feat(docs): Okta App Connection + Secret Rotation

2026-10-04 19:26:19 +00:00 · 2025-07-19 02:29:50 -04:00
parent de2df991d7
commit 7884f312cd
31 changed files with 367 additions and 5 deletions
@@ -0,0 +1,4 @@
+---
+title: "Available"
+openapi: "GET /api/v1/app-connections/okta/available"
+---
@@ -0,0 +1,8 @@
+---
+title: "Create"
+openapi: "POST /api/v1/app-connections/okta"
+---
+
+<Note>
+    Check out the configuration docs for [Okta Connections](/integrations/app-connections/okta) to learn how to obtain the required credentials.
+</Note>
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v1/app-connections/okta/{connectionId}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get by ID"
+openapi: "GET /api/v1/app-connections/okta/{connectionId}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get by Name"
+openapi: "GET /api/v1/app-connections/okta/connection-name/{connectionName}"
+---
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v1/app-connections/okta"
+---
@@ -0,0 +1,8 @@
+---
+title: "Update"
+openapi: "PATCH /api/v1/app-connections/okta/{connectionId}"
+---
+
+<Note>
+    Check out the configuration docs for [Okta Connections](/integrations/app-connections/okta) to learn how to obtain the required credentials.
+</Note>
@@ -0,0 +1,8 @@
+---
+title: "Create"
+openapi: "POST /api/v2/secret-rotations/okta-client-secret"
+---
+
+<Note>
+    Check out the configuration docs for [Okta Client Secret Rotations](/documentation/platform/secret-rotation/okta-client-secret) to learn how to obtain the required parameters.
+</Note>
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v2/secret-rotations/okta-client-secret/{rotationId}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get by ID"
+openapi: "GET /api/v2/secret-rotations/okta-client-secret/{rotationId}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get by Name"
+openapi: "GET /api/v2/secret-rotations/okta-client-secret/rotation-name/{rotationName}"
+---
@@ -0,0 +1,4 @@
+---
+title: "Get Credentials by ID"
+openapi: "GET /api/v2/secret-rotations/okta-client-secret/{rotationId}/generated-credentials"
+---
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v2/secret-rotations/okta-client-secret"
+---
@@ -0,0 +1,4 @@
+---
+title: "Rotate Secrets"
+openapi: "POST /api/v2/secret-rotations/okta-client-secret/{rotationId}/rotate-secrets"
+---
@@ -0,0 +1,8 @@
+---
+title: "Update"
+openapi: "PATCH /api/v2/secret-rotations/okta-client-secret/{rotationId}"
+---
+
+<Note>
+    Check out the configuration docs for [Okta Client Secret Rotations](/documentation/platform/secret-rotation/okta-client-secret) to learn how to obtain the required parameters.
