diff --git a/docs/opengraph/extensions/okta/edges/okta_addmember.mdx b/docs/opengraph/extensions/okta/edges/okta_addmember.mdx index d96cb795..1011b97c 100644 --- a/docs/opengraph/extensions/okta/edges/okta_addmember.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_addmember.mdx @@ -1,27 +1,24 @@ ---- -title: 'Okta_AddMember' -description: 'Ability to add or remove members in scoped Okta groups' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) -- Traversable: ✅ - -## General Information - -The traversable Okta_AddMember edges represent custom role permissions that allow a principal (user, group, or application) to add or remove members in scoped Okta groups. These edges are created when a custom role includes the `okta.groups.members.manage` or `okta.groups.manage` permissions. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - g1("Okta_Group Finance") - g2("Okta_Group Tier 0 Admins") - app1("Okta_Application Automation") - u1 -- Okta_AddMember --> g1 - app1 -- Okta_AddMember --> g2 -``` \ No newline at end of file +--- +title: 'Okta_AddMember' +description: 'Ability to add or remove members in scoped Okta groups' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_AddMember edges represent custom role permissions that allow a principal (user, group, or application) to add or remove members in scoped Okta groups. These edges are created when a custom role includes the `okta.groups.members.manage` or `okta.groups.manage` permissions. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + g1("Okta_Group Finance") + g2("Okta_Group Tier 0 Admins") + app1("Okta_Application Automation") + u1 -- Okta_AddMember --> g1 + app1 -- Okta_AddMember --> g2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_agentmemberof.mdx b/docs/opengraph/extensions/okta/edges/okta_agentmemberof.mdx index 30639d72..1edd7565 100644 --- a/docs/opengraph/extensions/okta/edges/okta_agentmemberof.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_agentmemberof.mdx @@ -1,35 +1,32 @@ ---- -title: 'Okta_AgentMemberOf' -description: 'Membership of an Okta agent in an agent pool' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Agent](/opengraph/extensions/okta/nodes/okta_agent) -- Destination: [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) -- Traversable: ✅ - -## General Information - -Okta_AgentMemberOf edges represent membership of an [Okta_Agent](/opengraph/extensions/okta/nodes/okta_agent) in an [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool). - -Active Directory Agent Pools and their agents can be visualized in BloodHound as follows: - - -```mermaid -graph LR - ap1("Okta_AgentPool contoso.com") - ap2("Okta_AgentPool adatum.com") - a1("Okta_Agent CONTOSO-SRV1") - a2("Okta_Agent CONTOSO-SRV2") - a3("Okta_Agent ADATUM-SRV1") - a1 -- Okta_AgentMemberOf --> ap1 - a2 -- Okta_AgentMemberOf --> ap1 - a3 -- Okta_AgentMemberOf --> ap2 -``` - - -Traversable edges between [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) and AD Domain nodes are not modeled in the current version of the Okta BloodHound extension. Support for this is planned for a future release. - \ No newline at end of file +--- +title: 'Okta_AgentMemberOf' +description: 'Membership of an Okta agent in an agent pool' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +Okta_AgentMemberOf edges represent membership of an [Okta_Agent](/opengraph/extensions/okta/nodes/okta_agent) in an [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool). + +Active Directory Agent Pools and their agents can be visualized in BloodHound as follows: + +```mermaid +graph LR + ap1("Okta_AgentPool contoso.com") + ap2("Okta_AgentPool adatum.com") + a1("Okta_Agent CONTOSO-SRV1") + a2("Okta_Agent CONTOSO-SRV2") + a3("Okta_Agent ADATUM-SRV1") + a1 -- Okta_AgentMemberOf --> ap1 + a2 -- Okta_AgentMemberOf --> ap1 + a3 -- Okta_AgentMemberOf --> ap2 +``` + + +Traversable edges between [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) and AD Domain nodes are not modeled in the current version of the Okta BloodHound extension. Support for this is planned for a future release. + diff --git a/docs/opengraph/extensions/okta/edges/okta_agentpoolfor.mdx b/docs/opengraph/extensions/okta/edges/okta_agentpoolfor.mdx index 9668955f..f3ef02d7 100644 --- a/docs/opengraph/extensions/okta/edges/okta_agentpoolfor.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_agentpoolfor.mdx @@ -1,41 +1,37 @@ ---- -title: 'Okta_AgentPoolFor' -description: 'Relationship between an AD agent pool and its backing AD application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Traversable: ✅ - -## General Information - -Okta_AgentPoolFor edges connect an AD [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) to the backing [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) used for directory integration. - - -```mermaid -graph TB - subgraph Active Directory - d1("Domain contoso.com") - c1("Computer CONTOSO-SRV1$") - c2("Computer CONTOSO-SRV2$") - d1 -- Contains --> c1 - d1 -- Contains --> c2 - end - - subgraph Okta - ap1("Okta_AgentPool contoso.com") - a1("Okta_Agent CONTOSO-SRV1") - a2("Okta_Agent CONTOSO-SRV2") - app1("Okta_Application AD contoso.com") - a1 -- Okta_AgentMemberOf --> ap1 - a2 -- Okta_AgentMemberOf --> ap1 - ap1 -- Okta_AgentPoolFor --> app1 - end - - c1 -- Okta_HostsAgent --> a1 - c2 -- Okta_HostsAgent --> a2 -``` \ No newline at end of file +--- +title: 'Okta_AgentPoolFor' +description: 'Relationship between an AD agent pool and its backing AD application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +Okta_AgentPoolFor edges connect a directory [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) to the backing [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) used for directory integration. +```mermaid +graph TB + subgraph Active Directory + d1("Domain contoso.com") + c1("Computer CONTOSO-SRV1$") + c2("Computer CONTOSO-SRV2$") + d1 -- Contains --> c1 + d1 -- Contains --> c2 + end + + subgraph Okta + ap1("Okta_AgentPool contoso.com") + a1("Okta_Agent CONTOSO-SRV1") + a2("Okta_Agent CONTOSO-SRV2") + app1("Okta_Application AD contoso.com") + a1 -- Okta_AgentMemberOf --> ap1 + a2 -- Okta_AgentMemberOf --> ap1 + ap1 -- Okta_AgentPoolFor --> app1 + end + + c1 -- Okta_HostsAgent --> a1 + c2 -- Okta_HostsAgent --> a2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_apitokenfor.mdx b/docs/opengraph/extensions/okta/edges/okta_apitokenfor.mdx index 2de245e5..a5263ea4 100644 --- a/docs/opengraph/extensions/okta/edges/okta_apitokenfor.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_apitokenfor.mdx @@ -1,31 +1,28 @@ ---- -title: 'Okta_ApiTokenFor' -description: 'User ownership of an Okta API token' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_ApiToken](/opengraph/extensions/okta/nodes/okta_apitoken) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ✅ - -## General Information - -The traversable Okta_ApiTokenFor edges represent the API token assignments for users in Okta, represented by the [Okta_User](/opengraph/extensions/okta/nodes/okta_user) nodes: - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - t1("Okta_ApiToken Test App") - t2("Okta_ApiToken Postman") - t3("Okta_ApiToken Python Script") - org("Okta_Organization contoso.okta.com") - t1 -- Okta_ApiTokenFor --> u1 - t2 -- Okta_ApiTokenFor --> u2 - t3 -- Okta_ApiTokenFor --> u2 - u2 -- Okta_SuperAdmin --> org -``` \ No newline at end of file +--- +title: 'Okta_ApiTokenFor' +description: 'User ownership of an Okta API token' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_ApiTokenFor edges represent the API token assignments for users in Okta, represented by the [Okta_User](/opengraph/extensions/okta/nodes/okta_user) nodes: + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + t1("Okta_ApiToken Test App") + t2("Okta_ApiToken Postman") + t3("Okta_ApiToken Python Script") + org("Okta_Organization contoso.okta.com") + t1 -- Okta_ApiTokenFor --> u1 + t2 -- Okta_ApiTokenFor --> u2 + t3 -- Okta_ApiTokenFor --> u2 + u2 -- Okta_SuperAdmin --> org +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_appadmin.mdx b/docs/opengraph/extensions/okta/edges/okta_appadmin.mdx index 93c35670..f2b21565 100644 --- a/docs/opengraph/extensions/okta/edges/okta_appadmin.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_appadmin.mdx @@ -1,31 +1,28 @@ ---- -title: 'Okta_AppAdmin' -description: 'Application administrator role assignment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) -- Traversable: ✅ - -## General Information - -The traversable Okta_AppAdmin edges represent Application Administrator role assignments. Application Administrators can manage application configurations, user assignments, and provisioning settings for their assigned applications. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - g1("Okta_Group Salesforce Admins") - app1("Okta_Application GitHub") - app2("Okta_Application Salesforce") - is1("Okta_APIServiceIntegration Elastic Agent") - u2 -- Okta_MemberOf --> g1 - u1 -- Okta_AppAdmin --> app1 - g1 -- Okta_AppAdmin --> app2 - u1 -- Okta_AppAdmin --> is1 -``` \ No newline at end of file +--- +title: 'Okta_AppAdmin' +description: 'Application administrator role assignment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_AppAdmin edges represent Application Administrator role assignments. Application Administrators can manage application configurations, user assignments, and provisioning settings for their assigned applications. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + g1("Okta_Group Salesforce Admins") + app1("Okta_Application GitHub") + app2("Okta_Application Salesforce") + is1("Okta_APIServiceIntegration Elastic Agent") + u2 -- Okta_MemberOf --> g1 + u1 -- Okta_AppAdmin --> app1 + g1 -- Okta_AppAdmin --> app2 + u1 -- Okta_AppAdmin --> is1 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_appassignment.mdx b/docs/opengraph/extensions/okta/edges/okta_appassignment.mdx index eca5a276..9ca1b1f9 100644 --- a/docs/opengraph/extensions/okta/edges/okta_appassignment.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_appassignment.mdx @@ -1,43 +1,40 @@ ---- -title: 'Okta_AppAssignment' -description: 'Assignment of users or groups to an Okta application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Traversable: ❌ - -## General Information - -Only users that are assigned to applications can access them. Users can be assigned to applications directly or indirectly through group memberships. - -The non-traversable Okta_AppAssignment edges represent the application assignments for users and groups in Okta: - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - u3("Okta_User mary\@contoso.com") - u4("Okta_User bob\@contoso.com") - u5("Okta_User alice\@contoso.com") - g1("Okta_Group Engineering") - e("Okta_Group Everyone") - a1("Okta_Application SalesForce") - a2("Okta_Application GitHub") - a3("Okta_Application VPN") - e -. Okta_AppAssignment .-> a1 - u1 -- Okta_MemberOf --> e - u2 -- Okta_MemberOf --> e - u3 -- Okta_MemberOf --> e - u4 -- Okta_MemberOf --> e - u3 -- Okta_MemberOf --> g1 - u4 -- Okta_MemberOf --> g1 - g1 -. Okta_AppAssignment .-> a2 - u4 -. Okta_AppAssignment .-> a3 - u5 -. Okta_AppAssignment .-> a3 -``` \ No newline at end of file +--- +title: 'Okta_AppAssignment' +description: 'Assignment of users or groups to an Okta application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +Only users that are assigned to applications can access them. Users can be assigned to applications directly or indirectly through group memberships. + +The non-traversable Okta_AppAssignment edges represent the application assignments for users and groups in Okta: + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + u3("Okta_User mary\@contoso.com") + u4("Okta_User bob\@contoso.com") + u5("Okta_User alice\@contoso.com") + g1("Okta_Group Engineering") + e("Okta_Group Everyone") + a1("Okta_Application SalesForce") + a2("Okta_Application GitHub") + a3("Okta_Application VPN") + e -. Okta_AppAssignment .-> a1 + u1 -- Okta_MemberOf --> e + u2 -- Okta_MemberOf --> e + u3 -- Okta_MemberOf --> e + u4 -- Okta_MemberOf --> e + u3 -- Okta_MemberOf --> g1 + u4 -- Okta_MemberOf --> g1 + g1 -. Okta_AppAssignment .-> a2 + u4 -. Okta_AppAssignment .-> a3 + u5 -. Okta_AppAssignment .-> a3 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_contains.mdx b/docs/opengraph/extensions/okta/edges/okta_contains.mdx index 1fb92e2e..dcc763df 100644 --- a/docs/opengraph/extensions/okta/edges/okta_contains.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_contains.mdx @@ -1,48 +1,45 @@ ---- -title: 'Okta_Contains' -description: 'Contains relationship between the Okta organization and its objects' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration), [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset), [Okta_Role](/opengraph/extensions/okta/nodes/okta_role), [Okta_CustomRole](/opengraph/extensions/okta/nodes/okta_customrole), [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment), [Okta_Realm](/opengraph/extensions/okta/nodes/okta_realm), [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool), [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider), [Okta_AuthorizationServer](/opengraph/extensions/okta/nodes/okta_authorizationserver), [Okta_Policy](/opengraph/extensions/okta/nodes/okta_policy) -- Traversable: ✅ - -## General Information - -The traversable Okta_Contains edges represent the containment relationships between the organization and other entities in Okta. The organization node will have Okta_Contains edges to all other nodes in the graph, with some exceptions. - - -```mermaid -graph LR - org("Okta_Organization contoso.okta.com") - user1("Okta_User john\@contoso.com") - group1("Okta_Group IT") - app1("Okta_Application GitHub") - role1("Okta_Role Super Admin") - device1("Okta_Device John's MacBook") - realm1("Okta_Realm EU") - cr1("Okta_CustomRole Help Desk") - rs1("Okta_ResourceSet HR Resources") - ap1("Okta_AgentPool AD Sync Pool") - as1("Okta_AuthorizationServer Default Server") - ip1("Okta_IdentityProvider Google IdP") - is1("Okta_APIServiceIntegration Elastic Agent") - p1("Okta_Policy Idp Discovery Policy") - org -- Okta_Contains --> user1 - org -- Okta_Contains --> group1 - org -- Okta_Contains --> app1 - org -- Okta_Contains --> role1 - org -- Okta_Contains --> device1 - org -- Okta_Contains --> cr1 - org -- Okta_Contains --> realm1 - org -- Okta_Contains --> rs1 - org -- Okta_Contains --> ap1 - org -- Okta_Contains --> as1 - org -- Okta_Contains --> ip1 - org -- Okta_Contains --> is1 - org -- Okta_Contains --> p1 -``` \ No newline at end of file +--- +title: 'Okta_Contains' +description: 'Contains relationship between the Okta organization and its objects' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_Contains edges represent the containment relationships between the organization and other entities in Okta. The organization node will have Okta_Contains edges to all other nodes in the graph, with some exceptions. + +```mermaid +graph LR + org("Okta_Organization contoso.okta.com") + user1("Okta_User john\@contoso.com") + group1("Okta_Group IT") + app1("Okta_Application GitHub") + role1("Okta_Role Super Admin") + device1("Okta_Device John's MacBook") + realm1("Okta_Realm EU") + cr1("Okta_CustomRole Help Desk") + rs1("Okta_ResourceSet HR Resources") + ap1("Okta_AgentPool AD Sync Pool") + as1("Okta_AuthorizationServer Default Server") + ip1("Okta_IdentityProvider Google IdP") + is1("Okta_APIServiceIntegration Elastic Agent") + p1("Okta_Policy Idp Discovery Policy") + org -- Okta_Contains --> user1 + org -- Okta_Contains --> group1 + org -- Okta_Contains --> app1 + org -- Okta_Contains --> role1 + org -- Okta_Contains --> device1 + org -- Okta_Contains --> cr1 + org -- Okta_Contains --> realm1 + org -- Okta_Contains --> rs1 + org -- Okta_Contains --> ap1 + org -- Okta_Contains --> as1 + org -- Okta_Contains --> ip1 + org -- Okta_Contains --> is1 + org -- Okta_Contains --> p1 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_creatorof.mdx b/docs/opengraph/extensions/okta/edges/okta_creatorof.mdx index 7b295b5b..688d6c5f 100644 --- a/docs/opengraph/extensions/okta/edges/okta_creatorof.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_creatorof.mdx @@ -1,27 +1,24 @@ ---- -title: 'Okta_CreatorOf' -description: 'Creator relationship for API service integrations' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) -- Destination: [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) -- Traversable: ❌ - -## General Information - -The non-traversable Okta_CreatorOf edges represent the creator relationships between API Service Integration instances and users in Okta: - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - is1("Okta_APIServiceIntegration Elastic Agent") - is2("Okta_APIServiceIntegration Falcon Shield") - u1 -. Okta_CreatorOf .-> is1 - u2 -. Okta_CreatorOf .-> is2 -``` \ No newline at end of file +--- +title: 'Okta_CreatorOf' +description: 'Creator relationship for API service integrations' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable Okta_CreatorOf edges represent the creator relationships between API Service Integration instances and users in Okta: + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + is1("Okta_APIServiceIntegration Elastic Agent") + is2("Okta_APIServiceIntegration Falcon Shield") + u1 -. Okta_CreatorOf .-> is1 + u2 -. Okta_CreatorOf .-> is2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_deviceof.mdx b/docs/opengraph/extensions/okta/edges/okta_deviceof.mdx index df89c943..c6127694 100644 --- a/docs/opengraph/extensions/okta/edges/okta_deviceof.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_deviceof.mdx @@ -1,28 +1,25 @@ ---- -title: 'Okta_DeviceOf' -description: 'Ownership relationship between a device and its assigned user' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ❌ - -## General Information - -The non-traversable Okta_DeviceOf edges represent the ownership relationships between users and devices in Okta: - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - d1("Okta_Device John's MacBook") - d2("Okta_Device Steve's iPhone") - d1 -. Okta_DeviceOf .-> u1 - d1 -. Okta_DeviceOf .-> u2 - d2 -. Okta_DeviceOf .-> u2 -``` \ No newline at end of file +--- +title: 'Okta_DeviceOf' +description: 'Ownership relationship between a device and its assigned user' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable Okta_DeviceOf edges represent the ownership relationships between users and devices in Okta: + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + d1("Okta_Device John's MacBook") + d2("Okta_Device Steve's iPhone") + d1 -. Okta_DeviceOf .