Connect Okta
How to connect your Okta org to STLabs so users, groups, and app assignments sync into Axiom.
Overview
STLabs connects to Okta as an OAuth 2.0 API Service Integration, published in the Okta Integration Network as Axiom. Installing it in your Okta org issues a client ID and client secret scoped to your tenant; you paste those into STLabs once, and the connection is live.
This is a backend service integration: there is no user-in-the-loop login at runtime. Once connected, your users, groups, group memberships, applications, and application assignments sync into Axiom, the live graph STLabs uses for access visibility, onboarding and offboarding context, and ticket enrichment.
Directory sync is read-only. STLabs writes back to your Okta org only when someone runs an Okta action from an STLabs workflow — see Permissions.
Prerequisites
| Requirement | Detail |
|---|---|
| Okta super administrator | Required to add and authorize an API Service Integration under Applications → API Service Integrations. |
| Okta org domain | e.g. your-company.okta.com. If you paste your admin console address (e.g. your-company-admin.okta.com), STLabs uses your org address instead. |
| STLabs admin access | Any STLabs role with permission to create connections. |
Connect Okta to STLabs
Step 1: Install and authorize Axiom in Okta
- Sign in to your Okta admin console as a super administrator.
- Go to Applications → API Service Integrations (Applications and Resources → API Service Integrations in newer admin consoles) and select Add Integration.
- Choose Axiom from the list and select Next. Okta shows the permissions the integration asks for.
- Review the permissions and select Install & Authorize. STLabs cannot look up or change people, groups, and applications without all of them.
- Copy the client ID and the client secret.
Save the client secret before closing the dialog. Okta shows it only once. If you lose it, rotate the secret from the Axiom integration in your Okta admin console and re-enter both values in STLabs.
Step 2: Enter your credentials in STLabs
In STLabs, open Integrations → Okta → Connect, choose the OAuth (Okta Integration Network) method, and fill in:
| Field | Value |
|---|---|
| Okta domain | Your Okta org domain, e.g. your-company.okta.com |
| Client ID | From Step 1 |
| Client secret | From Step 1 |
Then save.
Step 3: STLabs verifies the connection
STLabs exchanges your client ID and secret for an access token at your org’s authorization server, calls your Okta org to confirm the granted scopes are in effect, marks the connection Connected, and starts the initial sync. A full first sync of users, groups, and applications can take anywhere from a few minutes to a few hours depending on directory size; incremental syncs afterward are much faster, and use Okta System Log events to pick up changes between full syncs.
Permissions
All scopes are on the Okta Management API, granted once at install time. STLabs requests two sets: one for directory sync, one for workflow actions.
Directory sync (read-only)
| Scope | Why STLabs needs it |
|---|---|
| okta.users.read | Read the people in your directory. |
| okta.groups.read | Read your groups and their members. |
| okta.apps.read | Read your applications and who can use them. |
| okta.userTypes.read | Read the account types in your directory. |
| okta.roles.read | Read who holds an administrator role. |
| okta.logs.read | Read your Okta System Log, so incremental sync picks up changes without a full re-pull. |
Workflow actions
These are used only when someone runs an Okta action from an STLabs workflow. Directory sync makes no write calls. Every action is logged in STLabs and attributed to the user who ran it.
| Scope | Why STLabs needs it |
|---|---|
| okta.users.read | Look up people in your directory. |
| okta.users.manage | Create, change, or deactivate people. |
| okta.groups.read | Look up your groups. |
| okta.groups.manage | Add people to groups or remove them. |
| okta.apps.read | Look up your applications and who can use them. |
| okta.apps.manage | Assign people to applications or remove them. |
What syncs
| Synced | Why STLabs reads it |
|---|---|
| Users | Populates Person entities in Axiom, the identity backbone for access reviews and onboarding. |
| Groups | Populates Team entities in Axiom. |
| Group memberships | Links people to teams, so group-based access shows up on a person’s record. |
| Applications | Populates Application entities for access and entitlement reporting. |
| Application assignments | Links people to the apps Okta says they can access. |
| System Log events | Drives incremental sync between full pulls, so changes land without a full re-read. |
Verify
- Check connection status in STLabs: it should read Connected with a recent sync timestamp.
- Review synced data: your Okta users should appear as Person entities in Axiom, with counts roughly matching your Okta population.
- Spot-check relationships: open a Person entity and confirm their group memberships and application assignments from Okta appear.
- If a sync fails or the connection needs reauthenticating, STLabs shows the diagnostic in the connection detail view. Re-enter a fresh client ID and client secret if you have rotated them in Okta.
Support
| Setup help or questions | support@stlabs.com |
| About STLabs | stlabs.com |