+</Note>
@@ -78,7 +78,10 @@
              },
              {
                "group": "Infisical SSH",
-                "pages": ["documentation/platform/ssh/overview", "documentation/platform/ssh/host-groups"]
+                "pages": [
+                  "documentation/platform/ssh/overview",
+                  "documentation/platform/ssh/host-groups"
+                ]
              },
              {
                "group": "Key Management (KMS)",
@@ -146,6 +149,7 @@
                  "documentation/platform/secret-rotation/ldap-password",
                  "documentation/platform/secret-rotation/mssql-credentials",
                  "documentation/platform/secret-rotation/mysql-credentials",
+                  "documentation/platform/secret-rotation/okta-client-secret",
                  "documentation/platform/secret-rotation/oracledb-credentials",
                  "documentation/platform/secret-rotation/postgres-credentials"
                ]
@@ -375,7 +379,10 @@
              },
              {
                "group": "Architecture",
-                "pages": ["internals/architecture/components", "internals/architecture/cloud"]
+                "pages": [
+                  "internals/architecture/components",
+                  "internals/architecture/cloud"
+                ]
              },
              "internals/security",
              "internals/service-tokens"
@@ -481,6 +488,7 @@
                  "integrations/app-connections/mssql",
                  "integrations/app-connections/mysql",
                  "integrations/app-connections/oci",
+                  "integrations/app-connections/okta",
                  "integrations/app-connections/oracledb",
                  "integrations/app-connections/postgres",
                  "integrations/app-connections/railway",
@@ -551,7 +559,10 @@
              "integrations/cloud/gcp-secret-manager",
              {
                "group": "Cloudflare",
-                "pages": ["integrations/cloud/cloudflare-pages", "integrations/cloud/cloudflare-workers"]
+                "pages": [
+                  "integrations/cloud/cloudflare-pages",
+                  "integrations/cloud/cloudflare-workers"
+                ]
              },
              "integrations/cloud/terraform-cloud",
              "integrations/cloud/databricks",
@@ -663,7 +674,11 @@
                  "cli/commands/reset",
                  {
                    "group": "infisical scan",
-                    "pages": ["cli/commands/scan", "cli/commands/scan-git-changes", "cli/commands/scan-install"]
+                    "pages": [
+                      "cli/commands/scan",
+                      "cli/commands/scan-git-changes",
+                      "cli/commands/scan-install"
+                    ]
                  }
                ]
              },
@@ -987,7 +1002,9 @@
                "pages": [
                  {
                    "group": "Kubernetes",
-                    "pages": ["api-reference/endpoints/dynamic-secrets/kubernetes/create-lease"]
+                    "pages": [
+                      "api-reference/endpoints/dynamic-secrets/kubernetes/create-lease"
+                    ]
                  },
                  "api-reference/endpoints/dynamic-secrets/create",
                  "api-reference/endpoints/dynamic-secrets/update",
@@ -1093,6 +1110,19 @@
                      "api-reference/endpoints/secret-rotations/mysql-credentials/update"
                    ]
                  },
+                  {
+                    "group": "Okta Client Secret",
+                    "pages": [
+                      "api-reference/endpoints/secret-rotations/okta-client-secret/create",
+                      "api-reference/endpoints/secret-rotations/okta-client-secret/delete",
+                      "api-reference/endpoints/secret-rotations/okta-client-secret/get-by-id",
+                      "api-reference/endpoints/secret-rotations/okta-client-secret/get-by-name",
+                      "api-reference/endpoints/secret-rotations/okta-client-secret/get-generated-credentials-by-id",
+                      "api-reference/endpoints/secret-rotations/okta-client-secret/list",
+                      "api-reference/endpoints/secret-rotations/okta-client-secret/rotate-secrets",
+                      "api-reference/endpoints/secret-rotations/okta-client-secret/update"
+                    ]
+                  },
                  {
                    "group": "OracleDB Credentials",
                    "pages": [
@@ -1496,6 +1526,18 @@
                      "api-reference/endpoints/app-connections/oci/delete"
                    ]
                  },
+                  {
+                    "group": "Okta",
+                    "pages": [
+                      "api-reference/endpoints/app-connections/okta/list",
+                      "api-reference/endpoints/app-connections/okta/available",
+                      "api-reference/endpoints/app-connections/okta/get-by-id",
+                      "api-reference/endpoints/app-connections/okta/get-by-name",
+                      "api-reference/endpoints/app-connections/okta/create",
+                      "api-reference/endpoints/app-connections/okta/update",
+                      "api-reference/endpoints/app-connections/okta/delete"
+                    ]
+                  },
                  {
                    "group": "OracleDB",
                    "pages": [
@@ -0,0 +1,145 @@
+---
+title: "Okta Client Secret"
+description: "Learn how to automatically rotate Okta Client Secrets."
+---
+
+## Prerequisites
+
+- Create an [Okta Connection](/integrations/app-connections/okta).
+
+## Create an Okta Client Secret Rotation in Infisical
+
+<Tabs>
+    <Tab title="Infisical UI">
+        1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
+
+        ![Secret Manager Dashboard](/images/secret-rotations-v2/generic/add-secret-rotation.png)
+
+        2. Select the **Okta Client Secret** option.