-> u1 + d1 -. Okta_DeviceOf .-> u2 + d2 -. Okta_DeviceOf .-> u2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_groupadmin.mdx b/docs/opengraph/extensions/okta/edges/okta_groupadmin.mdx index 6d0af89f..f8fc66cb 100644 --- a/docs/opengraph/extensions/okta/edges/okta_groupadmin.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_groupadmin.mdx @@ -1,29 +1,26 @@ ---- -title: 'Okta_GroupAdmin' -description: 'Group administrator role assignment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) -- Traversable: ✅ - -## General Information - -The traversable Okta_GroupAdmin edges represent Group Administrator (also known as User Administrator) role assignments. Group Administrators can manage users and groups within their assigned scope. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - g1("Okta_Group Marketing") - u1 -- Okta_GroupAdmin --> u2 - u1 -- Okta_GroupAdmin --> g1 - u2 -- Okta_MemberOf --> g1 -``` - -Target group memberships are flattened when the assignment is evaluated. \ No newline at end of file +--- +title: 'Okta_GroupAdmin' +description: 'Group administrator role assignment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_GroupAdmin edges represent Group Administrator (also known as User Administrator) role assignments. Group Administrators can manage users and groups within their assigned scope. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + g1("Okta_Group Marketing") + u1 -- Okta_GroupAdmin --> u2 + u1 -- Okta_GroupAdmin --> g1 + u2 -- Okta_MemberOf --> g1 +``` + +Target group memberships are flattened when the assignment is evaluated. diff --git a/docs/opengraph/extensions/okta/edges/okta_groupmembershipadmin.mdx b/docs/opengraph/extensions/okta/edges/okta_groupmembershipadmin.mdx index 68240d3c..0c3b01cb 100644 --- a/docs/opengraph/extensions/okta/edges/okta_groupmembershipadmin.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_groupmembershipadmin.mdx @@ -1,26 +1,23 @@ ---- -title: 'Okta_GroupMembershipAdmin' -description: 'Group membership administrator role assignment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) -- Traversable: ✅ - -## General Information - -The traversable Okta_GroupMembershipAdmin edges represent Group Membership Administrator role assignments. Group Membership Administrators can add and remove members from groups within their assigned scope but cannot modify the groups themselves. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - g1("Okta_Group Marketing") - g2("Okta_Group Sales") - u1 -- Okta_GroupMembershipAdmin --> g1 - u1 -- Okta_GroupMembershipAdmin --> g2 -``` \ No newline at end of file +--- +title: 'Okta_GroupMembershipAdmin' +description: 'Group membership administrator role assignment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_GroupMembershipAdmin edges represent Group Membership Administrator role assignments. Group Membership Administrators can add and remove members from groups within their assigned scope but cannot modify the groups themselves. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + g1("Okta_Group Marketing") + g2("Okta_Group Sales") + u1 -- Okta_GroupMembershipAdmin --> g1 + u1 -- Okta_GroupMembershipAdmin --> g2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_grouppull.mdx b/docs/opengraph/extensions/okta/edges/okta_grouppull.mdx index db70a72d..39b45640 100644 --- a/docs/opengraph/extensions/okta/edges/okta_grouppull.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_grouppull.mdx @@ -1,24 +1,21 @@ ---- -title: 'Okta_GroupPull' -description: 'Import of group memberships from an external application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) -- Traversable: ✅ - -## General Information - -The traversable Okta_GroupPull edges represent the group synchronization relationships from applications to Okta: - - -```mermaid -graph LR - g1("Okta_Group HR") - app1("Okta_Application contoso.com") - app1 -- Okta_GroupPull --> g1 -``` \ No newline at end of file +--- +title: 'Okta_GroupPull' +description: 'Import of group memberships from an external application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_GroupPull edges represent the group synchronization relationships from applications to Okta: + +```mermaid +graph LR + g1("Okta_Group HR") + app1("Okta_Application contoso.com") + app1 -- Okta_GroupPull --> g1 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_grouppush.mdx b/docs/opengraph/extensions/okta/edges/okta_grouppush.mdx index e4495ef4..a748e43d 100644 --- a/docs/opengraph/extensions/okta/edges/okta_grouppush.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_grouppush.mdx @@ -1,24 +1,21 @@ ---- -title: 'Okta_GroupPush' -description: 'Provisioning of group memberships to an external application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Traversable: ❌ - -## General Information - -The non-traversable Okta_GroupPush edges represent the group push assignments to applications. This indicates group provisioning and membership synchronization from Okta to external applications. - - -```mermaid -graph LR - g1("Okta_Group Engineering") - app1("Okta_Application contoso.com") - g1 -. Okta_GroupPush .-> app1 -``` \ No newline at end of file +--- +title: 'Okta_GroupPush' +description: 'Provisioning of group memberships to an external application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable Okta_GroupPush edges represent the group push assignments to applications. This indicates group provisioning and membership synchronization from Okta to external applications. + +```mermaid +graph LR + g1("Okta_Group Engineering") + app1("Okta_Application contoso.com") + g1 -. Okta_GroupPush .-> app1 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_hasrole.mdx b/docs/opengraph/extensions/okta/edges/okta_hasrole.mdx index 494b1e24..f5461826 100644 --- a/docs/opengraph/extensions/okta/edges/okta_hasrole.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_hasrole.mdx @@ -1,32 +1,29 @@ ---- -title: 'Okta_HasRole' -description: 'Assignment of a built-in or custom role to a principal' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_Role](/opengraph/extensions/okta/nodes/okta_role), [Okta_CustomRole](/opengraph/extensions/okta/nodes/okta_customrole) -- Traversable: ❌ - -## General Information - -The non-traversable Okta_HasRole edges represent the role assignments for users in Okta: - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - g1("Okta_Group IT") - a1("Okta_Application Python Script") - r1("Okta_Role Group Administrator") - r2("Okta_Role Application Administrator") - u1 -. Okta_HasRole .-> r1 - g1 -. Okta_HasRole .-> r1 - g1 -. Okta_HasRole .-> r2 - a1 -. Okta_HasRole .-> r2 - u2 -- Okta_MemberOf --> g1 -``` \ No newline at end of file +--- +title: 'Okta_HasRole' +description: 'Assignment of a built-in or custom role to a principal' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable Okta_HasRole edges represent the role assignments for users in Okta: + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + g1("Okta_Group IT") + a1("Okta_Application Python Script") + r1("Okta_Role Group Administrator") + r2("Okta_Role Application Administrator") + u1 -. Okta_HasRole .-> r1 + g1 -. Okta_HasRole .-> r1 + g1 -. Okta_HasRole .-> r2 + a1 -. Okta_HasRole .-> r2 + u2 -- Okta_MemberOf --> g1 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_hasroleassignment.mdx b/docs/opengraph/extensions/okta/edges/okta_hasroleassignment.mdx index 3c8bf766..9a6f64c2 100644 --- a/docs/opengraph/extensions/okta/edges/okta_hasroleassignment.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_hasroleassignment.mdx @@ -1,42 +1,39 @@ ---- -title: 'Okta_HasRoleAssignment' -description: 'Relationship between a principal and a role assignment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) -- Traversable: ❌ - -## General Information - -The Okta_HasRoleAssignment edges connect users, groups, and applications to their respective [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes. The [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) edges connect the [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes to the resources they are scoped to, such as the organization or specific groups or applications. - - -```mermaid -graph TB - ra1("Okta_RoleAssignment Help Desk Administrator") - ra2("Okta_RoleAssignment Super Administrator") - r1("Okta_Role Help Desk Administrator") - r2("Okta_Role Super Administrator") - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - u3("Okta_User alice\@contoso.com") - g1("Okta_Group Seattle Help Desk") - g2("Okta_Group Seattle Office") - org("Okta_Organization contoso.okta.com") - - u1 -- Okta_MemberOf --> g1 - g1 -. Okta_HasRoleAssignment .-> ra1 - g1 -. Okta_HasRole .-> r1 - g1 -- Okta_HelpDeskAdmin --> u3 - u3 -- Okta_MemberOf --> g2 - ra1 -. Okta_ScopedTo .-> g2 - u2 -. Okta_HasRoleAssignment .-> ra2 - ra2 -. Okta_ScopedTo .-> org - u2 -- Okta_SuperAdmin --> org - u2 -. Okta_HasRole .-> r2 -``` \ No newline at end of file +--- +title: 'Okta_HasRoleAssignment' +description: 'Relationship between a principal and a role assignment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The Okta_HasRoleAssignment edges connect users, groups, and applications to their respective [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes. The [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) edges connect the [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes to the resources they are scoped to, such as the organization or specific groups or applications. + +```mermaid +graph TB + ra1("Okta_RoleAssignment Help Desk Administrator") + ra2("Okta_RoleAssignment Super Administrator") + r1("Okta_Role Help Desk Administrator") + r2("Okta_Role Super Administrator") + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + u3("Okta_User alice\@contoso.com") + g1("Okta_Group Seattle Help Desk") + g2("Okta_Group Seattle Office") + org("Okta_Organization contoso.okta.com") + + u1 -- Okta_MemberOf --> g1 + g1 -. Okta_HasRoleAssignment .-> ra1 + g1 -. Okta_HasRole .-> r1 + g1 -- Okta_HelpDeskAdmin --> u3 + u3 -- Okta_MemberOf --> g2 + ra1 -. Okta_ScopedTo .-> g2 + u2 -. Okta_HasRoleAssignment .-> ra2 + ra2 -. Okta_ScopedTo .-> org + u2 -- Okta_SuperAdmin --> org + u2 -. Okta_HasRole .-> r2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_helpdeskadmin.mdx b/docs/opengraph/extensions/okta/edges/okta_helpdeskadmin.mdx index 7fc031c5..2c24393a 100644 --- a/docs/opengraph/extensions/okta/edges/okta_helpdeskadmin.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_helpdeskadmin.mdx @@ -1,27 +1,24 @@ ---- -title: 'Okta_HelpDeskAdmin' -description: 'Help desk administrator role assignment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ✅ - -## General Information - -The traversable Okta_HelpDeskAdmin edges represent Help Desk Administrator role assignments. Help Desk Administrators can perform password resets, unlock accounts, and reset MFA factors for users within their assigned scope. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - g1("Okta_Group Help Desk") - u2("Okta_User alice\@contoso.com") - u3("Okta_User bob\@contoso.com") - u1 -- Okta_HelpDeskAdmin --> u2 - g1 -- Okta_HelpDeskAdmin --> u3 -``` \ No newline at end of file +--- +title: 'Okta_HelpDeskAdmin' +description: 'Help desk administrator role assignment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_HelpDeskAdmin edges represent Help Desk Administrator role assignments. Help Desk Administrators can perform password resets, unlock accounts, and reset MFA factors for users within their assigned scope. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + g1("Okta_Group Help Desk") + u2("Okta_User alice\@contoso.com") + u3("Okta_User bob\@contoso.com") + u1 -- Okta_HelpDeskAdmin --> u2 + g1 -- Okta_HelpDeskAdmin --> u3 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_hostsagent.mdx b/docs/opengraph/extensions/okta/edges/okta_hostsagent.mdx index c6dc844a..2992119e 100644 --- a/docs/opengraph/extensions/okta/edges/okta_hostsagent.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_hostsagent.mdx @@ -1,37 +1,34 @@ ---- -title: 'Okta_HostsAgent' -description: 'Relationship between an AD server and the Okta agent running on that host' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Computer](/resources/nodes/computer) -- Destination: [Okta_Agent](/opengraph/extensions/okta/nodes/okta_agent) -- Traversable: ✅ - -## General Information - -Hybrid Okta_HostsAgent edges connect an AD Computer node to the [Okta_Agent](/opengraph/extensions/okta/nodes/okta_agent) running on that host. - - -```mermaid -graph LR - subgraph ad["Active Directory"] - d1("Domain contoso.com") - c1("Computer LON-SRV1$") - c2("Computer NY-SRV2$") - d1 -- Contains --> c1 - d1 -- Contains --> c2 - end - subgraph okta["Okta"] - ap1("Okta_AgentPool contoso.com") - a1("Okta_Agent LON-SRV1") - a2("Okta_Agent NY-SRV2") - a1 -- Okta_AgentMemberOf --> ap1 - a2 -- Okta_AgentMemberOf --> ap1 - end - c1 -- Okta_HostsAgent --> a1 - c2 -- Okta_HostsAgent --> a2 -``` \ No newline at end of file +--- +title: 'Okta_HostsAgent' +description: 'Relationship between an AD server and the Okta agent running on that host' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +Hybrid Okta_HostsAgent edges connect an AD Computer node to the [Okta_Agent](/opengraph/extensions/okta/nodes/okta_agent) running on that host. + +```mermaid +graph LR + subgraph ad["Active Directory"] + d1("Domain contoso.com") + c1("Computer LON-SRV1$") + c2("Computer NY-SRV2$") + d1 -- Contains --> c1 + d1 -- Contains --> c2 + end + subgraph okta["Okta"] + ap1("Okta_AgentPool contoso.com") + a1("Okta_Agent LON-SRV1") + a2("Okta_Agent NY-SRV2") + a1 -- Okta_AgentMemberOf --> ap1 + a2 -- Okta_AgentMemberOf --> ap1 + end + c1 -- Okta_HostsAgent --> a1 + c2 -- Okta_HostsAgent --> a2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_identityproviderfor.mdx b/docs/opengraph/extensions/okta/edges/okta_identityproviderfor.mdx index 8e2e1bf0..6c089a68 100644 --- a/docs/opengraph/extensions/okta/edges/okta_identityproviderfor.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_identityproviderfor.mdx @@ -1,29 +1,26 @@ ---- -title: 'Okta_IdentityProviderFor' -description: 'Trust relationship between an identity provider and Okta users' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ✅ - -## General Information - -The traversable Okta_IdentityProviderFor edges represent the relationships between identity providers and the users who authenticate through them: - - -```mermaid -graph LR - idp1("Okta_IdentityProvider Google") - idp2("Okta_IdentityProvider Contoso SAML") - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@gmail.com") - u3("Okta_User bob\@contoso.com") - idp1 -- Okta_IdentityProviderFor --> u2 - idp2 -- Okta_IdentityProviderFor --> u1 - idp2 -- Okta_IdentityProviderFor --> u3 -``` \ No newline at end of file +--- +title: 'Okta_IdentityProviderFor' +description: 'Trust relationship between an identity provider and Okta users' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_IdentityProviderFor edges represent the relationships between identity providers and the users who authenticate through them: + +```mermaid +graph LR + idp1("Okta_IdentityProvider Google") + idp2("Okta_IdentityProvider Contoso SAML") + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@gmail.com") + u3("Okta_User bob\@contoso.com") + idp1 -- Okta_IdentityProviderFor --> u2 + idp2 -- Okta_IdentityProviderFor --> u1 + idp2 -- Okta_IdentityProviderFor --> u3 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_idpgroupassignment.mdx b/docs/opengraph/extensions/okta/edges/okta_idpgroupassignment.mdx index 9e0533ed..99b77650 100644 --- a/docs/opengraph/extensions/okta/edges/okta_idpgroupassignment.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_idpgroupassignment.mdx @@ -1,28 +1,25 @@ ---- -title: 'Okta_IdpGroupAssignment' -description: 'Identity provider group assignment to an Okta group' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider) -- Destination: [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) -- Traversable: ❌ - -## General Information - -The non-traversable Okta_IdpGroupAssignment edges represent groups automatically assigned to users based on identity provider attributes or user claims: - - -```mermaid -graph LR - idp1("Okta_IdentityProvider Microsoft Login") - g1("Okta_Group Contractors") - g2("Okta_Group Employees") - g3("Okta_Group Entra ID Users") - idp1 -. Okta_IdpGroupAssignment .-> g1 - idp1 -. Okta_IdpGroupAssignment .-> g2 - idp1 -. Okta_IdpGroupAssignment .-> g3 -``` \ No newline at end of file +--- +title: 'Okta_IdpGroupAssignment' +description: 'Identity provider group assignment to an Okta group' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable Okta_IdpGroupAssignment edges represent groups automatically assigned to users based on identity provider attributes or user claims: + +```mermaid +graph LR + idp1("Okta_IdentityProvider Microsoft Login") + g1("Okta_Group Contractors") + g2("Okta_Group Employees") + g3("Okta_Group Entra ID Users") + idp1 -. Okta_IdpGroupAssignment .-> g1 + idp1 -. Okta_IdpGroupAssignment .-> g2 + idp1 -. Okta_IdpGroupAssignment .-> g3 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_inboundorgsso.mdx b/docs/opengraph/extensions/okta/edges/okta_inboundorgsso.mdx index 74e0f79a..f132d1d8 100644 --- a/docs/opengraph/extensions/okta/edges/okta_inboundorgsso.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_inboundorgsso.mdx @@ -1,27 +1,24 @@ ---- -title: 'Okta_InboundOrgSSO' -description: 'Single sign-on from an external organization into Okta' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [AZTenant](/resources/nodes/az-tenant) -- Destination: [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider) -- Traversable: ✅ - -## General Information - -The Okta_InboundOrgSSO and [Okta_InboundSSO](/opengraph/extensions/okta/edges/okta_inboundsso) hybrid edges connect external tenants and users to Okta entities: - - -```mermaid -graph LR - t1("AZTenant Contoso") - idp1("Okta_IdentityProvider Microsoft Login") - u1("AZUser alice\@contoso.com") - ou1("Okta_User alice\@contoso.com") - t1 -- Okta_InboundOrgSSO --> idp1 - u1 -- Okta_InboundSSO --> ou1 -``` \ No newline at end of file +--- +title: 'Okta_InboundOrgSSO' +description: 'Single sign-on from an external organization into Okta' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The Okta_InboundOrgSSO and [Okta_InboundSSO](/opengraph/extensions/okta/edges/okta_inboundsso) hybrid edges connect external tenants and users to Okta entities: + +```mermaid +graph LR + t1("AZTenant Contoso") + idp1("Okta_IdentityProvider Microsoft Login") + u1("AZUser alice\@contoso.com") + ou1("Okta_User alice\@contoso.com") + t1 -- Okta_InboundOrgSSO --> idp1 + u1 -- Okta_InboundSSO --> ou1 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_inboundsso.mdx b/docs/opengraph/extensions/okta/edges/okta_inboundsso.mdx index cf733451..e5bf4fe2 100644 --- a/docs/opengraph/extensions/okta/edges/okta_inboundsso.