Setting up the Okta integration

Why set up the Okta integration?

You can have users automatically created, deactivated, reactivated or updated from Okta via webhooks/Event hooks which you can configure within Okta.

How do I get access to the Okta integration

The Learn Amp team will need to enable the integration for you to access the details. Please contact us to get this set up for you. After this, the setup will be visible for admins and owners by clicking their profile image > Integrations > Okta. 

What information can be synced?

• First Name

• Last Name

• Email

• Profile Picture

• Title

• Language

• Location

• Manager

• Department (to be used for “Primary Team” within Learn Amp)

• Custom fields (only if the custom field exists in Learn Amp)

Setup

1. Sign in to your okta account: https://www.okta.com

2. In the left hand side navigation, expand Applications and click Applications link below

3. Click a button Create App Integration

4. In the modal which would pop up, from available options, select option OIDC - OpenID Connect

5. A second list of options would appear. Please select Web Application

6. Click button Next

7. In the General Settings panel, fill in App Integration Name

8. In the Client acting on behalf of a user make sure all 3 options are checked:Authorization CodeRefresh TokenImplicit (hybrid)

9. As Sign-in redirect URIs provide: https://<subdomain>.learnamp.com/en-US/okta/auth_callback

10. Click  Add URI and in Sign-in redirect URIs field fill: https://<subdomain>.learnamp.com/users/auth/okta/callback

11. In the Assignments select an option, which fits you the best

12. Click Save

13. From Client Credentials panel, copy value from Client ID and paste in the corresponding field above

14. From Client Credentials panel, copy value from Client secrent and paste in the corresponding field above

15. From General Settings panel, copy value from Okta domain and paste in the field *API URL above

16. In the Left Hand Side Menu, expand Security tab, and click API link

17. In the tabs on the top, click Tokens

18. Click Create Token

19. In the modal which would pop up, fill in What do you want your token to be named? field

20. Click Create Token

21. Copy value in Token Value and paste in to the field API Token above

22. Save the form above

23. When the page reloads, click the button Connect to Okta

24. Congratulations! The integration is now finalised!

Please follow these steps to enable instant updates (Event Hooks):

1. In the Left Hand Side Menu, expand Workflow and click Event Hooks

2. Click Create Event Hook button

3. Fill in Name

4. Fill in URL with: https://<subdomain>.learnamp.com/webhooks/okta

5. Fill in Authentication field with: Authorization

6. Fill in Authentication secret with: <secret-from-learnamp-okta-setup-page>

7. Please add the following for Subscribe to events:

   • User assigned to app

   • User added to group

   • User's Okta profile updated

   • User unassigned from app

   • User deactivated

   • User removed from group

   • User reactivated

   • User deleted

8. Click Save & Continue

FAQ’s

How do I make sure the users Sync?

Users are synced at least once every 24 hours at 3am GMT, but will be 'immediately'* synced if...

• They are invited to HiBob and match the criteria above (e.g. start date = today).

• Sync users button is pressed. 

Note: Immediate means that the action will be immediately sent to the queue, sometimes at time of peak traffic there may be minor delays.

How are managers allocated when using OKTA?

Typically within Learn Amp the manager is set by the users 'Primary Team' (the teams manager, becomes their manager). However for this integration, the 'Primary Team' manager will be overridden with the individuals manager within Okta. This means that teams will not have a manager, so you may wish to set these up as a sensible default if the manager field is missing within Okta.

Managers can view team members details, objectives, 1-to-1s, set tasks for them etc.

In the future, to improve this we will give an option on the integration on how the manager will be handled by the system. We will also:

1. Set manager at an individual level: Directly match the data in Okta, by setting a manager on an individual using our 'Override manager' setting.

2. Set manager at a team level: When the first user is added to a team, take their manager as the manager of that team. 
   
   

When will users be invited to join Learn Amp?
During your implementation period, the integration should be set up with the option “do not invite automatically” enabled to prevent users gaining access to the platform before it has been launched. Post launch, this feature will
disabled and new users will receive their email automatically shortly after their account is created in Learn Amp regardless of their start date.