+
+        ![Select Okta Client Secret](/images/secret-rotations-v2/okta-client-secret/select-okta.png)
+
+        3. Configure the rotation behavior, then click **Next**.
+
+        ![Rotation Configuration](/images/secret-rotations-v2/okta-client-secret/configuration.png)
+
+        - **Okta Connection** - the connection that will perform the rotation of the specified application's Client Secret.
+        - **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
+        - **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
+        - **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
+
+        4. Select the Okta application whose Client Secret you want to rotate. Then click **Next**.
+
+        ![Rotation Parameters](/images/secret-rotations-v2/okta-client-secret/parameters.png)
+
+        5. Specify the secret names that the client credentials should be mapped to. Then click **Next**.
+
+        ![Rotation Secrets Mapping](/images/secret-rotations-v2/okta-client-secret/mappings.png)
+
+        - **Client ID** - the name of the secret that the application Client ID will be mapped to.
+        - **Client Secret** - the name of the secret that the rotated Client Secret will be mapped to.
+
+        6. Give your rotation a name and description (optional). Then click **Next**.
+
+        ![Rotation Details](/images/secret-rotations-v2/okta-client-secret/details.png)
+
+        - **Name** - the name of the secret rotation configuration. Must be slug-friendly.
+        - **Description** (optional) - a description of this rotation configuration.
+
+        7. Review your configuration, then click **Create Secret Rotation**.
+
+        ![Rotation Review](/images/secret-rotations-v2/okta-client-secret/review.png)
+
+        8. Your **Okta Client Secret** credentials are now available for use via the mapped secrets.
+
+        ![Rotation Created](/images/secret-rotations-v2/okta-client-secret/created.png)
+    </Tab>
+    <Tab title="API">
+        To create an Okta Client Secret Rotation, make an API request to the [Create Okta Client Secret Rotation](/api-reference/endpoints/secret-rotations/okta-client-secret/create) API endpoint.
+
+        You will first need the **Client ID** of the Okta application you want to rotate the secret for. This can be obtained from the applications dashboard.
+
+        ![Okta Client ID](/images/secret-rotations-v2/okta-client-secret/client-id.png)
+
+        ### Sample request
+
+        ```bash Request
+        curl --request POST \
+        --url https://us.infisical.com/api/v2/secret-rotations/okta-client-secret \
+        --header 'Content-Type: application/json' \
+        --data '{
+            "name": "my-okta-rotation",
+            "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+            "description": "my client secret rotation",
+            "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+            "environment": "dev",
+            "secretPath": "/",
+            "isAutoRotationEnabled": true,
+            "rotationInterval": 30,
+            "rotateAtUtc": {
+                "hours": 0,
+                "minutes": 0
+            },
+            "parameters": {
+                "clientId": "...",
+            },
+            "secretsMapping": {
+                "clientId": "OKTA_CLIENT_ID",
+                "clientSecret": "OKTA_CLIENT_SECRET"
+            }
+        }'
+        ```
+
+        ### Sample response
+
+        ```bash Response
+        {
+            "secretRotation": {
+                "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "name": "my-okta-rotation",
+                "description": "my client secret rotation",
+                "secretsMapping": {
+                    "clientId": "OKTA_CLIENT_ID",
+                    "clientSecret": "OKTA_CLIENT_SECRET"
+                },
+                "isAutoRotationEnabled": true,
+                "activeIndex": 0,
+                "folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "createdAt": "2023-11-07T05:31:56Z",
+                "updatedAt": "2023-11-07T05:31:56Z",
+                "rotationInterval": 30,
+                "rotationStatus": "success",
+                "lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
+                "lastRotatedAt": "2023-11-07T05:31:56Z",
+                "lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "nextRotationAt": "2023-11-07T05:31:56Z",
+                "connection": {
+                    "app": "okta",
+                    "name": "my-okta-connection",
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
+                },
+                "environment": {
+                    "slug": "dev",
+                    "name": "Development",
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
+                },
+                "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "folder": {
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                    "path": "/"
+                },
+                "rotateAtUtc": {
+                    "hours": 0,
+                    "minutes": 0
+                },
+                "lastRotationMessage": null,
+                "type": "okta-client-secret",
+                "parameters": {
+                    "clientId": "..."