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_inboundsso.mdx @@ -1,27 +1,24 @@ ---- -title: 'Okta_InboundSSO' -description: 'Single sign-on from an external identity provider into Okta' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [AZUser](/resources/nodes/az-user) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ✅ - -## General Information - -The [Okta_InboundOrgSSO](/opengraph/extensions/okta/edges/okta_inboundorgsso) and Okta_InboundSSO hybrid edges connect external tenants and users to Okta entities: - - -```mermaid -graph LR - t1("AZTenant Contoso") - idp1("Okta_IdentityProvider Microsoft Login") - u1("AZUser alice\@contoso.com") - ou1("Okta_User alice\@contoso.com") - t1 -- Okta_InboundOrgSSO --> idp1 - u1 -- Okta_InboundSSO --> ou1 -``` \ No newline at end of file +--- +title: 'Okta_InboundSSO' +description: 'Single sign-on from an external identity provider into Okta' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The [Okta_InboundOrgSSO](/opengraph/extensions/okta/edges/okta_inboundorgsso) and Okta_InboundSSO hybrid edges connect external tenants and users to Okta entities: + +```mermaid +graph LR + t1("AZTenant Contoso") + idp1("Okta_IdentityProvider Microsoft Login") + u1("AZUser alice\@contoso.com") + ou1("Okta_User alice\@contoso.com") + t1 -- Okta_InboundOrgSSO --> idp1 + u1 -- Okta_InboundSSO --> ou1 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_kerberossso.mdx b/docs/opengraph/extensions/okta/edges/okta_kerberossso.mdx index bb382abd..a7d250ca 100644 --- a/docs/opengraph/extensions/okta/edges/okta_kerberossso.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_kerberossso.mdx @@ -1,35 +1,32 @@ ---- -title: 'Okta_KerberosSSO' -description: 'Agentless desktop SSO relationship from on-prem AD user account to Okta AD application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [User](/resources/nodes/user) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Traversable: ✅ - -## General Information - -Hybrid traversable Okta_KerberosSSO edges represent [agentless desktop SSO](https://help.okta.com/en-us/content/topics/directory/ad-dsso-about-workflow.htm) trust from an on-prem AD User account to an AD-backed [Okta_Application](/opengraph/extensions/okta/nodes/okta_application). - - -```mermaid -graph LR - subgraph ad["Active Directory"] - d1("Domain contoso.com") - u1("User SPN:HTTP/contoso.kerberos.okta.com") - u2("User jane.doe\@contoso.com") - d1 -- "Contains" --> u1 - d1 -- "Contains" --> u2 - end - subgraph okta["Okta"] - app1("Okta_Application contoso.com") - u3("Okta_User jane.doe\@contoso.com") - app1 -. Okta_UserPull .-> u3 - end - u1 -- Okta_KerberosSSO --> app1 - u2 -. Okta_UserSync .-> u3 -``` \ No newline at end of file +--- +title: 'Okta_KerberosSSO' +description: 'Agentless desktop SSO relationship from on-prem AD user account to Okta AD application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +Hybrid traversable Okta_KerberosSSO edges represent [agentless desktop SSO](https://help.okta.com/en-us/content/topics/directory/ad-dsso-about-workflow.htm) trust from an on-prem AD User account to an AD-backed [Okta_Application](/opengraph/extensions/okta/nodes/okta_application). + +```mermaid +graph LR + subgraph ad["Active Directory"] + d1("Domain contoso.com") + u1("User SPN:HTTP/contoso.kerberos.okta.com") + u2("User jane.doe\@contoso.com") + d1 -- "Contains" --> u1 + d1 -- "Contains" --> u2 + end + subgraph okta["Okta"] + app1("Okta_Application contoso.com") + u3("Okta_User jane.doe\@contoso.com") + app1 -. Okta_UserPull .-> u3 + end + u1 -- Okta_KerberosSSO --> app1 + u2 -. Okta_UserSync .-> u3 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_keyof.mdx b/docs/opengraph/extensions/okta/edges/okta_keyof.mdx index e843e43e..b4e5b354 100644 --- a/docs/opengraph/extensions/okta/edges/okta_keyof.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_keyof.mdx @@ -1,31 +1,28 @@ ---- -title: 'Okta_KeyOf' -description: 'JSON Web Key associated with an Okta application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_JWK](/opengraph/extensions/okta/nodes/okta_jwk) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Traversable: ✅ - -## General Information - -The traversable Okta_KeyOf edges represent the relationships between applications [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) and their JWKs: - - -```mermaid -graph LR - app1("Okta_Application OktaHound Collector") - app2("Okta_Application Security Scanner") - key1("Okta_JWK ABC123") - key2("Okta_JWK DEF456") - key3("Okta_JWK GHI789") - key1 -- Okta_KeyOf --> app1 - key2 -- Okta_KeyOf --> app2 - key3 -- Okta_KeyOf --> app2 -``` - -Possession of the private key corresponding to a JWK allows an attacker to authenticate as the application. The Okta_KeyOf edge can be used in BloodHound to understand which applications use JWK-based authentication and trace potential attack paths involving compromised private keys. \ No newline at end of file +--- +title: 'Okta_KeyOf' +description: 'JSON Web Key associated with an Okta application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_KeyOf edges represent the relationships between applications [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) and their JWKs: + +```mermaid +graph LR + app1("Okta_Application OpenHound Okta Collector") + app2("Okta_Application Security Scanner") + key1("Okta_JWK ABC123") + key2("Okta_JWK DEF456") + key3("Okta_JWK GHI789") + key1 -- Okta_KeyOf --> app1 + key2 -- Okta_KeyOf --> app2 + key3 -- Okta_KeyOf --> app2 +``` + +Possession of the private key corresponding to a JWK allows an attacker to authenticate as the application. The Okta_KeyOf edge can be used in BloodHound to understand which applications use JWK-based authentication and trace potential attack paths involving compromised private keys. diff --git a/docs/opengraph/extensions/okta/edges/okta_manageapp.mdx b/docs/opengraph/extensions/okta/edges/okta_manageapp.mdx index 9ce8e3eb..14e6f348 100644 --- a/docs/opengraph/extensions/okta/edges/okta_manageapp.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_manageapp.mdx @@ -1,27 +1,24 @@ ---- -title: 'Okta_ManageApp' -description: 'Ability to manage scoped Okta applications' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Traversable: ✅ - -## General Information - -The traversable Okta_ManageApp edges correspond to the `okta.apps.manage` custom role permissions that allow a principal (user, group, or application) to fully manage Okta applications and their members. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - g1("Okta_Group App Operators") - app1("Okta_Application GitHub") - app2("Okta_Application Salesforce") - u1 -- Okta_ManageApp --> app1 - g1 -- Okta_ManageApp --> app2 -``` \ No newline at end of file +--- +title: 'Okta_ManageApp' +description: 'Ability to manage scoped Okta applications' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_ManageApp edges correspond to the `okta.apps.manage` custom role permissions that allow a principal (user, group, or application) to fully manage Okta applications and their members. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + g1("Okta_Group App Operators") + app1("Okta_Application GitHub") + app2("Okta_Application Salesforce") + u1 -- Okta_ManageApp --> app1 + g1 -- Okta_ManageApp --> app2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_managerof.mdx b/docs/opengraph/extensions/okta/edges/okta_managerof.mdx index 19aef1c8..d7b034af 100644 --- a/docs/opengraph/extensions/okta/edges/okta_managerof.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_managerof.mdx @@ -1,34 +1,31 @@ ---- -title: 'Okta_ManagerOf' -description: 'Manager relationship between Okta users' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ❌ - -## General Information - -Okta uses the `Manager` and `ManagerId` user profile attributes to represent managerial relationships. Unfortunately, these attributes can have any arbitrary value and their referential integrity is not enforced by Okta. They are not even synchronized from external directories by default. - -Our recommendation is to map the `ManagerId` attribute to the login of the manager in Okta. When synchronizing users from Active Directory, the `getManagerUser("active_directory").login` mapping expression can be used to achieve this. Such values are automatically recognized by the OpenHound Okta collector. - -The **non-traversable** Okta_ManagerOf edges represent the organizational structure in BloodHound: - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - u3("Okta_User mary\@contoso.com") - u4("Okta_User bob\@contoso.com") - u5("Okta_User alice\@contoso.com") - u1 -. Okta_ManagerOf .-> u2 - u1 -. Okta_ManagerOf .-> u3 - u3 -. Okta_ManagerOf .-> u4 - u3 -. Okta_ManagerOf .-> u5 -``` \ No newline at end of file +--- +title: 'Okta_ManagerOf' +description: 'Manager relationship between Okta users' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +Okta uses the `Manager` and `ManagerId` user profile attributes to represent managerial relationships. Unfortunately, these attributes can have any arbitrary value and their referential integrity is not enforced by Okta. They are not even synchronized from external directories by default. + +Our recommendation is to map the `ManagerId` attribute to the login of the manager in Okta. When synchronizing users from Active Directory, the `getManagerUser("active_directory").login` mapping expression can be used to achieve this. Such values are automatically recognized by the OpenHound Okta collector. + +The **non-traversable** Okta_ManagerOf edges represent the organizational structure in BloodHound: + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + u3("Okta_User mary\@contoso.com") + u4("Okta_User bob\@contoso.com") + u5("Okta_User alice\@contoso.com") + u1 -. Okta_ManagerOf .-> u2 + u1 -. Okta_ManagerOf .-> u3 + u3 -. Okta_ManagerOf .-> u4 + u3 -. Okta_ManagerOf .-> u5 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_memberof.mdx b/docs/opengraph/extensions/okta/edges/okta_memberof.mdx index ee716651..b23dd95a 100644 --- a/docs/opengraph/extensions/okta/edges/okta_memberof.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_memberof.mdx @@ -1,30 +1,27 @@ ---- -title: 'Okta_MemberOf' -description: 'Membership of a user in an Okta group' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Destination: [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) -- Traversable: ✅ - -## General Information - -The traversable Okta_MemberOf edges represent the membership relationships between users and groups in Okta: - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - u3("Okta_User mary\@contoso.com") - g1("Okta_Group Marketing") - g2("Okta_Group Sales") - u1 -- Okta_MemberOf --> g1 - u2 -- Okta_MemberOf --> g1 - u2 -- Okta_MemberOf --> g2 - u3 -- Okta_MemberOf --> g2 -``` \ No newline at end of file +--- +title: 'Okta_MemberOf' +description: 'Membership of a user in an Okta group' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_MemberOf edges represent the membership relationships between users and groups in Okta: + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + u3("Okta_User mary\@contoso.com") + g1("Okta_Group Marketing") + g2("Okta_Group Sales") + u1 -- Okta_MemberOf --> g1 + u2 -- Okta_MemberOf --> g1 + u2 -- Okta_MemberOf --> g2 + u3 -- Okta_MemberOf --> g2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_membershipsync.mdx b/docs/opengraph/extensions/okta/edges/okta_membershipsync.mdx index 87e50dff..1637d18d 100644 --- a/docs/opengraph/extensions/okta/edges/okta_membershipsync.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_membershipsync.mdx @@ -1,55 +1,52 @@ ---- -title: 'Okta_MembershipSync' -description: 'Bidirectional synchronization between Okta groups and external groups' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Group](/resources/nodes/group), [AZGroup](/resources/nodes/az-group) -- Destination: [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Group](/resources/nodes/group), [AZGroup](/resources/nodes/az-group) -- Traversable: ✅ - -## General Information - -The traversable hybrid Okta_MembershipSync edges represent the synchronization relationships between groups in external directories and their corresponding groups in Okta: - - -```mermaid -graph TB - subgraph ad["Active Directory"] - adg1("Group IT") - adg2("Group HR") - end - subgraph okta["Okta Org A"] - g1("Okta_Group IT") - g2("Okta_Group HR") - adg1 -- Okta_MembershipSync --> g1 - g2 -- Okta_MembershipSync --> adg2 - end - subgraph okta2["Okta Org B"] - g3("Okta_Group IT") - g1 -- Okta_MembershipSync --> g3 - end +--- +title: 'Okta_MembershipSync' +description: 'Bidirectional synchronization between Okta groups and external groups' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable hybrid Okta_MembershipSync edges represent the synchronization relationships between groups in external directories and their corresponding groups in Okta: + +```mermaid +graph TB + subgraph ad["Active Directory"] + adg1("Group IT") + adg2("Group HR") + end + subgraph okta["Okta Org A"] + g1("Okta_Group IT") + g2("Okta_Group HR") + adg1 -- Okta_MembershipSync --> g1 + g2 -- Okta_MembershipSync --> adg2 + end + subgraph okta2["Okta Org B"] + g3("Okta_Group IT") + g1 -- Okta_MembershipSync --> g3 + end +``` + +```mermaid +graph LR + subgraph source_org["Okta Org Contoso"] + u1("Okta_User alice\@contoso.com") + g1("Okta_Group IT") + app1("Okta_Application Adatum Org2Org App") + end + subgraph target_org["Okta Org Adatum"] + u2("Okta_User alice\@adatum.com") + g2("Okta_Group IT") + app2("Okta_Application Contoso Sync API Service") + end + u1 -->|Okta_MemberOf| g1 + u1 .->|Okta_UserSync| u2 + u1 .->|Okta_UserPush| app1 + u2 -->|Okta_MemberOf| g2 + g1 .->|Okta_GroupPush| app1 + g1 -->|Okta_MembershipSync| g2 ``` - -```mermaid -graph LR - subgraph source_org["Okta Org Contoso"] - u1("Okta_User alice\@contoso.com") - g1("Okta_Group IT") - app1("Okta_Application Adatum Org2Org App") - end - subgraph target_org["Okta Org Adatum"] - u2("Okta_User alice\@adatum.com") - g2("Okta_Group IT") - app2("Okta_Application Contoso Sync API Service") - end - u1 -->|Okta_MemberOf| g1 - u1 .->|Okta_UserSync| u2 - u1 .->|Okta_UserPush| app1 - u2 -->|Okta_MemberOf| g2 - g1 .->|Okta_GroupPush| app1 - g1 -->|Okta_MembershipSync| g2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/okta/edges/okta_mobileadmin.mdx b/docs/opengraph/extensions/okta/edges/okta_mobileadmin.mdx index cd5d0d29..3e25dc00 100644 --- a/docs/opengraph/extensions/okta/edges/okta_mobileadmin.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_mobileadmin.mdx @@ -1,26 +1,23 @@ ---- -title: 'Okta_MobileAdmin' -description: 'Mobile administrator role assignment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) -- Traversable: ✅ - -## General Information - -The traversable Okta_MobileAdmin edges represent Mobile Administrator role assignments. Mobile Administrators can manage mobile device settings and configurations within their assigned scope. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - d1("Okta_Device Alice's iPhone") - d2("Okta_Device Bob's MacBook") - u1 -- Okta_MobileAdmin --> d1 - u1 -- Okta_MobileAdmin --> d2 -``` \ No newline at end of file +--- +title: 'Okta_MobileAdmin' +description: 'Mobile administrator role assignment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_MobileAdmin edges represent Mobile Administrator role assignments. Mobile Administrators can manage mobile device settings and configurations within their assigned scope. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + d1("Okta_Device Alice's iPhone") + d2("Okta_Device Bob's MacBook") + u1 -- Okta_MobileAdmin --> d1 + u1 -- Okta_MobileAdmin --> d2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_orgadmin.mdx b/docs/opengraph/extensions/okta/edges/okta_orgadmin.mdx index 8a3137a9..9940df92 100644 --- a/docs/opengraph/extensions/okta/edges/okta_orgadmin.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_orgadmin.mdx @@ -1,28 +1,25 @@ ---- -title: 'Okta_OrgAdmin' -description: 'Organization administrator role assignment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) -- Traversable: ✅ - -## General Information - -The traversable Okta_OrgAdmin edges represent Organization Administrator role assignments. Organization Administrators can manage most organizational settings except for administrative role assignments and some security settings. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - g1("Okta_Group IT") - d1("Okta_Device John's MacBook") - u1 -- Okta_OrgAdmin --> u2 - u1 -- Okta_OrgAdmin --> g1 - u1 -- Okta_OrgAdmin --> d1 -``` \ No newline at end of file +--- +title: 'Okta_OrgAdmin' +description: 'Organization administrator role assignment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_OrgAdmin edges represent Organization Administrator role assignments. Organization Administrators can manage most organizational settings except for administrative role assignments and some security settings. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + g1("Okta_Group IT") + d1("Okta_Device John's MacBook") + u1 -- Okta_OrgAdmin --> u2 + u1 -- Okta_OrgAdmin --> g1 + u1 -- Okta_OrgAdmin --> d1 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_orgswa.mdx b/docs/opengraph/extensions/okta/edges/okta_orgswa.mdx index d6e51112..43055ae7 100644 --- a/docs/opengraph/extensions/okta/edges/okta_orgswa.