Integrate Atomicwork with Okta to streamline user authentication and access management, ensuring a secure and seamless login experience for your team. This integration enhances security protocols while simplifying access, allowing your team to focus on their work without worrying about credentials. This reduces the risk of unauthorized access by ensuring that only the right people have access to the right resources at all times.
Here are all the capabilities you can unlock with the Atomicwork - Okta integration:
SSO access to Atomicwork: Allow your employees and agents to login to Atomicwork with their Okta credentials.
Employee data sync: All employee data from Okta will be synced with Atomicwork, enabling enabling the Assistant use these attributes to deliver personalized responses.
Atom skill: Provision apps: Your employees can request and obtain application access, without waiting for an administrator to intervene. The Assistant grants access by adding the employee to the right Okta group.
Okta actions in journeys and workflows: Automate actions in Okta, such as creating accounts, managing group memberships, and suspending or deactivating accounts, through workflows and journeys.
Okta · Atomicwork | Product
Okta: Permissions and setup
Permissions
To connect your Atomicwork and Okta accounts, you need:
Atomicwork admin access: You need to org admin access in Atomicwork.
Okta admin access: You need to have admin access in Okta that will allow you to create and manage your own API tokens. Only super admins, org admins, and group admins can create tokens.
An Okta API token carries the permissions of the user who creates it, so it’s essential to have the necessary permissions for managing users and executing specific workflows within Atomicwork.
If an Okta action fails and you’re unsure if the problem is your connection, please check the token status first. Your token might have expired. Okta uses colors to show the token status.
Okta data sync
After an administrator connects an Okta account with Atomicwork, they have the option of enabling data sync so that Okta employee attributes are synced with Atomicwork.
This way, Atomicwork will be able to customize information access for employees based on their attributes
Go to Settings > App Store > Okta.
Click on Enable.
Review the attribute map that Atomicwork generated for your account. If you want to map an Okta attribute to a different attribute, you can modify the mapping on this screen.
Okta: Troubleshooting & errors
Permission constraints
Group management restrictions: If a group contains super admins, a non-super admin user will not be able to add members to that group. This restriction ensures that only users with the highest level of access can modify groups containing super admins.
Admin modification limitations: A non-super admin user’s API token will not be permitted to modify any admin accounts with higher access levels. This includes actions such as adding these admins to a group, editing their properties, or any other modifications. This restriction is in place to maintain the security and integrity of high-level administrative roles.
Reset password limitations
The Reset password skill needs to be configured by the admin.
The action works only for non-super admins.
The action can be performed only for users who have their Okta account status as Active or Password ExpiredAND have configured their self-service mechanism in their Okta profile. If the user has been invited but has not yet joined the Okta account or their account status is anything other than Active/Password expired (see the full list of Okta account statuses here), they cannot reset their password.
Okta: Employee data sync
When you integrate Atomicwork with Okta, you can also sync employee data into Atomicwork for use in workflows and other capabilities. Every 24 hours, Atomicwork syncs new users, suspended and deactivated users. Updates to users on Okta also sync every 24 hours.
Atomicwork does not delete users on the platform unless you set up inline hooks on Okta. You can also configure inline hooks if you want to sync users more frequently.
When you configure inline hooks, you can set up events that need to be communicated to Atomicwork: this could include user updates, deactivations and suspensions. Whenever we receive an event about user suspensions or deactivations, those users are deleted on Atomicwork.
Navigate to Settings > App Store and click on Settings in the Okta card**.**
Click on Enable next to Sync employee data.
You can map Okta attributes to Atomicwork attributes.
If the Manage Applications permission is provided during setup, Atomicwork will automatically fetch all available fields from Okta (including custom attributes) and display them for easy mapping.
If this permission isn’t granted, you'll need to manually enter the variable name from Okta and select the corresponding Atomicwork attribute to map each custom field you want to sync.
To find the variable names for your Okta attributes, navigate to yourOkta dashboard > Directory > Profile Editor > Default Profile.
Copy the variable name for the attribute you want to sync and paste it into the Enter reference key text box.
Click on Enable. New users and updates to users will sync every 24 hours.
To edit the attribute mapping, click on Manage attributes in the Okta settings page.
Configure Okta inline hooks
Log into the Atomicwork portal. Navigate to Settings > My Account > Public API Token
Create a new token and copy it into a safe place
Go to Okta admin console > Workflow nav item > Event hooks. Click on Create Event Hook
Enter X-Api-Key as the Authentication Field under Credentials. Enter the Public API Token you created in step 1 as the Authentication Secret.
Choose the user events you want to track. When we receive these events - "User deleted", "User suspended", "User deactivated", the user would be deleted on Atomicwork.
Skip the filter application and preview steps.
Click Verify. Once verified, Atomicwork will start listening to events from Okta and update user profiles accordingly.
Okta: Single sign-on (SSO)
Make it easy for your end-users and agents to access Atomicwork by implementing Okta Single Sign-On (SSO). This allows users to sign in using their existing Okta credentials—either by going to your Atomicwork portal or by launching Atomicwork directly from their Okta dashboard.
You can choose how your users should access the platform:
Start from Atomicwork: Users go to yourcompany.atomicwork.com and are redirected to Okta to sign in.
Start from Okta: Users click the Atomicwork app in their Okta dashboard and are signed in automatically.