+                }
+            }
+        }
+        ```
+    </Tab>
+</Tabs>
@@ -0,0 +1,99 @@
+---
+title: "Okta Connection"
+description: "Learn how to configure an Okta Connection for Infisical."
+---
+
+Infisical supports the use of [API Tokens](https://developer.okta.com/docs/guides/create-an-api-token/main/) to connect with Okta.
+
+## Create Okta API Token
+
+<Steps>
+    <Step title="Create API Token">
+        From the Okta admin dashboard, navigate to **Security > API > Tokens** and click **Create token**.
+
+        ![Create API Token](/images/app-connections/okta/step-1.png)
+    </Step>
+    <Step title="Provide Info">
+        Enter the token name and select **Any IP** for the second dropdown, then click **Create token**.
+
+        ![Provide Info](/images/app-connections/okta/step-2.png)
+    </Step>
+    <Step title="Copy Token">
+        Copy the token from the modal for later steps.
+
+        ![Copy Token](/images/app-connections/okta/step-3.png)
+    </Step>
+</Steps>
+
+## Create Okta Connection in Infisical
+
+<Tabs>
+    <Tab title="Infisical UI">
+        <Steps>
+            <Step title="Navigate to App Connections">
+                In your Infisical dashboard, go to **Organization Settings** and select the [**App Connections**](https://app.infisical.com/organization/app-connections) tab.
+
+                ![App Connections Tab](/images/app-connections/general/add-connection.png)
+            </Step>
+            <Step title="Select Okta Connection">
+                Click the **Add Connection** button and select **Okta** from the list of available connections.
+            </Step>
+            <Step title="Fill out Connection Modal">
+                Complete the Okta Connection form by entering:
+                - A descriptive name for the connection
+                - An optional description for future reference
+                - Your Okta instance URL
+                - The API Token from earlier steps
+
+                ![Connection Modal](/images/app-connections/okta/step-4.png)
+            </Step>
+            <Step title="Connection Created">
+                After clicking Create, your **Okta Connection** is established and ready to use with your Infisical projects.
+
+                ![Connection Created](/images/app-connections/okta/step-5.png)
+            </Step>
+        </Steps>
+    </Tab>
+    <Tab title="API">
+        To create a Okta Connection, make an API request to the [Create Okta Connection](/api-reference/endpoints/app-connections/okta/create) API endpoint.
+
+        ### Sample request
+
+        ```bash Request
+        curl    --request POST \
+                --url https://app.infisical.com/api/v1/app-connections/okta \
+                --header 'Content-Type: application/json' \
+                --data '{
+                    "name": "my-okta-connection",
+                    "method": "api-token",
+                    "credentials": {
+                        "instanceUrl": "https://example.okta.com",
+                        "apiToken": "<YOUR-API-TOKEN>"
+                    }
+                }'
+        ```
+
+        ### Sample response
+
+        ```bash Response
+        {
+          "appConnection": {
+              "id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
+              "name": "my-okta-connection",
+              "description": null,
+              "version": 1,
+              "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
+              "createdAt": "2025-04-23T19:46:34.831Z",
+              "updatedAt": "2025-04-23T19:46:34.831Z",
+              "isPlatformManagedCredentials": false,
+              "credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
+              "app": "okta",
+              "method": "api-token",
+              "credentials": {
+                  "instanceUrl": "https://example.okta.com"
+              }
+          }
+        }
+        ```
+    </Tab>
+</Tabs>