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_orgswa.mdx @@ -1,34 +1,31 @@ ---- -title: 'Okta_OrgSWA' -description: 'Secure Web Authentication from an Okta application to an external organization' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [jamf_SSOIntegration](/opengraph/extensions/jamf/nodes/jamf_ssointegration), [OP_Account](https://github.com/SpecterOps/1PassHound), [SNOW_Account](https://github.com/SpecterOps/SnowHound) -- Traversable: ❌ - -## General Information - -The non-traversable Okta_OrgSWA edges represent the Secure Web Authentication (SWA) relationships between Okta applications and supported external organizations or tenants. SWA stores user credentials in Okta and automatically fills them in when users access the application, which is less secure than federated SSO protocols. - - -```mermaid -graph LR - subgraph okta["OktaHound"] - direction TB - o("Okta_Organization contoso.okta.com") - app1("Okta_Application Jamf Pro SWA") - o -- Okta_Contains --> app1 - end - subgraph "Jamf" - direction TB - jamf("jamf_SSOIntegration contoso.jamfcloud.com-SSO") - app1 -. Okta_OrgSWA .-> jamf - end -``` - +--- +title: 'Okta_OrgSWA' +description: 'Secure Web Authentication from an Okta application to an external organization' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable Okta_OrgSWA edges represent the Secure Web Authentication (SWA) relationships between Okta applications and supported external organizations or tenants. SWA stores user credentials in Okta and automatically fills them in when users access the application, which is less secure than federated SSO protocols. + +```mermaid +graph LR + subgraph okta["OpenHound Okta"] + direction TB + o("Okta_Organization contoso.okta.com") + app1("Okta_Application Jamf Pro SWA") + o -- Okta_Contains --> app1 + end + subgraph "Jamf" + direction TB + jamf("jamf_SSOIntegration contoso.jamfcloud.com-SSO") + app1 -. Okta_OrgSWA .-> jamf + end +``` + The respective BloodHound collectors, e.g., OpenHound Github for GitHub organizations and OpenHound Jamf for Jamf Pro tenants, must be used to gather the external node information. diff --git a/docs/opengraph/extensions/okta/edges/okta_outboundorgsso.mdx b/docs/opengraph/extensions/okta/edges/okta_outboundorgsso.mdx index d7c8c7d6..ab9b1bd4 100644 --- a/docs/opengraph/extensions/okta/edges/okta_outboundorgsso.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_outboundorgsso.mdx @@ -1,41 +1,38 @@ ---- -title: 'Okta_OutboundOrgSSO' -description: 'Single sign-on from an Okta application to an external organization' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [AZTenant](/resources/nodes/az-tenant), [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [jamf_SSOIntegration](/opengraph/extensions/jamf/nodes/jamf_ssointegration), [SNOW_Account](https://github.com/SpecterOps/SnowHound), [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider) -- Traversable: ✅ - -## General Information - -The traversable Okta_OutboundOrgSSO edges represent the Single Sign-On (SSO) relationships between Okta applications and supported external organizations or tenants, such as GitHub Enterprise or Jamf Pro, using SAML 2.0 or OIDC protocols. - - -```mermaid -graph LR - subgraph okta["OktaHound"] - direction TB - o("Okta_Organization contoso.okta.com") - app1("Okta_Application GitHub Enterprise Cloud") - app2("Okta_Application Jamf Pro SAML") - o -- Okta_Contains --> app1 - o -- Okta_Contains --> app2 - end - subgraph "GitHub" - direction TB - ghorg("GH_Organization Contoso") - app1 -- Okta_OutboundOrgSSO --> ghorg - end - subgraph "Jamf" - direction TB - jamf("jamf_SSOIntegration contoso.jamfcloud.com-SSO") - app2 -- Okta_OutboundOrgSSO --> jamf - end -``` - +--- +title: 'Okta_OutboundOrgSSO' +description: 'Single sign-on from an Okta application to an external organization' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_OutboundOrgSSO edges represent the Single Sign-On (SSO) relationships between Okta applications and supported external organizations or tenants, such as GitHub Enterprise or Jamf Pro, using SAML 2.0 or OIDC protocols. + +```mermaid +graph LR + subgraph okta["OpenHound Okta"] + direction TB + o("Okta_Organization contoso.okta.com") + app1("Okta_Application GitHub Enterprise Cloud") + app2("Okta_Application Jamf Pro SAML") + o -- Okta_Contains --> app1 + o -- Okta_Contains --> app2 + end + subgraph "GitHub" + direction TB + ghorg("GH_Organization Contoso") + app1 -- Okta_OutboundOrgSSO --> ghorg + end + subgraph "Jamf" + direction TB + jamf("jamf_SSOIntegration contoso.jamfcloud.com-SSO") + app2 -- Okta_OutboundOrgSSO --> jamf + end +``` + The respective BloodHound collectors, e.g., OpenHound Github for GitHub organizations and OpenHound Jamf for Jamf Pro tenants, must be used to gather the external node information. diff --git a/docs/opengraph/extensions/okta/edges/okta_outboundsso.mdx b/docs/opengraph/extensions/okta/edges/okta_outboundsso.mdx index 46414312..050131bb 100644 --- a/docs/opengraph/extensions/okta/edges/okta_outboundsso.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_outboundsso.mdx @@ -1,39 +1,36 @@ ---- -title: 'Okta_OutboundSSO' -description: 'Single sign-on from Okta to an external identity provider' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Destination: [AZUser](/resources/nodes/az-user), [GH_User](/opengraph/extensions/github/nodes/gh_user), [jamf_Account](/opengraph/extensions/jamf/nodes/jamf_account), [SNOW_User](https://github.com/SpecterOps/SnowHound), [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ✅ - -## General Information - -The traversable hybrid Okta_OutboundSSO edges represent Single Sign-On relationships between Okta users and their linked accounts in external applications using federated authentication (SAML 2.0 or OIDC). - - -```mermaid -graph LR - subgraph okta["Okta"] - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - end - subgraph github["GitHub"] - ghu1("GH_User john\@contoso.com") - ghu2("GH_User alice\@contoso.com") - end - subgraph jamf["Jamf"] - jamfu1("jamf_Account john\@contoso.com") - end - subgraph snowflake["Snowflake"] - snu1("SNOW_User john\@contoso.com") - end - u1 -- Okta_OutboundSSO --> ghu1 - u1 -- Okta_OutboundSSO --> jamfu1 - u2 -- Okta_OutboundSSO --> ghu2 - u1 -- Okta_OutboundSSO --> snu1 +--- +title: 'Okta_OutboundSSO' +description: 'Single sign-on from Okta to an external identity provider' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable hybrid Okta_OutboundSSO edges represent Single Sign-On relationships between Okta users and their linked accounts in external applications using federated authentication (SAML 2.0 or OIDC). + +```mermaid +graph LR + subgraph okta["Okta"] + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + end + subgraph github["GitHub"] + ghu1("GH_User john\@contoso.com") + ghu2("GH_User alice\@contoso.com") + end + subgraph jamf["Jamf"] + jamfu1("jamf_Account john\@contoso.com") + end + subgraph snowflake["Snowflake"] + snu1("SNOW_User john\@contoso.com") + end + u1 -- Okta_OutboundSSO --> ghu1 + u1 -- Okta_OutboundSSO --> jamfu1 + u2 -- Okta_OutboundSSO --> ghu2 + u1 -- Okta_OutboundSSO --> snu1 ``` diff --git a/docs/opengraph/extensions/okta/edges/okta_passwordsync.mdx b/docs/opengraph/extensions/okta/edges/okta_passwordsync.mdx index 655117d2..0de6bc3f 100644 --- a/docs/opengraph/extensions/okta/edges/okta_passwordsync.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_passwordsync.mdx @@ -1,59 +1,56 @@ ---- -title: 'Okta_PasswordSync' -description: 'Password synchronization between user accounts via AD integration, Org2Org, or SCIM' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [User](/resources/nodes/user), [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [User](/resources/nodes/user) -- Traversable: ✅ - -## General Information - -The traversable Okta_PasswordSync edge represents password synchronization between user accounts. This indicates that credentials are synchronized from a source user to a target user. - -In **Active Directory** hybrid setups, this edge is created between User (AD) and [Okta_User](/opengraph/extensions/okta/nodes/okta_user) when delegated authentication or password push is enabled. In **Org2Org** setups, this edge is created between [Okta_User](/opengraph/extensions/okta/nodes/okta_user) nodes across organizations when password synchronization is configured. - - -The Okta API does not indicate if the actual password or a randomly generated value is pushed to the other organization. - -### Active Directory Hybrid - - -```mermaid -graph LR - subgraph ad["Active Directory"] - adu1("User john\@contoso.com") - end - subgraph okta["Okta"] - u1("Okta_User john\@contoso.com") - adu1 -->|Okta_PasswordSync| u1 - adu1 .->|Okta_UserSync| u1 - end +--- +title: 'Okta_PasswordSync' +description: 'Password synchronization between user accounts via AD integration, Org2Org, or SCIM' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_PasswordSync edge represents password synchronization between user accounts. This indicates that credentials are synchronized from a source user to a target user. + +In **Active Directory** hybrid setups, this edge is created between User (AD) and [Okta_User](/opengraph/extensions/okta/nodes/okta_user) when delegated authentication or password push is enabled. In **Org2Org** setups, this edge is created between [Okta_User](/opengraph/extensions/okta/nodes/okta_user) nodes across organizations when password synchronization is configured. + + +The Okta API does not indicate if the actual password or a randomly generated value is pushed to the other organization. + +### Active Directory Hybrid + +```mermaid +graph LR + subgraph ad["Active Directory"] + adu1("User john\@contoso.com") + end + subgraph okta["Okta"] + u1("Okta_User john\@contoso.com") + adu1 -->|Okta_PasswordSync| u1 + adu1 .->|Okta_UserSync| u1 + end +``` + +### Org2Org + +```mermaid +graph LR + subgraph source_org["Okta Org Contoso"] + u1("Okta_User alice\@contoso.com") + app1("Okta_Application Adatum Org2Org App") + end + subgraph target_org["Okta Org Adatum"] + u2("Okta_User alice\@adatum.com") + idp2("Okta_IdentityProvider Contoso Org2Org OIDC") + app2("Okta_Application Contoso Sync API Service") + end + u1 -->|Okta_PasswordSync| u2 + u1 -->|Okta_OutboundSSO| u2 + u1 .->|Okta_UserSync| u2 + u1 .->|Okta_UserPush| app1 + u1 .->|Okta_AppAssignment| app1 + app1 -->|Okta_ReadPasswordUpdates| u1 + app1 -->|Okta_OutboundOrgSSO| idp2 + idp2 -->|Okta_IdentityProviderFor| u2 ``` - -### Org2Org - -```mermaid -graph LR - subgraph source_org["Okta Org Contoso"] - u1("Okta_User alice\@contoso.com") - app1("Okta_Application Adatum Org2Org App") - end - subgraph target_org["Okta Org Adatum"] - u2("Okta_User alice\@adatum.com") - idp2("Okta_IdentityProvider Contoso Org2Org OIDC") - app2("Okta_Application Contoso Sync API Service") - end - u1 -->|Okta_PasswordSync| u2 - u1 -->|Okta_OutboundSSO| u2 - u1 .->|Okta_UserSync| u2 - u1 .->|Okta_UserPush| app1 - u1 .->|Okta_AppAssignment| app1 - app1 -->|Okta_ReadPasswordUpdates| u1 - app1 -->|Okta_OutboundOrgSSO| idp2 - idp2 -->|Okta_IdentityProviderFor| u2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/okta/edges/okta_policymapping.mdx b/docs/opengraph/extensions/okta/edges/okta_policymapping.mdx index 6a4c4ffa..b2578abc 100644 --- a/docs/opengraph/extensions/okta/edges/okta_policymapping.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_policymapping.mdx @@ -1,45 +1,41 @@ ---- -title: 'Okta_PolicyMapping' -description: 'Association of a policy with an Okta application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Policy](/opengraph/extensions/okta/nodes/okta_policy) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Traversable: ❌ - -## General Information - -The non-traversable Okta_PolicyMapping edges represent the association between a policy and the resources to which it is applied. - - -Only application targets are supported in the current version of the Okta BloodHound extension. - - - -```mermaid -graph LR - o["Okta_Organization contoso.okta.com"] - p1["Okta_Policy Idp Discovery Policy {Type: 'IDP_DISCOVERY'}"] - p2["Okta_Policy Active Directory Policy {Type: 'PASSWORD'}"] - p3["Okta_Policy Okta Admin Console {Type: 'ACCESS_POLICY'}"] - p4["Okta_Policy Any two factors {Type: 'ACCESS_POLICY'}"] - p5["Okta_Policy Default Policy {Type: 'PROFILE_ENROLLMENT'}"] - a1["Okta_Application Okta Admin Console"] - a2["Okta_Application Salesforce"] - a3["Okta_Application Intranet Portal"] - o -->|Okta_Contains| p1 - o -->|Okta_Contains| p2 - o -->|Okta_Contains| p3 - p3 -->|Okta_PolicyMapping| a1 - o -->|Okta_Contains| p4 - p4 -->|Okta_PolicyMapping| a2 - p4 -->|Okta_PolicyMapping| a3 - o -->|Okta_Contains| p5 - p5 -->|Okta_PolicyMapping| a1 - p5 -->|Okta_PolicyMapping| a2 - p5 -->|Okta_PolicyMapping| a3 -``` \ No newline at end of file +--- +title: 'Okta_PolicyMapping' +description: 'Association of a policy with an Okta application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable Okta_PolicyMapping edges represent the association between a policy and the resources to which it is applied. + + +Only application targets are supported in the current version of the Okta BloodHound extension. + +```mermaid +graph LR + o["Okta_Organization contoso.okta.com"] + p1["Okta_Policy Idp Discovery Policy {Type: 'IDP_DISCOVERY'}"] + p2["Okta_Policy Active Directory Policy {Type: 'PASSWORD'}"] + p3["Okta_Policy Okta Admin Console {Type: 'ACCESS_POLICY'}"] + p4["Okta_Policy Any two factors {Type: 'ACCESS_POLICY'}"] + p5["Okta_Policy Default Policy {Type: 'PROFILE_ENROLLMENT'}"] + a1["Okta_Application Okta Admin Console"] + a2["Okta_Application Salesforce"] + a3["Okta_Application Intranet Portal"] + o -->|Okta_Contains| p1 + o -->|Okta_Contains| p2 + o -->|Okta_Contains| p3 + p3 -->|Okta_PolicyMapping| a1 + o -->|Okta_Contains| p4 + p4 -->|Okta_PolicyMapping| a2 + p4 -->|Okta_PolicyMapping| a3 + o -->|Okta_Contains| p5 + p5 -->|Okta_PolicyMapping| a1 + p5 -->|Okta_PolicyMapping| a2 + p5 -->|Okta_PolicyMapping| a3 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_readclientsecret.mdx b/docs/opengraph/extensions/okta/edges/okta_readclientsecret.mdx index cee354e7..9a046cb2 100644 --- a/docs/opengraph/extensions/okta/edges/okta_readclientsecret.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_readclientsecret.mdx @@ -1,40 +1,33 @@ ---- -title: 'Okta_ReadClientSecret' -description: 'Ability to read client secrets for scoped Okta applications' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_ClientSecret](/opengraph/extensions/okta/nodes/okta_clientsecret) -- Traversable: ✅ - -## General Information - -The traversable Okta_ReadClientSecret edges represent permissions that allow a principal (user, group, or application) to read OAuth client secrets for scoped Okta applications. These edges are created for the **Application Administrator**, **API Access Management Administrator**, and **Read-only Administrator** built-in roles and for custom roles with the `okta.apps.clientCredentials.read` permission. - - -```mermaid -graph TD - org("Okta_Organization contoso.okta.com") - u1("Okta_User john\@contoso.com") - g1("Okta_Group Auditors") - app1("Okta_Application HR Sync") - secret1("Okta_ClientSecret abcdefgh") - r1("Okta_Role Read-only Administrator") - u1 -- Okta_MemberOf --> g1 - g1 -- Okta_ReadClientSecret --> secret1 - secret1 -- Okta_SecretOf --> app1 - app1 -- Okta_SuperAdmin --> org - g1 -. Okta_HasRole .-> r1 -``` - -## Potential Attack Scenarios - +--- +title: 'Okta_ReadClientSecret' +description: 'Ability to read client secrets for scoped Okta applications' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_ReadClientSecret edges represent permissions that allow a principal (user, group, or application) to read OAuth client secrets for scoped Okta applications. These edges are created for the **Application Administrator**, **API Access Management Administrator**, and **Read-only Administrator** built-in roles and for custom roles with the `okta.apps.clientCredentials.read` permission. + +```mermaid +graph TD + org("Okta_Organization contoso.okta.com") + u1("Okta_User john\@contoso.com") + g1("Okta_Group Auditors") + app1("Okta_Application HR Sync") + secret1("Okta_ClientSecret abcdefgh") + r1("Okta_Role Read-only Administrator") + u1 -- Okta_MemberOf --> g1 + g1 -- Okta_ReadClientSecret --> secret1 + secret1 -- Okta_SecretOf --> app1 + app1 -- Okta_SuperAdmin --> org + g1 -. Okta_HasRole .-> r1 +``` + +## Potential Attack Scenarios + An attacker with the ability to read client secrets for an application assigned the Super Administrator role could potentially use the client secret to authenticate as that application and perform privileged actions in Okta. -## Potential Attack Scenarios - -An attacker with the ability to read client secrets for an application assigned the Super Administrator role -could potentially use the client secret to authenticate as that application and perform privileged actions in Okta. diff --git a/docs/opengraph/extensions/okta/edges/okta_readpasswordupdates.mdx b/docs/opengraph/extensions/okta/edges/okta_readpasswordupdates.mdx index b90e5bb2..61220c82 100644 --- a/docs/opengraph/extensions/okta/edges/okta_readpasswordupdates.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_readpasswordupdates.mdx @@ -1,28 +1,25 @@ ---- -title: 'Okta_ReadPasswordUpdates' -description: 'Application can read password updates over the SCIM protocol' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ✅ - -## General Information - -The traversable Okta_ReadPasswordUpdates edges represent applications that can read password updates over SCIM. - - -```mermaid -graph LR - org("Okta_Organization contoso.okta.com") - app("Okta_Application SCIM App") - user("Okta_User john\@contoso.com") - user2("Okta_User steve\@contoso.com") - app -- Okta_ReadPasswordUpdates --> user - user -- Okta_SuperAdmin --> org - user2 -- Okta_AppAdmin --> app -``` \ No newline at end of file +--- +title: 'Okta_ReadPasswordUpdates' +description: 'Application can read password updates over the SCIM protocol' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_ReadPasswordUpdates edges represent applications that can read password updates over SCIM. + +```mermaid +graph LR + org("Okta_Organization contoso.okta.com") + app("Okta_Application SCIM App") + user("Okta_User john\@contoso.com") + user2("Okta_User steve\@contoso.com") + app -- Okta_ReadPasswordUpdates --> user + user -- Okta_SuperAdmin --> org + user2 -- Okta_AppAdmin --> app +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_realmcontains.mdx b/docs/opengraph/extensions/okta/edges/okta_realmcontains.mdx index c7077e2a..a295da15 100644 --- a/docs/opengraph/extensions/okta/edges/okta_realmcontains.