Step 1: Setup an Okta application
Go to Applications > Create an App integration in your Okta admin portal
Choose "SAML 2.0" as your sign-in method
Enter an app name ("Atomicwork" should do). The logo is optional, so feel free to skip uploading the Atomicwork logo and select "Do not display application icon to users"
Step 2: Configure SAML settings
Switch to your Atomicwork account to fetch SAML settings. Go to Settings > Security > Okta SSO to find "Single sign-on URL" and "Audience URI" links. Copy these links into your Okta app settings.
Switch back to Okta admin portal. Leave the "Default RelayState" as blank.
Choose "Email address" for "NameID format"
Choose "Email" as "Application user name" and "Update application username on" setting as "Create and update".
In the "Attribute Statements" section, please add
firstName
lastName
login
id
Click "Save" and mark this as an "internal app" in the "Feedback" section
Click "Finish" and copy the metadata URL. Paste it into the SAML metadata URL field in your Atomicwork account. Click "Connect".
Okta: Using actions in journeys and workflows
When you integrate Atomicwork with identity access platforms like Okta, Azure AD, and Google Workspace, you can perform automated actions like creating a user, adding a user to a group, suspending a user, and deactivating a user.
When configuring an onboarding or offboarding journey (or even a team change journey), you can use these automated actions to automatically perform these operations instead of having to note it down on your to-do list and manually log into these platforms to perform these operations every single time.
Anything defined in the Okta API can be accessed through Atomicwork.
Add Okta actions to workflows
A workflow is triggered by an event in a request. Workflow trigger events can be service request, request, incident events (such as "incident is created" or "a reply is sent in an incident"), System events, or System or any person events. Okta actions are one type of many actions available to an IT admin to configure.
Go to Settings > Workspace > Workflows. Create a workflow or click the workflow to which you want to add actions
Click "Perform action" > "Okta actions".
Add Okta actions to journeys
Journeys can be triggered by an agent, scheduled for a certain day or triggered by certain API events like BambooHR profile creation.
Go to Settings > Journey templates. Click on the journey to which you want to add an action or create a new one from scratch.
Password strength. While you will ask that new employees reset their password when they first log in (We’d strongly recommend it), it’s still crucial to follow information security best practices, even if it’s for temporary passwords. Use dynamic placeholders to create a unique, strong password for new employees.
In journeys, Okta actions are automated actions that do not need to be manually executed by an HR or IT manager. So, you only need to specify when you want the action to be executed. Your two options are the day the employee moves to the stage or a day relative to the day an employee moves to this stage.
In journeys, you also need to name the Okta action in a way that is easy to understand so your teammates know why you’ve set it up. Okta actions will be visible to journey collaborators but not to employees who have been assigned this journey.
Click “Add/Done” to add the action to your journey or workflow.
Add an Okta user to a group
Tip: This action is most useful in onboarding journeys and can only be executed for existing Okta users. So, please make sure to create a new employee as an Okta user first before adding this action.
Choose which Okta user needs to be added to a group
Choose the Okta group you want to add a new user to. You can’t create an Okta group from Atomicwork, so please make sure to create the group on the Okta console before you set up this action.
In journeys, Okta actions are automated actions that do not need to be manually executed by an HR or IT manager. So, you only need to specify when you want the action to be executed. Your two options are the day the employee moves to the stage or a day relative to the day an employee moves to this stage.
In journeys, you also need to name the Okta action in a way that is easy to understand so your teammates know why you’ve set it up. Okta actions will be visible to journey collaborators but not to employees who have been assigned this journey.
Click “Add/Done” to add the action to your journey or workflow.
Suspend an Okta user
Tip: Suspending people in your organization is useful if you have temporary and contract workers or when your employees are on leaves of absence. You may also want to suspend a user who has permanently left your organization so that you can review their group and app assignments before deactivating them. Suspended users' app and group memberships are maintained and are reinstated when the user is unsuspended.
To set up the action, choose the Okta user whose account needs to be suspended.
In journeys, you need to specify when you want the action to be executed. Your two options are the day the employee moves to the stage or a day relative to the day an employee moves to this stage.
In journeys, name the Okta action in a way that is easy to understand so your teammates know why you’ve set it up. Okta actions will be visible to journey collaborators but not to employees who have been assigned this journey. Okta actions are automated actions that can be executed by Atomicwork directly.
Click “Add/Done” to add the action to your journey or workflow.
Deactivate an Okta account
Tip: Deactivated users will not have access to any apps and may need to be reassigned apps when reactivated. However, deactivated users will not be removed from groups until they are deleted. Users can be deleted only on the Okta app and not Atomicwork.
To set up the action, choose the Okta user whose account needs to be deactivated.
In journeys, please specify when you want the action to be executed. You don’t have to specify an assignee because Okta actions are all automated actions. You can choose to execute it on the day an employee moves to a stage or a day relative to this date
In journeys, name the Okta action in a way that is easy to understand so your teammates know why you’ve set it up. Okta actions will be visible to journey collaborators in the configuration view but not to employees who have been assigned this journey.
Click “Add/Done” to add the action to your journey.
Remove a user from a group
To set up the action, choose the Okta user account and the group from which they need to be removed.
Click "Done" to add the action to your workflow.
