Okta Certified Consultant flashcards
Okta Certified Consultant · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Okta AD Agent port
- The Okta AD Agent communicates outbound over TCP 443 to Okta; no inbound ports are required. It must be installed on a domain-joined Windows server with access to domain controllers.
- Universal Directory custom attributes
- Custom user profile attributes are defined in Profile Editor with data type (string, number, boolean) and permissions. They can be used in app attribute statements, group rules, and policies.
- Group rule evaluation
- Group rules assign users to groups based on profile attribute conditions. Rules run on user create/update; deleting a rule does not remove existing members-manual cleanup is needed.
- Network zone purpose
- Network zones define IP ranges (corporate, blocklist, tor) used in policy conditions for sign-on, MFA, and app access. Zones are referenced in rules to allow or deny based on source IP.
- IdP discovery routing
- IdP discovery routes users to a specific identity provider based on email domain or IP. Configure routing rules in Okta and use the Sign-In Widget with idpDiscovery parameter.
- SAML ACS URL
- The Assertion Consumer Service URL is the SP endpoint that receives the SAML response. It must be configured in Okta app settings and match the SP's expected URL exactly.
- OIDC authorization code flow
- OIDC authorization code flow with PKCE is recommended for web and native apps. Okta returns an authorization code, which the app exchanges for ID and access tokens.
- SCIM provisioning
- SCIM 2.0 is a standard for user/group provisioning. Okta uses SCIM connectors to create, update, and deactivate users in apps; configure base URL and authentication in the app's Provisioning tab.
- Okta RADIUS agent
- The Okta RADIUS Server Agent enables Okta MFA for VPN and network devices. Install the agent, configure it for the Okta org, and set the device to use RADIUS with Okta as the server.
- Okta Access Gateway
- OAG publishes on-premises web apps through Okta using header-based or Kerberos authentication. It joins to the Okta org and defines app routes with protected resources and policies.
- Okta Workflows connector
- Okta Workflows connectors (Okta, HTTP, Slack) enable no-code automation. Use triggers (user created) and functions (assign app) to build flows; test with run history and versioning.
- Authorization server scopes
- Okta authorization servers define scopes and claims for OAuth 2.0 access tokens. Custom scopes control API access; claims map user attributes into tokens for resource servers.
- Global session policy
- The global session policy determines IdP session lifetime and MFA enrollment requirements. It is evaluated before app authentication policies and applies org-wide.
- App authentication policy
- App authentication policies control access to individual apps, including re-prompt for MFA. Rules are evaluated top-down; first match wins; a catch-all rule provides default access.
- Profile mastering priority
- Profile mastering sets source priority per attribute (Okta, AD, HR). Higher priority sources overwrite lower ones; Okta as source means the attribute is managed only in Okta.
- Delegated authentication
- Delegated authentication validates user passwords against AD via the Okta AD Agent. Enable Authentication in directory settings; the agent uses Kerberos or NTLM to validate credentials.
- SWA app sign-on
- SWA (Secure Web Authentication) uses password vaulting for apps without SAML/OIDC. Okta stores credentials and injects them via browser plugin or Access Gateway; bookmark-only provides a link without SSO.
- Okta API rate limits
- Okta enforces per-org API rate limits (e.g., 600 requests/min for GET /api/v1/users). Use exponential backoff and monitor X-Rate-Limit-Remaining header; batch bulk operations.
- MFA enrollment policy
- Authenticator enrollment policy defines which MFA factors are available and their order. Set required vs optional at global session policy; FIDO2/WebAuthn requires HTTPS and compatible browsers.
- SAML attribute statements
- SAML attribute statements map Okta profile attributes to SP-expected attributes using Expression Language. Set NameFormat (unspecified, emailAddress, URI) and test in the Expression Editor.
- Okta Core API
- The Core API (/api/v1) manages users, groups, and apps. Authenticate with an API token (SSWS header) generated in Security > API; token permissions match the creating admin.
- User status transitions
- Okta user statuses: STAGED → ACTIVE → SUSPENDED → DEPROVISIONED. Use API operations activate, deactivate, suspend, unsuspend, and reset password to transition between statuses.
- Okta Expression Language
- EL is used in attribute statements, group rules, and policies. Syntax includes ${user.firstName}, ${user.getGroups()}, and string functions; test expressions in the Expression Editor.
- System Log API
- The System Log API (/api/v1/logs) provides audit events. Query with since, until, and filter parameters (e.g., eventType eq "user.session.start"); export to SIEM via OIN or Log Streaming.
- SAML troubleshooting
- Use Okta SAML Tracer or SP debug tools to inspect AuthnRequest and SAMLResponse. Verify signature, audience restriction, recipient, and clock skew (typically 5 minutes).
- Okta Verify enrollment API
- Enroll factors via /api/v1/users/{id}/factors. For push, user must have Okta Verify installed; for TOTP, generate a shared secret and QR code for the authenticator app.
- AD agent high availability
- Deploy at least two AD agents per domain and configure load balancing for high availability. Okta Enterprise orgs have a 99.99% uptime SLA; use preview orgs for testing.
- OIN app integration
- The Okta Integration Network provides pre-built SAML/OIDC app templates. For custom apps, use the App Integration Wizard to set ACS URL, Entity ID, and attribute statements.
- LDAP agent limitations
- The Okta LDAP Agent supports generic LDAP directories for authentication and profile sync but does not support password write-back to the directory.
- Inbound SAML federation
- Configure an external SAML IdP in Okta, map attributes, and use routing rules or IdP discovery to direct users. Okta acts as SP for inbound federation.
- Office 365 federation
- Okta integrates with Office 365 via WS-Federation or SAML 2.0. Configure domain federation in Azure AD, set immutable ID to Okta user ID, and enable provisioning for licenses and groups.
- Policy evaluation order
- Okta evaluates global session policy first (sign-on), then app authentication policies. Rules are evaluated top-down; first match wins; a catch-all rule provides default access.