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_realmcontains.mdx @@ -1,33 +1,30 @@ ---- -title: 'Okta_RealmContains' -description: 'Contains relationship between an Okta realm and its users' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Realm](/opengraph/extensions/okta/nodes/okta_realm) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ✅ - -## General Information - -The traversable Okta_RealmContains edges represent containment relationships between realms and the users assigned to those realms. - - -```mermaid -graph LR - r1("Okta_Realm EU") - r2("Okta_Realm US") - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - u3("Okta_User bob\@contoso.com") - r1 -- Okta_RealmContains --> u1 - r1 -- Okta_RealmContains --> u2 - r2 -- Okta_RealmContains --> u3 -``` - - -Okta Realms are currently not supported by BloodHound due to licensing restrictions. - \ No newline at end of file +--- +title: 'Okta_RealmContains' +description: 'Contains relationship between an Okta realm and its users' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_RealmContains edges represent containment relationships between realms and the users assigned to those realms. + +```mermaid +graph LR + r1("Okta_Realm EU") + r2("Okta_Realm US") + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + u3("Okta_User bob\@contoso.com") + r1 -- Okta_RealmContains --> u1 + r1 -- Okta_RealmContains --> u2 + r2 -- Okta_RealmContains --> u3 +``` + + +Okta Realms are currently not supported by BloodHound due to licensing restrictions. + diff --git a/docs/opengraph/extensions/okta/edges/okta_resetfactors.mdx b/docs/opengraph/extensions/okta/edges/okta_resetfactors.mdx index 8630814e..6759ca65 100644 --- a/docs/opengraph/extensions/okta/edges/okta_resetfactors.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_resetfactors.mdx @@ -1,26 +1,23 @@ ---- -title: 'Okta_ResetFactors' -description: 'Ability to reset MFA factors for scoped Okta users' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ✅ - -## General Information - -The traversable Okta_ResetFactors edges represent custom role permissions that allow a principal to reset MFA authenticators for scoped Okta users. These edges are created when a custom role includes the `okta.users.credentials.resetFactors` or `okta.users.credentials.manage` permissions. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - g1("Okta_Group Tier 1 Support") - g1 -- Okta_ResetFactors --> u1 - u2 -- Okta_ResetFactors --> u1 -``` \ No newline at end of file +--- +title: 'Okta_ResetFactors' +description: 'Ability to reset MFA factors for scoped Okta users' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_ResetFactors edges represent custom role permissions that allow a principal to reset MFA authenticators for scoped Okta users. These edges are created when a custom role includes the `okta.users.credentials.resetFactors` or `okta.users.credentials.manage` permissions. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + g1("Okta_Group Tier 1 Support") + g1 -- Okta_ResetFactors --> u1 + u2 -- Okta_ResetFactors --> u1 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_resetpassword.mdx b/docs/opengraph/extensions/okta/edges/okta_resetpassword.mdx index 03f6f765..62b799c2 100644 --- a/docs/opengraph/extensions/okta/edges/okta_resetpassword.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_resetpassword.mdx @@ -1,47 +1,44 @@ ---- -title: 'Okta_ResetPassword' -description: 'Ability to reset passwords or temporary credentials for scoped Okta users' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ✅ - -## General Information - -The traversable Okta_ResetPassword edges represent custom role permissions that allow a principal (user, group, or application) to reset passwords or temporary credentials for scoped Okta users. These edges are created when a custom role includes password management permissions such as `okta.users.credentials.resetPassword`, `okta.users.credentials.manage`, `okta.users.credentials.manageTemporaryAccessCode`, or `okta.users.manage`. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - g1("Okta_Group Help Desk") - app1("Okta_Application Automation") - g1 -- Okta_ResetPassword --> u2 - g1 -- Okta_ResetFactors --> u2 - app1 -- Okta_ResetPassword --> u1 +--- +title: 'Okta_ResetPassword' +description: 'Ability to reset passwords or temporary credentials for scoped Okta users' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_ResetPassword edges represent custom role permissions that allow a principal (user, group, or application) to reset passwords or temporary credentials for scoped Okta users. These edges are created when a custom role includes password management permissions such as `okta.users.credentials.resetPassword`, `okta.users.credentials.manage`, `okta.users.credentials.manageTemporaryAccessCode`, or `okta.users.manage`. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + g1("Okta_Group Help Desk") + app1("Okta_Application Automation") + g1 -- Okta_ResetPassword --> u2 + g1 -- Okta_ResetFactors --> u2 + app1 -- Okta_ResetPassword --> u1 +``` + +The edge is calculated based on custom role scoping. + +```mermaid +graph TD + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + g1("Okta_Group Help Desk") + rs("Okta_ResourceSet Frontline Workers") + a("Okta_RoleAssignment Authentication Admins") + r("Okta_CustomRole Authentication Admins") + g1 -. Okta_HasRole .-> r + a -. Okta_ScopedTo .-> rs + g1 -. Okta_HasRoleAssignment .-> a + rs -- Okta_ResourceSetContains --> u2 + u1 -- Okta_MemberOf --> g1 + g1 -- Okta_ResetPassword --> u2 + g1 -- Okta_ResetFactors --> u2 ``` - -The edge is calculated based on custom role scoping. - -```mermaid -graph TD - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - g1("Okta_Group Help Desk") - rs("Okta_ResourceSet Frontline Workers") - a("Okta_RoleAssignment Authentication Admins") - r("Okta_CustomRole Authentication Admins") - g1 -. Okta_HasRole .-> r - a -. Okta_ScopedTo .-> rs - g1 -. Okta_HasRoleAssignment .-> a - rs -- Okta_ResourceSetContains --> u2 - u1 -- Okta_MemberOf --> g1 - g1 -- Okta_ResetPassword --> u2 - g1 -- Okta_ResetFactors --> u2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/okta/edges/okta_resourcesetcontains.mdx b/docs/opengraph/extensions/okta/edges/okta_resourcesetcontains.mdx index da140094..8e63d8ec 100644 --- a/docs/opengraph/extensions/okta/edges/okta_resourcesetcontains.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_resourcesetcontains.mdx @@ -1,35 +1,32 @@ ---- -title: 'Okta_ResourceSetContains' -description: 'Membership of objects within an Okta resource set' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device), [Okta_AuthorizationServer](/opengraph/extensions/okta/nodes/okta_authorizationserver), [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider), [Okta_Policy](/opengraph/extensions/okta/nodes/okta_policy) -- Traversable: ✅ - -## General Information - -The traversable Okta_ResourceSetContains edges represent the membership relationships between resource sets and their member entities in Okta: - - -```mermaid -graph LR - rs1("Okta_ResourceSet Sales Department Resources") - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - g1("Okta_Group Sales Team") - a1("Okta_Application GitHub") - d1("Okta_Device John's MacBook") - rs1 -- Okta_ResourceSetContains --> u1 - rs1 -- Okta_ResourceSetContains --> g1 - rs1 -- Okta_ResourceSetContains --> a1 - rs1 -- Okta_ResourceSetContains --> d1 - u2 -- Okta_MemberOf --> g1 - rs1 -- Okta_ResourceSetContains --> u2 -``` - -Note that users can also be members of resource sets indirectly through group memberships. The intermediate group will not appear in the graph, but the user membership will be resolved by the collector. \ No newline at end of file +--- +title: 'Okta_ResourceSetContains' +description: 'Membership of objects within an Okta resource set' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_ResourceSetContains edges represent the membership relationships between resource sets and their member entities in Okta: + +```mermaid +graph LR + rs1("Okta_ResourceSet Sales Department Resources") + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + g1("Okta_Group Sales Team") + a1("Okta_Application GitHub") + d1("Okta_Device John's MacBook") + rs1 -- Okta_ResourceSetContains --> u1 + rs1 -- Okta_ResourceSetContains --> g1 + rs1 -- Okta_ResourceSetContains --> a1 + rs1 -- Okta_ResourceSetContains --> d1 + u2 -- Okta_MemberOf --> g1 + rs1 -- Okta_ResourceSetContains --> u2 +``` + +Note that users can also be members of resource sets indirectly through group memberships. The intermediate group will not appear in the graph, but the user membership will be resolved by the collector. diff --git a/docs/opengraph/extensions/okta/edges/okta_scopedto.mdx b/docs/opengraph/extensions/okta/edges/okta_scopedto.mdx index e48ff758..bd1bd55b 100644 --- a/docs/opengraph/extensions/okta/edges/okta_scopedto.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_scopedto.mdx @@ -1,42 +1,39 @@ ---- -title: 'Okta_ScopedTo' -description: 'Scope relationship between a role assignment and its target' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) -- Destination: [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization), [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device), [Okta_AuthorizationServer](/opengraph/extensions/okta/nodes/okta_authorizationserver) -- Traversable: ❌ - -## General Information - -The [Okta_HasRoleAssignment](/opengraph/extensions/okta/edges/okta_hasroleassignment) edges connect users, groups, and applications to their respective [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes. The Okta_ScopedTo edges connect the [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes to the resources they are scoped to, such as the organization or specific groups or applications. - - -```mermaid -graph TB - ra1("Okta_RoleAssignment Help Desk Administrator") - ra2("Okta_RoleAssignment Super Administrator") - r1("Okta_Role Help Desk Administrator") - r2("Okta_Role Super Administrator") - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - u3("Okta_User alice\@contoso.com") - g1("Okta_Group Seattle Help Desk") - g2("Okta_Group Seattle Office") - org("Okta_Organization contoso.okta.com") - - u1 -- Okta_MemberOf --> g1 - g1 -. Okta_HasRoleAssignment .-> ra1 - g1 -. Okta_HasRole .-> r1 - g1 -- Okta_HelpDeskAdmin --> u3 - u3 -- Okta_MemberOf --> g2 - ra1 -. Okta_ScopedTo .-> g2 - u2 -. Okta_HasRoleAssignment .-> ra2 - ra2 -. Okta_ScopedTo .-> org - u2 -- Okta_SuperAdmin --> org - u2 -. Okta_HasRole .-> r2 -``` \ No newline at end of file +--- +title: 'Okta_ScopedTo' +description: 'Scope relationship between a role assignment and its target' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The [Okta_HasRoleAssignment](/opengraph/extensions/okta/edges/okta_hasroleassignment) edges connect users, groups, and applications to their respective [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes. The Okta_ScopedTo edges connect the [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes to the resources they are scoped to, such as the organization or specific groups or applications. + +```mermaid +graph TB + ra1("Okta_RoleAssignment Help Desk Administrator") + ra2("Okta_RoleAssignment Super Administrator") + r1("Okta_Role Help Desk Administrator") + r2("Okta_Role Super Administrator") + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + u3("Okta_User alice\@contoso.com") + g1("Okta_Group Seattle Help Desk") + g2("Okta_Group Seattle Office") + org("Okta_Organization contoso.okta.com") + + u1 -- Okta_MemberOf --> g1 + g1 -. Okta_HasRoleAssignment .-> ra1 + g1 -. Okta_HasRole .-> r1 + g1 -- Okta_HelpDeskAdmin --> u3 + u3 -- Okta_MemberOf --> g2 + ra1 -. Okta_ScopedTo .-> g2 + u2 -. Okta_HasRoleAssignment .-> ra2 + ra2 -. Okta_ScopedTo .-> org + u2 -- Okta_SuperAdmin --> org + u2 -. Okta_HasRole .-> r2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_secretof.mdx b/docs/opengraph/extensions/okta/edges/okta_secretof.mdx index 7a0afd0b..a4c47f54 100644 --- a/docs/opengraph/extensions/okta/edges/okta_secretof.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_secretof.mdx @@ -1,29 +1,26 @@ ---- -title: 'Okta_SecretOf' -description: 'Client secret associated with an application or service integration' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_ClientSecret](/opengraph/extensions/okta/nodes/okta_clientsecret) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) -- Traversable: ✅ - -## General Information - -The traversable Okta_SecretOf edges represent the relationship between service applications or API service integrations and their associated client secrets, represented by the [Okta_ClientSecret](/opengraph/extensions/okta/nodes/okta_clientsecret) nodes. - - -```mermaid -graph LR - is1("Okta_APIServiceIntegration Elastic Agent") - is2("Okta_APIServiceIntegration Falcon Shield") - cs1("Okta_ClientSecret pdWB5I2I1LJ_cUAzD9fB1w") - cs2("Okta_ClientSecret lLRrn0i2tIa5YowaQuTdtQ") - cs3("Okta_ClientSecret EpGPhXPYLxqY2JEWRjTSAQ") - cs1 -- Okta_SecretOf --> is1 - cs2 -- Okta_SecretOf --> is2 - cs3 -- Okta_SecretOf --> is2 -``` \ No newline at end of file +--- +title: 'Okta_SecretOf' +description: 'Client secret associated with an application or service integration' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_SecretOf edges represent the relationship between service applications or API service integrations and their associated client secrets, represented by the [Okta_ClientSecret](/opengraph/extensions/okta/nodes/okta_clientsecret) nodes. + +```mermaid +graph LR + is1("Okta_APIServiceIntegration Elastic Agent") + is2("Okta_APIServiceIntegration Falcon Shield") + cs1("Okta_ClientSecret pdWB5I2I1LJ_cUAzD9fB1w") + cs2("Okta_ClientSecret lLRrn0i2tIa5YowaQuTdtQ") + cs3("Okta_ClientSecret EpGPhXPYLxqY2JEWRjTSAQ") + cs1 -- Okta_SecretOf --> is1 + cs2 -- Okta_SecretOf --> is2 + cs3 -- Okta_SecretOf --> is2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_superadmin.mdx b/docs/opengraph/extensions/okta/edges/okta_superadmin.mdx index 0625863a..6f6f70da 100644 --- a/docs/opengraph/extensions/okta/edges/okta_superadmin.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_superadmin.mdx @@ -1,26 +1,23 @@ ---- -title: 'Okta_SuperAdmin' -description: 'Super administrator role assignment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) -- Traversable: ✅ - -## General Information - -The traversable Okta_SuperAdmin edges represent Super Administrator role assignments to the Okta organization. Super Administrators have full access to all features and settings in the Okta organization. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - app1("Okta_Application Service Account") - org("Okta_Organization contoso.okta.com") - u1 -- Okta_SuperAdmin --> org - app1 -- Okta_SuperAdmin --> org -``` \ No newline at end of file +--- +title: 'Okta_SuperAdmin' +description: 'Super administrator role assignment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable Okta_SuperAdmin edges represent Super Administrator role assignments to the Okta organization. Super Administrators have full access to all features and settings in the Okta organization. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + app1("Okta_Application Service Account") + org("Okta_Organization contoso.okta.com") + u1 -- Okta_SuperAdmin --> org + app1 -- Okta_SuperAdmin --> org +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_swa.mdx b/docs/opengraph/extensions/okta/edges/okta_swa.mdx index e053c7c5..f300144d 100644 --- a/docs/opengraph/extensions/okta/edges/okta_swa.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_swa.mdx @@ -1,31 +1,28 @@ ---- -title: 'Okta_SWA' -description: 'Secure Web Authentication from Okta to an external application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Destination: [GH_User](/opengraph/extensions/github/nodes/gh_user), [jamf_Account](/opengraph/extensions/jamf/nodes/jamf_account), [OP_User](https://github.com/SpecterOps/1PassHound), [SNOW_User](https://github.com/SpecterOps/SnowHound) -- Traversable: ❌ - -## General Information - -The non-traversable hybrid Okta_SWA edges represent Secure Web Authentication relationships between Okta users and their linked accounts in external applications. SWA stores user credentials in Okta and automatically fills them in, which is less secure than federated SSO. - - -```mermaid -graph LR - subgraph okta["Okta"] - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - end - subgraph op["1Password Business"] - opu1("OP_User john\@contoso.com") - opu2("OP_User alice\@contoso.com") - end - u1 -. Okta_SWA .-> opu1 - u2 -. Okta_SWA .-> opu2 +--- +title: 'Okta_SWA' +description: 'Secure Web Authentication from Okta to an external application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable hybrid Okta_SWA edges represent Secure Web Authentication relationships between Okta users and their linked accounts in external applications. SWA stores user credentials in Okta and automatically fills them in, which is less secure than federated SSO. + +```mermaid +graph LR + subgraph okta["Okta"] + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + end + subgraph op["1Password Business"] + opu1("OP_User john\@contoso.com") + opu2("OP_User alice\@contoso.com") + end + u1 -. Okta_SWA .-> opu1 + u2 -. Okta_SWA .-> opu2 ``` diff --git a/docs/opengraph/extensions/okta/edges/okta_userpull.mdx b/docs/opengraph/extensions/okta/edges/okta_userpull.mdx index 09205189..81328a73 100644 --- a/docs/opengraph/extensions/okta/edges/okta_userpull.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_userpull.mdx @@ -1,26 +1,23 @@ ---- -title: 'Okta_UserPull' -description: 'Import of users from an external application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Traversable: ❌ - -## General Information - -The Okta_UserPull edges represent user import relationships from external applications to Okta. - - -```mermaid -graph LR - app1("Okta_Application Workday") - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - app1 -. Okta_UserPull .-> u1 - app1 -. Okta_UserPull .-> u2 -``` \ No newline at end of file +--- +title: 'Okta_UserPull' +description: 'Import of users from an external application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The Okta_UserPull edges represent user import relationships from external applications to Okta. + +```mermaid +graph LR + app1("Okta_Application Workday") + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + app1 -. Okta_UserPull .