Utilizing key integrations
Utilizing Key Integrations
This domain tests integration selection and lifecycle: OIN apps, SAML, OIDC, SCIM provisioning, Workflows, event hooks, and Access Gateway. You must know which layer handles authentication, authorization, and user lifecycle.
Core rules and concepts
- OIN integration quality varies. An OIN app may support SSO only, or SSO plus provisioning and entitlements.
- SAML integrations need correct ACS URL, audience/entity ID, and NameID format. OIDC integrations need redirect URIs, grant types, and scopes.
- SCIM provisioning requires a connector with import, matching, create/update, and deactivate rules. Entitlements are app-specific and often need separate import.
- Workflows and event hooks automate reactions to Okta events; inline hooks block or modify a flow and must respond quickly.
- Access Gateway is for header-based or Kerberos internal apps; it is not a general VPN replacement.
Worked example
A team buys a SaaS app listed in the OIN. They need SSO and automatic deactivation. Enable the OIN app, configure SAML with the vendor's ACS URL, and assign a pilot group. Then enable provisioning, match on userName, and map Okta department to the app. Enable deactivation when unassigned. Test with one user: assign, change department, unassign, and confirm the app deactivates the account.
Traps
Assuming every OIN app supports SCIM. Using email as the SCIM match key when users change addresses. Forgetting that app assignment drives provisioning. Inline hooks that time out cause failures. Entitlements may not appear until a separate import runs. Do not use Workflows for time-critical inline policy decisions.