Okta Scan Assets Wizard

The Okta Scan Assets Wizard helps users automate asset discovery for your inventories and avoid manual configuration of assets in the OneTrust application. The connection identifies which apps are registered in your Okta instance and creates corresponding assets in Data Mapping Automation.

Prerequisites

  • Admin-level permissions in Okta to manage apps

  • Apps must have okta.apps.read permission

To create connection

  1. In the Scan Assets screen, provide a unique name and notification email for the new connection in the Name your new connection section.


  2. In the Provide Login Credentials section, you can choose to create new credentials or select existing credentials. For this example, we are creating new credentials using the Simple Connect feature.
    Note:

    For more on creating credentials in Integrations, see Configuring Integration Credentials.

  3. Provide the credential with a unique name and description.
  4. The Credential Type field will default to Simple_Connect, which will allow you to authenticate with Okta without leaving the configuration process.


  5. Click the Login button to open a new tab to access and authenticate with your organization's Okta tenant.


  6. Once authenticated, the credential will show as logged in.


  7. You can also mark this new credential as sensitive if used with workflows that work with highly sensitive data. Only users with the Manage Sensitive Classification will have access to this credential if enabled.
  8. Click the Save button to save the credential.
  9. Click the Test button to validate the credential's connection to Okta.
  10. In the Select the Managing Organization section, choose the managing organization level.


  11. Click the Next button to advance to the next screen.

    The Configure Trigger screen appears.

  12. In the Schedule Action section, enter either Hourly, Daily, Weekly, Monthly, Yearly, or Quarterly in the Frequency field. Customize the time of day and which days the connection should be triggered.


  13. Click the Next button.

    The Integration Summary screen appears.

  14. Click the Save button. The workflow connection will be created in an initial Inactive state.


  15. You can test the connection by hovering over the workflow row and clicking the Context Menu icon to select Test.


  16. Click the Activate button.

    The Confirm modal appears.

  17. Click the Ok button to activate this integration. The Status in the Integration Summary screen will update to Active.


  18. Click the Save button again.

To configure connection basics

  1. In the Scan Assets screen, provide a unique name and notification email for the new connection in the Name your new connection section.


  2. In the Provide Login Credentials section, you can choose to create new credentials or select existing credentials.
    Note:

    For more on creating credentials in Integrations, see Configuring Integration Credentials.



    Field
    Description
    Credential Name

    Enter a name to identify the credentials.

    Description

    Enter a description of the credentials.

    Credential Type

    Select Custom.

    Connector Type

    Select Web App.

    Auth Type

    Select OAuth 2.

    Protocol

    Defaults to HTTPS.

    Hostname

    Enter the hostname for the credential. When a credential is associated to a workflow action, the hostname will be the default domain for this action. If a previous domain has been specified on the action, the hostname will replace that domain.

    Test URL

    Enter a test URL for the new credential.

    OneTrust recommends using the Test Credential feature to validate TEST URL field.. This is a valid REST GET URL provided by the attempted system integration. For more information, see Testing Workflow Actions and Saving Sample Payloads.

    Key (Default Header)

    Select the type of key which should be used in the header of the call made by the connection.

    You can add additional keys if your credential requires more than one header.

    Value (Default Header)

    Enter the value of the key which should be used in the header of the call made by the connection.

    Grant Type

    Select Client Credentials.

    Access Token URL

    The location where the flow sends the client credentials. This field should be a full URL, https://api.box.com/oauth2/token.

    Client ID

    A publicly exposed string provided by the service. This is used to identify the OAuth application and build authorization URLs. The end user populates this field when they create the connection.

    Client Secret

    A private value string provided by the service. This value is used to authenticate the application identity to the service. The end user populates this field when they create the connection.

    Send Authentication Parameters In

    Select Form URL encoded.

    Send Credentials In

    Select HTTPS Headers

    mTLS enabled

    Enable mutual transport layer security (mTLS) for all credentials using the Web App connector type to establish secure and trusted connections with external servers. This only applies to outbound connections made by actions in integration workflows which use this credential type.

    For more information, see Setting Up Mutual Transport Layer Security.

    Server Certificate Chain

    Post a custom server certificate to any HTTPS credential to establish a secure and trusted connection with external systems not using a certificate issued by a trusted authority.

  3. You can also mark this new credential as sensitive if used with workflows that work with highly sensitive data. Only users with the Manage Sensitive Classification will have access to this credential if enabled.
  4. Click the Save button to save the credential.
  5. Click the Test button to validate the credential's connection to Okta.
  6. In the Select the Managing Organization section, choose the managing organization level.


  7. Click the Next button to advance to the next screen.

    The Configure Trigger screen appears.

  8. In the Schedule Action section, enter either Hourly, Daily, Weekly, Monthly, Yearly, or Quarterly in the Frequency field. Customize the time of day and which days the connection should be triggered.


  9. Click the Next button.

    The Integration Summary screen appears.

  10. Click the Save button. The workflow connection will be created in an initial Inactive state.


  11. You can test the connection by hovering over the workflow row and clicking the Context Menu icon to select Test.


  12. Click the Activate button.

    The Confirm modal appears.

  13. Click the Ok button to activate this integration. The Status in the Integration Summary screen will update to Active.


  14. Click the Save button again.

To test logs and asset creation

Once the connection is triggered, you can inspect the connection logs to check the results and inspect Data Mapping Automation to see the newly created Assets. If you encounter any issues with this setup or are not able to create assets as expected, please contact OneTrust Support.

  1. In the Integrations menu, select Connections.
  2. Locate and select the new connection.

    The Connection Details screen appears.

  3. Select the active workflow in the Summary tab.

    The Integration Builder screen appears

  4. Navigate to the Logs tab.
  5. Check if the message log, which is created when the connection was triggered, was successful. You can click the Event ID to inspect the log's request bodies and results.


  6. To check if assets were created, navigate to Data Mapping Automation > Inventory > Assets.
  7. Use the search bar to locate the new asset. It will be titled using the app name as seen in Okta. The Managing Organization column will list the org level you specified in the wizard configuration.
  8. Select the asset name to enter the Inventory Details screen. In the Details tab, you will find under Integration Information section the External ID of the asset will default to the app name with "- Okta" appended.