-> u1 + app1 -. Okta_UserPull .-> u2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_userpush.mdx b/docs/opengraph/extensions/okta/edges/okta_userpush.mdx index 4e97facf..d2bf678e 100644 --- a/docs/opengraph/extensions/okta/edges/okta_userpush.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_userpush.mdx @@ -1,28 +1,25 @@ ---- -title: 'Okta_UserPush' -description: 'Provisioning of users to an external application' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [Okta_User](/opengraph/extensions/okta/nodes/okta_user) -- Destination: [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) -- Traversable: ❌ - -## General Information - -The non-traversable Okta_UserPush edges represent user provisioning relationships from Okta to external applications. When configured, Okta can automatically create, update, or deactivate user accounts in integrated applications using protocols like SCIM or LDAP. - - -```mermaid -graph LR - u1("Okta_User john\@contoso.com") - u2("Okta_User alice\@contoso.com") - app1("Okta_Application GitHub Enterprise Cloud") - app2("Okta_Application Salesforce") - u1 -. Okta_UserPush .-> app1 - u2 -. Okta_UserPush .-> app1 - u2 -. Okta_UserPush .-> app2 -``` \ No newline at end of file +--- +title: 'Okta_UserPush' +description: 'Provisioning of users to an external application' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable Okta_UserPush edges represent user provisioning relationships from Okta to external applications. When configured, Okta can automatically create, update, or deactivate user accounts in integrated applications using protocols like SCIM or LDAP. + +```mermaid +graph LR + u1("Okta_User john\@contoso.com") + u2("Okta_User alice\@contoso.com") + app1("Okta_Application GitHub Enterprise Cloud") + app2("Okta_Application Salesforce") + u1 -. Okta_UserPush .-> app1 + u2 -. Okta_UserPush .-> app1 + u2 -. Okta_UserPush .-> app2 +``` diff --git a/docs/opengraph/extensions/okta/edges/okta_usersync.mdx b/docs/opengraph/extensions/okta/edges/okta_usersync.mdx index e979e4fc..799625e8 100644 --- a/docs/opengraph/extensions/okta/edges/okta_usersync.mdx +++ b/docs/opengraph/extensions/okta/edges/okta_usersync.mdx @@ -1,32 +1,29 @@ ---- -title: 'Okta_UserSync' -description: 'Bidirectional synchronization between Okta users and external identities' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [User](/resources/nodes/user), [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [SNOW_User](https://github.com/SpecterOps/SnowHound) -- Destination: [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [User](/resources/nodes/user), [AZUser](/resources/nodes/az-user), [OP_User](https://github.com/SpecterOps/1PassHound), [SNOW_User](https://github.com/SpecterOps/SnowHound) -- Traversable: ❌ - -## General Information - -The non-traversable hybrid Okta_UserSync edges represent bidirectional user synchronization relationships between Okta and external directories or applications. These edges indicate that user accounts are linked and synchronized between systems. - - -```mermaid -graph LR - subgraph ad["Active Directory"] - adu1("User john\@contoso.com") - end - subgraph okta["Okta"] - u1("Okta_User john\@contoso.com") - adu1 -. Okta_UserSync .-> u1 - end - subgraph snowflake["Snowflake"] - snu1("SNOW_User john\@contoso.com") - u1 -. Okta_UserSync .-> snu1 - end -``` \ No newline at end of file +--- +title: 'Okta_UserSync' +description: 'Bidirectional synchronization between Okta users and external identities' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable hybrid Okta_UserSync edges represent bidirectional user synchronization relationships between Okta and external directories or applications. These edges indicate that user accounts are linked and synchronized between systems. + +```mermaid +graph LR + subgraph ad["Active Directory"] + adu1("User john\@contoso.com") + end + subgraph okta["Okta"] + u1("Okta_User john\@contoso.com") + adu1 -. Okta_UserSync .-> u1 + end + subgraph snowflake["Snowflake"] + snu1("SNOW_User john\@contoso.com") + u1 -. Okta_UserSync .-> snu1 + end +``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_agent.mdx b/docs/opengraph/extensions/okta/nodes/okta_agent.mdx index e1844841..d517d75f 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_agent.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_agent.mdx @@ -1,64 +1,15 @@ ---- -title: 'Okta_Agent' -description: 'A synchronization or authentication agent in Okta' -icon: '/images/extensions/okta/okta_agent.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -The Okta_Agent node represents an Okta Agent, which is a component used in Okta's integration with on-premises systems. Okta Agents facilitate communication between the Okta cloud and on-premises applications or directories, enabling features such as single sign-on (SSO) and user provisioning. - -One or more agents are grouped into Agent Pools, represented by the [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) nodes, to provide redundancy and load balancing. - +--- +title: 'Okta_Agent' +description: 'A synchronization or authentication agent in Okta' +icon: '/images/extensions/okta/okta_agent.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +The Okta_Agent node represents an Okta Agent, which is a component used in Okta's integration with on-premises systems. Okta Agents facilitate communication between the Okta cloud and on-premises applications or directories, enabling features such as single sign-on (SSO) and user provisioning. + +One or more agents are grouped into Agent Pools, represented by the [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) nodes, to provide redundancy and load balancing. + ![Active Directory Agent in BloodHound](/images/extensions/okta/bloodhound-ad-agent.png) -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_HostsAgent](/opengraph/extensions/okta/edges/okta_hostsagent) | [Computer](/resources/nodes/computer) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_AgentMemberOf](/opengraph/extensions/okta/edges/okta_agentmemberof) | [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) | ✅ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `agent.id` | `string` | Unique agent identifier. | -| `name` | `agent.name` | `string` | Agent name shown in Okta Admin Console. | -| `display_name` | `agent.name` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the agent exists. | -| `pool_name` | `agentPool.name` | `string` | Name of the parent [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool). For AD pools this typically corresponds to the synced AD domain. | -| `operational_status` | `agent.operationalStatus` | `string` | Runtime health/operational state reported by Okta. | -| `update_status` | `agent.updateStatus` | `string` | Agent software update state. | -| `type` | `agent.type` | `string` | Agent type (for example AD, LDAP, IWA, or RADIUS). | -| `version` | `agent.version` | `string` | Agent software version. | -| `pool_id` | `agent.poolId` | `string` | Identifier of the parent Okta agent pool. | -| `last_connection` | `FromUnixTime(agent.lastConnection)` | `datetime` | Timestamp of the last successful agent connection to Okta. | - -## Sample Property Values - -```yaml -id: a53xfufl4rqWcHhQo697 -name: LON-SRV01 -display_name: LON-SRV01 -pool_id: 0oaxg9rhdd7ncGCXv697 -okta_domain: contoso.okta.com -pool_name: contoso.local -operational_status: DISRUPTED -update_status: Cancelled -type: AD -version: 3.22.0 -last_connection: 2026-01-15T02:29:40+00:00 -``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_agentpool.mdx b/docs/opengraph/extensions/okta/nodes/okta_agentpool.mdx index 71afa03a..e71c85d2 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_agentpool.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_agentpool.mdx @@ -1,71 +1,27 @@ ---- -title: 'Okta_AgentPool' -description: 'A pool of synchronization or authentication agents in Okta' -icon: '/images/extensions/okta/okta_agentpool.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -The Okta_AgentPool nodes represent Okta Agent Pools, which are collections of Okta Agents (represented as [Okta_Agent](/opengraph/extensions/okta/nodes/okta_agent) nodes) that work together to provide high availability and load balancing for on-premises integrations. - -The following agent pool types are supported by Okta: - -| Agent Pool Type | Description | -|-----------------|-------------| -| AD | [Active Directory](https://help.okta.com/en-us/content/topics/directory/ad-agent-integration-implementation-options.htm) | -| IWA | [Integrated Windows Authentication (Kerberos/NTLM)](https://help.okta.com/en-us/content/topics/directory/ad-iwa-learn.htm) | -| LDAP | [Lightweight Directory Access Protocol](https://help.okta.com/en-us/content/topics/directory/ldap-agent-supported-directories.htm) | -| RADIUS | [RADIUS authentication proxy](https://help.okta.com/en-us/content/topics/integrations/radius-best-pract-flow.htm) | -| MFA | | -| OPP | | -| RUM | | - -The most common agent pool type is the Active Directory (AD) Agent Pool, which consists of one or more AD Agents that facilitate bi-directional object synchronization between Okta and on-premises Active Directory environments. - +--- +title: 'Okta_AgentPool' +description: 'A pool of synchronization or authentication agents in Okta' +icon: '/images/extensions/okta/okta_agentpool.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +The Okta_AgentPool nodes represent Okta Agent Pools, which are collections of Okta Agents (represented as [Okta_Agent](/opengraph/extensions/okta/nodes/okta_agent) nodes) that work together to provide high availability and load balancing for on-premises integrations. + +The following agent pool types are supported by Okta: + +| Agent Pool Type | Description | +|-----------------|-------------| +| AD | [Active Directory](https://help.okta.com/en-us/content/topics/directory/ad-agent-integration-implementation-options.htm) | +| IWA | [Integrated Windows Authentication (Kerberos/NTLM)](https://help.okta.com/en-us/content/topics/directory/ad-iwa-learn.htm) | +| LDAP | [Lightweight Directory Access Protocol](https://help.okta.com/en-us/content/topics/directory/ldap-agent-supported-directories.htm) | +| RADIUS | [RADIUS authentication proxy](https://help.okta.com/en-us/content/topics/integrations/radius-best-pract-flow.htm) | +| MFA | | +| OPP | | +| RUM | | + +The most common agent pool type is the Active Directory (AD) Agent Pool, which consists of one or more AD Agents that facilitate bi-directional object synchronization between Okta and on-premises Active Directory environments. + ![Okta AD Agent Pools displayed in BloodHound](/images/extensions/okta/bloodhound-ad-agent-pool.png) -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_AgentMemberOf](/opengraph/extensions/okta/edges/okta_agentmemberof) | [Okta_Agent](/opengraph/extensions/okta/nodes/okta_agent) | ✅ | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_AgentPoolFor](/opengraph/extensions/okta/edges/okta_agentpoolfor) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `agentPool.id + "_pool"` | `string` | Unique agent pool identifier. | -| `name` | `agentPool.name` | `string` | Name of the Okta agent pool. | -| `display_name` | `agentPool.name` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the agent pool exists. | -| `operational_status` | `agentPool.operationalStatus` | `string` | Current health/operational state of the agent pool. | -| `type` | `agentPool.type` | `string` | Agent pool type (for example AD, LDAP, IWA, RADIUS). | - - -Active Directory (AD) agent pool identifiers have the same values as the identifiers of the corresponding application objects. -The `_pool` suffix is therefore added to the `id` property of `Okta_AgentPool` nodes to ensure uniqueness of node identifiers in BloodHound. - -## Sample Property Values - -```yaml -id: 0oaxg9rhdd7ncGCXv697_pool -name: contoso.local -display_name: contoso.local -okta_domain: contoso.okta.com -operational_status: DISRUPTED -type: AD -``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_apiserviceintegration.mdx b/docs/opengraph/extensions/okta/nodes/okta_apiserviceintegration.mdx index c3253ed1..a729f847 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_apiserviceintegration.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_apiserviceintegration.mdx @@ -1,89 +1,28 @@ ---- -title: 'Okta_ApiServiceIntegration' -description: 'An API service integration' -icon: '/images/extensions/okta/okta_apiserviceintegration.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -API service integrations in Okta represent OAuth 2.0 service (daemon) applications that can be granted machine-to-machine access to Okta APIs. There are some important differences between API service integrations and [regular OIDC service applications in Okta](/opengraph/extensions/okta/nodes/okta_application): - -| Feature | Service Applications | API Service Integrations | -|----------------------------------------------|----------------------|--------------------------| -| Can be created manually: | ✅ | ❌ | -| Can be added from the OIN Catalog: | ✅ | ✅ | -| Require role assignments: | ✅ | ❌ | -| Support authentication using client secrets: | ✅ | ✅ | -| Support authentication using private keys: | ✅ | ❌ | -| Admins can read cleartext client secrets: | ✅ | ❌ | - -API service integrations are represented as Okta_ApiServiceIntegration nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_AppAdmin](/opengraph/extensions/okta/edges/okta_appadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_CreatorOf](/opengraph/extensions/okta/edges/okta_creatorof) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) | ❌ | -| [Okta_ResourceSetContains](/opengraph/extensions/okta/edges/okta_resourcesetcontains) | [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset) | ✅ | -| [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | -| [Okta_SecretOf](/opengraph/extensions/okta/edges/okta_secretof) | [Okta_ClientSecret](/opengraph/extensions/okta/nodes/okta_clientsecret) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_CreatorOf](/opengraph/extensions/okta/edges/okta_creatorof) | [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) | ❌ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `service.id` | `string` | Unique API service integration identifier. | -| `name` | `service.name` | `string` | Name of the API service integration in Okta. | -| `display_name` | `service.name` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the integration exists. | -| `app_type` | `service.type` | `string` | Integration/application type identifier. | -| `oauth_scopes` | `service.grantedScopes` | `string[]` | OAuth 2.0 scopes granted to the integration. | -| `created_at` | `service.createdAt` | `datetime` | Timestamp when the integration was created. | - -## Sample Property Values - -```yaml -id: 0oaz7jy5f2oXnvtmN697 -name: Falcon Shield -display_name: Falcon Shield -okta_domain: contoso.okta.com -app_type: falconshieldapiservice -oauth_scopes: - - okta.users.read - - okta.oauthIntegrations.read - - okta.threatInsights.read - - okta.devices.read - - okta.apiTokens.read - - okta.roles.read - - okta.logs.read - - okta.groups.read - - okta.apps.read - - okta.domains.read - - okta.factors.read - - okta.authenticators.read - - okta.policies.read - - okta.networkZones.read - - okta.features.read -created_at: 2026-01-15T12:25:42.000Z -``` - -## Integration OAuth 2.0 Scopes - -Each API service integration comes with a pre-defined set of OAuth 2.0 scopes to access Okta APIs: - +--- +title: 'Okta_ApiServiceIntegration' +description: 'An API service integration' +icon: '/images/extensions/okta/okta_apiserviceintegration.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +API service integrations in Okta represent OAuth 2.0 service (daemon) applications that can be granted machine-to-machine access to Okta APIs. There are some important differences between API service integrations and [regular OIDC service applications in Okta](/opengraph/extensions/okta/nodes/okta_application): + +| Feature | Service Applications | API Service Integrations | +|----------------------------------------------|----------------------|--------------------------| +| Can be created manually: | ✅ | ❌ | +| Can be added from the OIN Catalog: | ✅ | ✅ | +| Require role assignments: | ✅ | ❌ | +| Support authentication using client secrets: | ✅ | ✅ | +| Support authentication using private keys: | ✅ | ❌ | +| Admins can read cleartext client secrets: | ✅ | ❌ | + +Okta API service integrations are represented as Okta_ApiServiceIntegration nodes. + +## Integration OAuth 2.0 Scopes + +Each API service integration comes with a pre-defined set of OAuth 2.0 scopes to access Okta APIs: + ![Okta API service integration scopes in BloodHound](/images/extensions/okta/bloodhound-api-service-integration-scopes.png) diff --git a/docs/opengraph/extensions/okta/nodes/okta_apitoken.mdx b/docs/opengraph/extensions/okta/nodes/okta_apitoken.mdx index 501909d2..e548f386 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_apitoken.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_apitoken.mdx @@ -1,64 +1,17 @@ ---- -title: 'Okta_ApiToken' -description: 'A secret used by users to authenticate to the Okta API' -icon: '/images/extensions/okta/okta_apitoken.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -API tokens (also known as SSWS tokens) in Okta are used to authenticate and authorize access to the Okta API. They are typically used by applications and scripts that need to interact with Okta programmatically. - -These tokens are always associated with a specific user in Okta, and the permissions of the token are determined by the role assignments of that user. For example, if a user has the Super Administrator role, any API token generated by that user will have full access to all API endpoints. Moreover, the long-lived API tokens are typically stored in plaintext in application configuration files or environment variables, making them a high-value target for attackers. - -The use of API tokens is generally discouraged in favor of OAuth 2.0 access tokens, as they provide better security and flexibility. However, API tokens are still widely used by Okta customers. - +--- +title: 'Okta_ApiToken' +description: 'A secret used by users to authenticate to the Okta API' +icon: '/images/extensions/okta/okta_apitoken.