Okta OOB Connector Questions

[Chamundeeswari]

Hi,

I have a couple questions with the OOB Okta connector.

1. I am importing Okta users as accounts in Saviynt. I see that, in the ACCOUNTFIELDMAPPINGS, the attribute of Okta "Profile" are directly mapped. However, lastlogin attribute is in the root of the returned user json response and not under profile. If I try to directly map "LASTLOGONDATE=lastLogin", I get following error : Incorrect datetime value: 'null' for column'LASTLOGONDATE'. Is it possible to import lastlogin attribute with the OOB connector?

2. In STATUS_THRESHOLD_CONFIG, I have the following settings:

• "accountsNotInImportAction":"SUSPEND",
• "inactivateAccountsNotInFile":false

However, both Okta suspended and deleted users are all read in as "INACTIVE" accounts in Saviynt. Is this correct ?

The behaviour I would like to achieve is "SUSPENDED" Okta users are imported as "INACTIVE" and the DELETED Okta users are imported as "SUSPENDED FROM IMPORT SERVICE".  What configuration will achieve this ?

Thank you!

[stalluri]

• statusColumn: Specify the account attribute mapped with the status of the account.

• activeStatus: Specify all possible values that indicate the active status of the accounts in the target application. All accounts that do not have these status values are marked as inactive.

• inactiveStatus: Specify all possible values that indicate the inactive status of the accounts in the target application.

• deleteLinks: Specify true or false to instruct the connector to remove or retain entitlements associated with accounts missing from import. When set to true, entitlements associated with missing accounts are removed. The default value is false.

• correlateInactiveAccounts: Specify true or false to instruct the connector to remove or retain users associated with inactive accounts. When set to true, users associated with inactive accounts are retained. The default value is false.

• inactivateAccountsNotInFile: Specify true or false to instruct the connector to mark accounts that are not imported during import as inactive or SUSPENDED FROM IMPORT SERVICE. When set to true, accounts that are not imported during import are marked as inactive. The default value is false.

• {
  "statusAndThresholdConfig": {
  "accountThresholdValue": 100,
  "correlateInactiveAccounts": true,
  "inactivateAccountsNotInFile": false,
  "statusColumn": "customproperty1",
  "activeStatus": [
  "active"
  ],
  "deleteLinks": true
  }
  }
  
  

[Chamundeeswari]

Hi Stalluri,

Thank you for your response.

The issue was with RemoveAccountJSON. If account is active and we try to delete the user, the API call only deprovisions it. So, we need to add another DELETE call to actually delete the user in Okta. "Design" based auto-populated okta_ProvisioningConnection RemoveAccountJSON does not include the second call. Adding that made sure the account is deleted in Okta and the status are imported correctly.

I would really appreciate if someone could help with mapping the lastlogin attribute with the OOB connector. Thanks! 🙂