this file to discover all available pages before exploring further.

​
About Okta

The Okta connector reads directory data, group memberships, application assignments, policies, MFA posture, and audit-related signals from your Okta org and surfaces them as artifacts in Iru Compliance. Authentication uses an Okta API token over the Okta Management API. The integration is intended for read-only evidence collection. Iru does not provision users or change policies in Okta beyond what your token’s admin permissions allow during API reads.

​
How it works

Okta accepts API tokens using the SSWS scheme: 
Authorization: SSWS YOUR_API_TOKEN
Tokens inherit the permissions of the admin who created them. Unused tokens expire after 30 days; successful API calls refresh that window. The Iru connector walks through server URLs for your tenant (production, EMEA, Gov, preview, or custom domain), then collects your API token on the final step. Earlier wizard steps align OAuth-related URLs where the product expects them; SSWS token authentication is what authorizes Management API calls for this source.
DetailValue
CategorySecurity / identity
AuthenticationOkta API token (Authorization: SSWS YOUR_TOKEN)
Okta planAny plan that includes Management API access you rely on
Documentation: Create an API token, API token management, Rate limits.

​
Prerequisites

  • An Okta administrator role that can create API tokens (Super Admin, Org Admin, or Read-only Admin, depending on what your org allows for automation accounts).
  • Your org’s subdomain or full Okta domain (for example acme if users sign in at https://acme.okta.com).

​
Connect Okta to Iru

​
Okta

1

Create an API token in Okta

Sign in to the Okta Admin Console. Go to Security → API → Tokens. Select Create token, enter a name you will recognize (for example Iru Compliance), then create and copy the token immediately. You cannot view it again after you leave the dialog.Plan for idle expiry: if no successful API call uses the token for 30 days, Okta invalidates it and you must create a new token.Optionally restrict token use by network zone if your environment uses fixed egress IPs.

​
Iru Compliance

1

Open Sources

In Iru Compliance, on the left navigation bar, expand Compliance and select Sources.
Left navigation: Compliance expanded, Sources selected
2

Turn on Okta

Find Okta (use Category or Search by name or description). On that card, turn on the toggle. A new tab opens the connector wizard.
3

Choose the server URL that matches your tenant

Select the row that matches where your org lives:
EnvironmentBase URL pattern
Production (US)https://YOUR_SUBDOMAIN.okta.com
EMEAhttps://YOUR_SUBDOMAIN.okta-emea.com
Preview / sandboxhttps://YOUR_SUBDOMAIN.oktapreview.com
US Govhttps://YOUR_SUBDOMAIN.okta-gov.com
Custom domainhttps://YOUR_OKTA_DOMAIN
Confirm your choice so the wizard can build the correct Management API base URL.
4

Enter subdomain and domain variables

Follow each wizard screen: enter your subdomain or domain values where prompted so OAuth-related URLs stay consistent with your tenant.
Mid-wizard steps that mention OAuth URLs exist because the connector template configures endpoints completely. SSWS token authentication on the last step is what Iru uses for Management API reads for this source.
5

Paste the API token and activate

On the credential step, paste your API token into the authorization field and submit.When the source connects, the Okta card shows Active.

​
Troubleshooting

Check pop-up blocker settings for the Iru site and try again.
Verify the token string, that the admin account is still active, and that the token was not revoked.
Recreate the token under Security → API → Tokens if it has been idle for 30 days.
The admin profile tied to the token may lack read access to some endpoints. Confirm at least Read-only Admin (or equivalent) for evidence you need.
Disconnect and reconnect, double-checking subdomain and region (US vs EMEA vs Gov vs preview).

​
Considerations

Treat API tokens like credentials

Treat API tokens like credentials. Prefer a service account with the minimum admin role that still satisfies evidence requirements.

Okta applies rate limits to Management API traffic;…

Okta applies rate limits to Management API traffic; large orgs may see longer sync times during first collection.

Iru reads data exposed by the APIs your token can…

Iru reads data exposed by the APIs your token can access - it cannot override Okta entitlements you do not grant.

​
See also