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +API tokens (also known as SSWS tokens) in Okta are used to authenticate and authorize access to the Okta API. They are typically used by applications and scripts that need to interact with Okta programmatically. + +These tokens are always associated with a specific user in Okta, and the permissions of the token are determined by the role assignments of that user. For example, if a user has the Super Administrator role, any API token generated by that user will have full access to all API endpoints. Moreover, the long-lived API tokens are typically stored in plaintext in application configuration files or environment variables, making them a high-value target for attackers. + +The use of API tokens is generally discouraged in favor of OAuth 2.0 access tokens, as they provide better security and flexibility. However, API tokens are still widely used by Okta customers. + Okta API tokens are represented as Okta_ApiToken nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -No inbound edges are defined by the Okta extension for this node. - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_ApiTokenFor](/opengraph/extensions/okta/edges/okta_apitokenfor) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `apiToken.id` | `string` | Unique API token identifier. | -| `name` | `apiToken.name` | `string` | Friendly name of the API token. | -| `display_name` | `apiToken.name` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the token exists. | -| `user_id` | `apiToken.userId` | `string` | ID of the Okta user that owns the token. | -| `client_name` | `apiToken.clientName` | `string` | Client/application name associated with the token. | -| `created` | `apiToken.created` | `datetime` | Token creation timestamp. | -| `last_updated` | `apiToken.lastUpdated` | `datetime` | Last update timestamp of token metadata. | -| `expires_at` | `apiToken.expiresAt` | `datetime` | Token expiration timestamp. | -| `network_connection` | `apiToken.network.connection` | `string` | Network connection restriction for token usage. | -| `token_window` | `ToTimeSpan(apiToken.tokenWindow)` | `duration` | Inactivity window converted to `TimeSpan` when present. | - -## Sample Property Values - -```yaml -id: 00T36fk75smeJybKx697 -name: Postman -display_name: Postman -okta_domain: contoso.okta.com -user_id: 00uw0o8iizq37KgKP697 -client_name: Okta API -created: 2025-10-03T10:08:09+00:00 -last_updated: 2026-01-31T20:22:42+00:00 -expires_at: 2026-03-02T20:22:42+00:00 -network_connection: ANYWHERE -token_window: 30.00:00:00 -``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_application.mdx b/docs/opengraph/extensions/okta/nodes/okta_application.mdx index d3ff2c77..f4e94085 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_application.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_application.mdx @@ -1,479 +1,212 @@ ---- -title: 'Okta_Application' -description: 'An application registered in Okta, such as a SAML app or an OIDC app' -icon: '/images/extensions/okta/okta_application.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Applications in Okta represent the various software applications and services that users can access through the Okta organization. Applications can be configured to use different authentication methods, such as SAML, OIDC, or SWA. These protocols can either be configured manually by administrators or automatically by adding an application from Okta's App Integration Catalog, which provides a wide range of pre-configured cloud and on-premises application templates. - -With the exception of API Service applications, Okta users and groups can be assigned to applications. Users can also be synchronized TO and FROM applications in Okta, typically using the SCIM protocol. For example, when integrating with GitHub Enterprise Cloud, Okta can be configured to automatically create user accounts in GitHub when users are assigned to the GitHub application in Okta. - -Applications are represented as Okta_Application nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_AgentPoolFor](/opengraph/extensions/okta/edges/okta_agentpoolfor) | [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool) | ✅ | -| [Okta_AppAdmin](/opengraph/extensions/okta/edges/okta_appadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_AppAssignment](/opengraph/extensions/okta/edges/okta_appassignment) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ❌ | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_GroupPush](/opengraph/extensions/okta/edges/okta_grouppush) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ❌ | -| [Okta_KerberosSSO](/opengraph/extensions/okta/edges/okta_kerberossso) | [User](/resources/nodes/user) | ✅ | -| [Okta_KeyOf](/opengraph/extensions/okta/edges/okta_keyof) | [Okta_JWK](/opengraph/extensions/okta/nodes/okta_jwk) | ✅ | -| [Okta_ManageApp](/opengraph/extensions/okta/edges/okta_manageapp) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_PolicyMapping](/opengraph/extensions/okta/edges/okta_policymapping) | [Okta_Policy](/opengraph/extensions/okta/nodes/okta_policy) | ❌ | -| [Okta_ResourceSetContains](/opengraph/extensions/okta/edges/okta_resourcesetcontains) | [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset) | ✅ | -| [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | -| [Okta_SecretOf](/opengraph/extensions/okta/edges/okta_secretof) | [Okta_ClientSecret](/opengraph/extensions/okta/nodes/okta_clientsecret) | ✅ | -| [Okta_UserPush](/opengraph/extensions/okta/edges/okta_userpush) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_AddMember](/opengraph/extensions/okta/edges/okta_addmember) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_AppAdmin](/opengraph/extensions/okta/edges/okta_appadmin) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) | ✅ | -| [Okta_CreatorOf](/opengraph/extensions/okta/edges/okta_creatorof) | [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) | ❌ | -| [Okta_GroupAdmin](/opengraph/extensions/okta/edges/okta_groupadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_GroupMembershipAdmin](/opengraph/extensions/okta/edges/okta_groupmembershipadmin) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_GroupPull](/opengraph/extensions/okta/edges/okta_grouppull) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_HasRole](/opengraph/extensions/okta/edges/okta_hasrole) | [Okta_Role](/opengraph/extensions/okta/nodes/okta_role), [Okta_CustomRole](/opengraph/extensions/okta/nodes/okta_customrole) | ❌ | -| [Okta_HasRoleAssignment](/opengraph/extensions/okta/edges/okta_hasroleassignment) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | -| [Okta_HelpDeskAdmin](/opengraph/extensions/okta/edges/okta_helpdeskadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_ManageApp](/opengraph/extensions/okta/edges/okta_manageapp) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_MobileAdmin](/opengraph/extensions/okta/edges/okta_mobileadmin) | [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) | ✅ | -| [Okta_OrgAdmin](/opengraph/extensions/okta/edges/okta_orgadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) | ✅ | -| [Okta_OrgSWA](/opengraph/extensions/okta/edges/okta_orgswa) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [jamf_SSOIntegration](/opengraph/extensions/jamf/nodes/jamf_ssointegration), [OP_Account](https://github.com/SpecterOps/1PassHound), [SNOW_Account](https://github.com/SpecterOps/SnowHound) | ❌ | -| [Okta_OutboundOrgSSO](/opengraph/extensions/okta/edges/okta_outboundorgsso) | [AZTenant](/resources/nodes/az-tenant), [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [jamf_SSOIntegration](/opengraph/extensions/jamf/nodes/jamf_ssointegration), [SNOW_Account](https://github.com/SpecterOps/SnowHound), [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider) | ✅ | -| [Okta_ReadClientSecret](/opengraph/extensions/okta/edges/okta_readclientsecret) | [Okta_ClientSecret](/opengraph/extensions/okta/nodes/okta_clientsecret) | ✅ | -| [Okta_ReadPasswordUpdates](/opengraph/extensions/okta/edges/okta_readpasswordupdates) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_ResetFactors](/opengraph/extensions/okta/edges/okta_resetfactors) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_ResetPassword](/opengraph/extensions/okta/edges/okta_resetpassword) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_SuperAdmin](/opengraph/extensions/okta/edges/okta_superadmin) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_UserPull](/opengraph/extensions/okta/edges/okta_userpull) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ❌ | - -## Properties - -### Common Application Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `application.id` | `string` | Unique application identifier. | -| `name` | `application.name` | `string` | App type identifier (for example `office365`, `snowflake`, `githubcloud`). | -| `display_name` | `application.label` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the application exists. | -| `has_role_assignments` | Calculated | `bool` | Indicates whether the application is assigned any administrative roles. | -| `created` | `application.created` | `datetime` | Application creation timestamp. | -| `last_updated` | `application.lastUpdated` | `datetime` | Last update timestamp of the app definition. | -| `status` | `application.status` | `string` | Current lifecycle status of the application instance. | -| `sign_on_mode` | `application.signOnMode` | `string` | Sign-on protocol mode (for example `OPENID_CONNECT`, `SAML_2_0`, `AUTO_LOGIN`). | -| `features` | `application.features` | `string[]` | Enabled app capabilities such as SCIM provisioning and password push. | -| `user_name_mapping` | `application.credentials.userNameTemplate.template` | `string` | Username mapping template used for provisioning/federation. | - -Individual application types may have additional properties specific to the integration or protocol: - -### GitHub Cloud - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `github_org` | `application.settings.app.githubOrg` | `string` | GitHub organization mapped to the integration. | - -### Google Workspace - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `domain` | `application.settings.app.domain` | `string` | Google Workspace domain associated with the integration. | -| `afw_only` | `application.settings.app.afwOnly` | `bool` | App-specific flag indicating constrained integration behavior. | - -### Jamf Pro SAML - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `domain` | `application.settings.app.domain` | `string` | Jamf Pro tenant domain associated with the integration. | - -### Active Directory Integration - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `naming_context` | `application.settings.app.namingContext` | `string` | Naming context configured for AD-backed app integration. | -| `filter_groups_by_ou` | `application.settings.app.filterGroupsByOU` | `bool` | Whether group filtering by OU is enabled. | -| `domain_sid` | Derived from synced AD user/group SID values (not directly in app object) | `string` | Domain SID associated with AD-backed integration. | -| `windows_transport_enabled` | `application.settings.app.windowsTransportEnabled` | `bool` | Indicates if Windows transport is enabled. | - -### Generic SAML Application - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `url` | `application.settings.signOn.ssoAcsUrl` (SAML 2.0) / `application.settings.signOn.ssoAcsUrlOverride` (SAML 1.1) | `string` | Primary sign-on URL exposed for SAML applications. | -| `entity_id` | `application.settings.signOn.destination` / `application.settings.signOn.audience` | `string` | SAML Entity ID for SAML integrations. | -| `acs_url` | `application.settings.signOn.ssoAcsUrl` | `string` | Assertion Consumer Service (ACS) URL for SAML integrations. | -| `ws_fed_configure_type` | `application.settings.app.wsFedConfigureType` | `string` | WS-Federation configuration mode. | - -### Generic OIDC Service Application - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `client_type` | `application.settings.oauthClient.applicationType` | `string` | OIDC client type (for example `web`, `native`, `browser`, `service`). | -| `grant_types` | `application.settings.oauthClient.grantTypes[]` | `string[]` | OAuth 2.0 grant types allowed for OIDC apps. | -| `redirect_uri` | `application.settings.oauthClient.redirectUris[]` | `string` | OIDC redirect URI configured for the integration. | -| `initiate_login_uri` | `application.settings.oauthClient.initiateLoginUri` | `string` | Okta-initiated login URI for supported OIDC apps. | -| `url` | Derived from OIDC sign-in URL preference (`initiate_login_uri` first, otherwise first `redirect_uri`) | `string` | Primary sign-in URL for OIDC applications. | -| `oauth_scopes` | Derived from app grants in `PopulateOAuthScopes` / grant collection logic | `string[]` | OAuth scopes granted to the application in Okta. | -| `domain` | `application.settings.app.domain` | `string` | Directory or service domain associated with the app integration. | -| `domains` | `application.settings.app.domains` | `string[]` | Domain list associated with the app integration when provided. | -| `service_domain` | `application.settings.app.serviceDomain` | `string` | Service/API domain used by workflow or API-connected apps. | -| `sub_domain` | `application.settings.app.subDomain` | `string` | Subdomain value used by app-specific integrations. | -| `region_type` | `application.settings.app.regionType` | `string` | Region suffix/type used by the app integration. | - -### Microsoft Entra ID External Authentication - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `microsoft_discovery_endpoint` | `application.settings.app.microsoftDiscoveryEndpoint` | `string` | OIDC discovery endpoint used by Microsoft integrations. | -| `microsoft_app_id` | `application.settings.app.microsoftAppId` | `string` | Microsoft application/client ID configured in the integration. | -| `microsoft_tenant_id` | `application.settings.app.microsoftTenantId` | `string` | Microsoft Entra tenant GUID associated with the app integration. | -| `require_admin_consent` | `application.settings.app.requireAdminConsent` | `bool` | Indicates if Microsoft admin consent is required. | - -### Microsoft Office 365 - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `msft_tenant` | `application.settings.app.msftTenant` | `string` | Microsoft tenant short name/domain used by the Office 365 integration. | -| `microsoft_tenant_id` | Calculated from `msft_tenant` | `string` | Microsoft Entra tenant GUID resolved from the Office 365 onmicrosoft tenant. | - -### Generic SWA / Browser Plugin Application - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `login_url` | `application.settings.app.loginUrl` | `string` | App login URL used by SWA/browser plugin configurations. | -| `url` | `application.settings.signOn.loginUrl` (AutoLogin) / `application.settings.app.url` (BrowserPlugin/BasicAuth/Bookmark/SPS) | `string` | Primary login URL exposed for SWA and related app types. | -| `app_filter` | `application.settings.app.appFilter` | `string` | App-side filter expression value. | -| `group_filter` | `application.settings.app.groupFilter` | `string` | Group filter pattern used for provisioning/mapping. | -| `use_group_mapping` | `application.settings.app.useGroupMapping` | `bool` | Whether group mapping is enabled for integration. | -| `join_all_roles` | `application.settings.app.joinAllRoles` | `bool` | Whether all discovered roles are joined/collected. | -| `role_value_pattern` | `application.settings.app.roleValuePattern` | `string` | Role mapping pattern template for AWS role federation. | -| `aws_environment_type` | `application.settings.app.awsEnvironmentType` | `string` | AWS environment identifier for AWS app integrations. | -| `session_duration` | `application.settings.app.sessionDuration` | `integer` | Session duration setting (seconds) for supported app integrations. | - -## Sample Property Values - -### Github Cloud - -```yaml -id: 0oawyp12cjglrkfId697 -name: githubcloud -display_name: Github Contoso -features: [] -github_org: Contoso -has_role_assignments: false -okta_domain: contoso.okta.com -sign_on_mode: SAML_2_0 -status: ACTIVE -user_name_mapping: ${source.login} -created: 2025-10-31T06:08:00+00:00 -last_updated: 2025-10-31T06:08:01+00:00 -``` - -### Google Workspace - -```yaml -id: 0oax4r57x0V5NHL2W697 -name: google -afw_only: false -display_name: Google Workspace -domain: contoso.com -features: [] -has_role_assignments: false -okta_domain: contoso.okta.com -sign_on_mode: SAML_2_0 -status: ACTIVE -user_name_mapping: ${source.login} -created: 2025-11-05T09:06:48+00:00 -last_updated: 2025-11-05T09:07:21+00:00 -``` - -### Jamf Pro SAML - -```yaml -id: 0oax4r3ud0J2WjlNh697 -name: jamfsoftwareserver -display_name: Jamf Pro SAML -domain: contoso.jamfcloud.com -features: [] -has_role_assignments: false -name: Jamf Pro SAML -okta_domain: contoso.okta.com -sign_on_mode: SAML_2_0 -status: ACTIVE -user_name_mapping: ${source.login} -created: 2025-11-05T09:10:52+00:00 -last_updated: 2026-01-19T14:33:39+00:00 -``` - -### OktaHound - -```yaml -id: 0oaw0pujq5WtBiMYD697 -name: oidc_client -client_type: service -display_name: OktaHound -features: [] -grant_types: - - client_credentials -has_role_assignments: true -oauth_scopes: - - okta.trustedOrigins.read - - okta.policies.read - - okta.linkedObjects.read - - okta.authModes.read - - okta.templates.read - - okta.apiTokens.read - - okta.factors.read - - okta.brands.read - - okta.authenticators.read - - okta.uischemas.read - - okta.logs.read - - okta.groups.read - - okta.identitySources.read - - okta.users.read - - okta.orgs.read - - okta.threatInsights.read - - okta.pushProviders.read - - okta.apps.read - - ssf.read - - okta.roles.read - - okta.networkZones.read - - okta.emailDomains.read - - okta.manifests.read - - okta.oauthIntegrations.read - - okta.domains.read - - okta.deviceAssurance.read - - okta.reports.read - - okta.authorizationServers.read - - okta.enduser.read - - okta.schemas.read - - okta.idps.read - - okta.agentPools.read - - okta.appGrants.read - - okta.inlineHooks.read - - okta.certificateAuthorities.read - - okta.devices.read - - okta.behaviors.read - - okta.profileMappings.read - - okta.captchas.read - - okta.clients.read - - okta.features.read - - okta.sessions.read - - okta.userTypes.read -okta_domain: integrator-5415459.okta.com -sign_on_mode: OPENID_CONNECT -status: ACTIVE -user_name_mapping: ${source.login} -created: 2025-10-02T10:11:20+00:00 -last_updated: 2025-10-02T10:26:27+00:00 -``` - -### Active Directory Integration - -```yaml -id: 0oaxg9rhdd7ncGCXv697 -name: active_directory -display_name: contoso.local -domain_sid: S-1-5-21-71365889-924527929-2677699343 -features: - - IMPORT_PROFILE_UPDATES - - PROFILE_MASTERING - - OUTBOUND_DEL_AUTH - - IMPORT_USER_SCHEMA - - IMPORT_NEW_USERS -filter_groups_by_ou: false -has_role_assignments: false -naming_context: contoso.local -okta_domain: contoso.okta.com -status: ACTIVE -created: 2025-11-14T12:50:42+00:00 -last_updated: 2026-01-31T15:12:24+00:00 -``` - -## User Name Mapping - -User name mapping from Okta to SAML 2.0, OpenID Connect (OIDC), and Secure Web Authentication (SWA) applications is configurable in the Okta Admin Console, with the default setting being the Okta username pass-through, i.e., `${source.login}`. - -| Application username format | Mapping template | -|-------------------------------|-------------------------------------------------------------| -| Okta username | `${source.login}` | -| Email | `${source.email}` | -| Okta username prefix | `${fn:substringBefore(source.login, "@")}` | -| Email prefix | `${fn:substringBefore(source.email, "@")}` | -| AD Employee ID | `${source.employeeID}` | -| AD SAM account name | `${source.samAccountName}` | -| AD SAM account name + domain | `${source.samAccountName}@${source.instance.namingContext}` | -| AD user principal name | `${source.userName}` | -| AD user principal name prefix | `${fn:substringBefore(source.userName, "@")}` | -| (None) | `NONE` | -| Custom | ? | - -## API Service Applications - -This application type is the most interesting one from the security perspective, as it represents OAuth 2.0 service (daemon) applications that can be granted machine-to-machine access to Okta APIs, without any user interaction. These applications can be assigned administrative roles, e.g., Super Admin, and OAuth 2.0 scope grants, e.g., `okta.users.manage`. Any API operation must be allowed by both the assigned roles and the granted scopes. - -![Okta Application scopes and roles in BloodHound](/images/extensions/okta/bloodhound-app-scopes.png) - -## Hybrid Edges - -For supported systems like Active Directory, GitHub Enterprise Cloud, or Jamf Pro, hybrid edges in BloodHound to represent the relationships between these external systems and Okta. - -```mermaid -graph TB - subgraph ad["Active Directory"] - direction LR - domain("Domain contoso.com") - adu1("User john\@contoso.com") - adu2("User steve\@contoso.com") - adg1("Group IT") - domain -- Contains --> adu1 - domain -- Contains --> adu2 - domain -- Contains --> adg1 - adu1 -- MemberOf --> adg1 - end - subgraph okta["Okta"] - direction LR - org("Okta_Organization contoso.okta.com") - u1("Okta_User john\@contoso.com") - u2("Okta_User steve\@contoso.com") - g1("Okta_Group IT") - gha("Okta_Application GitHub Enterprise Cloud") - jmfa("Okta_Application Jamf Pro SAML") - org -- Okta_Contains --> u1 - org -- Okta_Contains --> u2 - org -- Okta_Contains --> g1 - u1 -- Okta_MemberOf --> g1 - u2 -- Okta_AppAdmin --> gha - g1 -. Okta_AppAssignment .-> gha - u1 -. Okta_AppAssignment .-> jmfa - end - subgraph gh["GitHub Enterprise Cloud"] - direction LR - ghorg("GH_Organization Contoso") - ghu1("GH_User john\@contoso.com") - ghorg -- GH_Contains --> ghu1 - end - subgraph jamf["Jamf Pro Cloud"] - direction LR - jamft("jamf_SSOIntegration contoso.jamfcloud.com-SSO") - jmfu1("jamf_Account john\@contoso.com") - end - adu1 -. Okta_UserSync .-> u1 - adu2 -. Okta_UserSync .-> u2 - adg1 -- Okta_MembershipSync --> g1 - gha -- Okta_OutboundOrgSSO --> ghorg - jmfa -- Okta_OutboundOrgSSO --> jamft - u1 -- Okta_OutboundSSO --> ghu1 - u1 -- Okta_OutboundSSO --> jmfu1 -``` - -### Active Directory Synchronization - -When Okta's Active Directory (AD) integration is configured for user and group synchronization, -the connected AD domain is represented as an `Okta_Application` node in BloodHound. -This allows you to visualize the AD-backed application alongside other applications in your Okta environment and understand its relationships with users, groups, and roles. - -The synchronization is performed by domain-joined servers with the Okta AD Agent installed. -This agent typically has Domain Admin privileges in the connected AD domain to perform user and group enumeration and synchronization, -making it a high-value target for attackers. - -![Okta AD agent settings](/images/extensions/okta/okta-ad-agent.png) - -Authentication can be delegated from Okta to AD in multiple ways: - -- [Agentless Desktop SSO](https://help.okta.com/oie/en-us/content/topics/directory/ad-dsso-about-workflow.htm) -- [Password Synchronization](https://help.okta.com/oie/en-us/content/topics/directory/installing_configuring_active_directory_password_sync_agent.htm) -- Active Directory Federation Services (ADFS) integration with Okta as a SAML IdP - - -There is no documented API available to determine the authentication delegation method(s) configured for an AD-backed Okta application. The collector therefore performs some heuristics that might not be 100% accurate in all cases. - - -### GitHub Enterprise Cloud Organizations - -When integrating Okta with GitHub Enterprise Cloud, each GitHub organization connected to Okta is represented as a separate `Okta_Application` node in BloodHound. - -![Properties of the GitHub Application node](/images/extensions/okta/bloodhound-github-properties.png) - -### Jamf Pro - -When integrating Okta with Jamf Pro using SAML 2.0, each Jamf Pro instance connected to Okta is represented as a separate `Okta_Application` node in BloodHound. -The differentiator is the `domain_fqdn` property: - -![Jamf Pro SAML application in BloodHound](/images/extensions/okta/bloodhound-jamf-saml-properties.png) - -It is also possible to integrate Jamf Pro with Okta using Secure Web Authentication (SWA), but this option is less secure. - -![Jamf Pro SWA settings](/images/extensions/okta/app-jamf-swa.png) - -## Google Workspace - -Similarly to the Jamf Pro SAML applications, each Google Workspace (formerly G Suite) instance connected to Okta using SAML 2.0 is represented as a separate `Okta_Application` node in BloodHound and is identified by the `domain_fqdn` property: - -![Google Workspace SAML application in BloodHound](/images/extensions/okta/bloodhound-google-saml-properties.png) - -The SAML 2.0 protocol should always be preferred to SWA when integrating Okta with Google Workspace: - -![Google Workspace sign-in protocol settings](/images/extensions/okta/app-google-protocol-selector.png) - -## Generic SAML 2.0 Applications - -The assertion consumer service (ACS) URLs of generic (non-Catalog) Okta SAML 2.0 applications are exposed via the `url` attribute in BloodHound. - -![Okta SAML application in BloodHound](/images/extensions/okta/bloodhound-app-saml.png) - -## Generic Secure Web Authentication (SWA) Applications - -Secure Web Authentication (SWA) is an Okta technology that provides Single Sign-On (SSO) functionality to external web applications that don't support federated protocols. SWA applications store user credentials in Okta and automatically fill them in when users access the application through the Okta dashboard. - -The app's login page URL is exposed via the `url` attribute in BloodHound. - -![Okta SWA application in BloodHound](/images/extensions/okta/bloodhound-app-swa.png) - -## Generic OpenID Connect (OIDC) Applications - -Okta supports three types of OIDC applications: - -- Web Application -- Single-Page Application (SPA) -- Native Application - -The default redirect URI of generic (non-Catalog) Okta OIDC single-page applications (SPAs) starts with `http://localhost:8080/`, making it hard to identify the actual application address. The optional Okta-initiated sign-in flow URL is therefore exposed in the `url` attribute in BloodHound instead, if configured. - -OIDC applications can be granted OAuth 2.0 scopes to access Okta APIs on behalf of users: - -![Okta application OIDC grants](/images/extensions/okta/app-oidc-grants.png) - -## SCIM-Enabled Applications - -The `features` attribute of `Okta_Application` nodes may contain the following SCIM-related values, -indicating if SCIM is enabled and which protocol capabilities are supported: - -| Feature | Description | -|------------------------------|--------------------------------------------------------------------------------| -| PUSH_NEW_USERS | Supports pushing new users from Okta to the application | -| PUSH_PASSWORD_UPDATES | Supports pushing password updates from Okta to the application | -| PUSH_PENDING_USERS | Supports pushing users from Okta to the application in pending state | -| PUSH_PROFILE_UPDATES | Supports pushing profile updates from Okta to the application | -| PUSH_USER_DEACTIVATION | Supports pushing user deactivation from Okta to the application | -| REACTIVATE_USERS | Supports reactivating users in the application from Okta | -| IMPORT_NEW_USERS | Supports importing new users into Okta from the application | -| OPP_SCIM_INCREMENTAL_IMPORTS | Supports incremental imports of users from the application into Okta | -| IMPORT_PROFILE_UPDATES | Updates a linked user's app profile in Okta during manual or scheduled imports | -| GROUP_PUSH | Supports pushing groups and group memberships from Okta to the application | +--- +title: 'Okta_Application' +description: 'An application registered in Okta, such as a SAML app or an OIDC app' +icon: '/images/extensions/okta/okta_application.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Applications in Okta represent the various software applications and services that users can access through the Okta organization. Applications can be configured to use different authentication methods, such as SAML, OIDC, or SWA. These protocols can either be configured manually by administrators or automatically by adding an application from Okta's App Integration Catalog, which provides a wide range of pre-configured cloud and on-premises application templates. + +With the exception of API Service applications, Okta users and groups can be assigned to applications. Users can also be synchronized TO and FROM applications in Okta, typically using the SCIM protocol. For example, when integrating with GitHub Enterprise Cloud, Okta can be configured to automatically create user accounts in GitHub when users are assigned to the GitHub application in Okta. + +Okta applications are represented as Okta_Application nodes. + +## User Name Mapping + +User name mapping from Okta to SAML 2.0, OpenID Connect (OIDC), and Secure Web Authentication (SWA) applications is configurable in the Okta Admin Console, with the default setting being the Okta username pass-through, i.e., `${source.login}`. + +| Application username format | Mapping template | +|-------------------------------|-------------------------------------------------------------| +| Okta username | `${source.login}` | +| Email | `${source.email}` | +| Okta username prefix | `${fn:substringBefore(source.login, "@")}` | +| Email prefix | `${fn:substringBefore(source.email, "@")}` | +| AD Employee ID | `${source.employeeID}` | +| AD SAM account name | `${source.samAccountName}` | +| AD SAM account name + domain | `${source.samAccountName}@${source.instance.namingContext}` | +| AD user principal name | `${source.userName}` | +| AD user principal name prefix | `${fn:substringBefore(source.userName, "@")}` | +| (None) | `NONE` | +| Custom | ? | + +## API Service Applications + +This application type is the most interesting one from the security perspective, as it represents OAuth 2.0 service (daemon) applications that can be granted machine-to-machine access to Okta APIs, without any user interaction. These applications can be assigned administrative roles, e.g., Super Admin, and OAuth 2.0 scope grants, e.g., `okta.users.manage`. Any API operation must be allowed by both the assigned roles and the granted scopes. + +![Okta Application scopes and roles in BloodHound](/images/extensions/okta/bloodhound-app-scopes.png) + +## Hybrid Edges + +For supported systems like Active Directory, GitHub Enterprise Cloud, or Jamf Pro, OpenHound can create hybrid edges in BloodHound to represent the relationships between these external systems and Okta. + +```mermaid +graph TB + subgraph ad["Active Directory"] + direction LR + domain("Domain contoso.com") + adu1("User john\@contoso.com") + adu2("User steve\@contoso.com") + adg1("Group IT") + domain -- Contains --> adu1 + domain -- Contains --> adu2 + domain -- Contains --> adg1 + adu1 -- MemberOf --> adg1 + end + subgraph okta["Okta"] + direction LR + org("Okta_Organization contoso.okta.com") + u1("Okta_User john\@contoso.com") + u2("Okta_User steve\@contoso.com") + g1("Okta_Group IT") + gha("Okta_Application GitHub Enterprise Cloud") + jmfa("Okta_Application Jamf Pro SAML") + org -- Okta_Contains --> u1 + org -- Okta_Contains --> u2 + org -- Okta_Contains --> g1 + u1 -- Okta_MemberOf --> g1 + u2 -- Okta_AppAdmin --> gha + g1 -. Okta_AppAssignment .-> gha + u1 -. Okta_AppAssignment .-> jmfa + end + subgraph gh["GitHub Enterprise Cloud"] + direction LR + ghorg("GH_Organization Contoso") + ghu1("GH_User john\@contoso.com") + ghorg -- GH_Contains --> ghu1 + end + subgraph jamf["Jamf Pro Cloud"] + direction LR + jamft("jamf_SSOIntegration contoso.jamfcloud.com-SSO") + jmfu1("jamf_Account john\@contoso.com") + end + adu1 -. Okta_UserSync .-> u1 + adu2 -. Okta_UserSync .-> u2 + adg1 -- Okta_MembershipSync --> g1 + gha -- Okta_OutboundOrgSSO --> ghorg + jmfa -- Okta_OutboundOrgSSO --> jamft + u1 -- Okta_OutboundSSO --> ghu1 + u1 -- Okta_OutboundSSO --> jmfu1 +``` + +### Active Directory Synchronization + +When Okta's Active Directory (AD) integration is configured for user and group synchronization, the connected AD domain is represented as an Okta_Application node in BloodHound. This allows you to visualize the AD-backed application alongside other applications in your Okta environment and understand its relationships with users, groups, and roles. + +The synchronization is performed by domain-joined servers with the Okta AD Agent installed. This agent typically has Domain Admin privileges in the connected AD domain to perform user and group enumeration and synchronization, making it a high-value target for attackers. + +![Okta AD agent settings](/images/extensions/okta/okta-ad-agent.png) + +Authentication can be delegated from Okta to AD in multiple ways: + +- [Agentless Desktop SSO](https://help.okta.com/oie/en-us/content/topics/directory/ad-dsso-about-workflow.htm) +- [Password Synchronization](https://help.okta.com/oie/en-us/content/topics/directory/installing_configuring_active_directory_password_sync_agent.htm) +- Active Directory Federation Services (ADFS) integration with Okta as a SAML IdP + + +There is no documented API available to determine the authentication delegation method(s) configured for an AD-backed Okta application. The collector therefore performs some heuristics that might not be 100% accurate in all cases. + +### GitHub Enterprise Cloud Organizations + +When integrating Okta with GitHub Enterprise Cloud, each GitHub organization connected to Okta is represented as a separate Okta_Application node in BloodHound. + +![Properties of the GitHub Application node](/images/extensions/okta/bloodhound-github-properties.png) + +### Jamf Pro + +When integrating Okta with Jamf Pro using SAML 2.0, each Jamf Pro instance connected to Okta is represented as a separate Okta_Application node in BloodHound. The differentiator is the `domainFQDN` property: + +![Jamf Pro SAML application in BloodHound](/images/extensions/okta/bloodhound-jamf-saml-properties.png) + +It is also possible to integrate Jamf Pro with Okta using Secure Web Authentication (SWA), but this option is less secure. + +![Jamf Pro SWA settings](/images/extensions/okta/app-jamf-swa.png) + +## Google Workspace + +Similarly to the Jamf Pro SAML applications, each Google Workspace (formerly G Suite) instance connected to Okta using SAML 2.0 is represented as a separate Okta_Application node in BloodHound and is identified by the `domainFQDN` property: + +![Google Workspace SAML application in BloodHound](/images/extensions/okta/bloodhound-google-saml-properties.png) + +The SAML 2.0 protocol should always be preferred to SWA when integrating Okta with Google Workspace: + +![Google Workspace sign-in protocol settings](/images/extensions/okta/app-google-protocol-selector.png) + +## Generic SAML 2.0 Applications + +The assertion consumer service (ACS) URLs of generic (non-Catalog) Okta SAML 2.0 applications are exposed via the `url` attribute in BloodHound. + +![Okta SAML application in BloodHound](/images/extensions/okta/bloodhound-app-saml.png) + +### OIN catalog SAML routes + +Okta Integration Network (OIN) applications do not expose their SAML routes in +one uniform API shape. OpenHound prefers a complete route reported directly in +`settings.signOn`. When that route is absent, it can use a reviewed, bundled +resolver for these catalog families: + +- Asana +- GitHub Enterprise Cloud and Enterprise Managed Users +- Jamf Pro +- Okta Org2Org +- Palo Alto Networks GlobalProtect +- Slack +- Zoom single-vanity URLs +- Miro standard and complete custom routes + +Resolver-derived routes fail closed when required account, domain, or route +settings are missing or malformed. OpenHound does not infer a route for an +unsupported catalog family merely from the application name. + +Safe route-related `settings.app` values are exposed as normalized application +properties. `saml_route_setting_fields` records which supported fields were +present in the Okta response, including fields whose value was explicitly null. +The field-presence property is significant: an omitted field is not treated as +proof that a catalog default was selected. Null values themselves are not +written as BloodHound properties. + +See [Okta OIN SAML route evidence](../../docs/saml-oin-route-evidence) for the +resolver contract, evidence boundaries, supported variants, and deferred +families. + +## Generic Secure Web Authentication (SWA) Applications + +Secure Web Authentication (SWA) is an Okta technology that provides Single Sign-On (SSO) functionality to external web applications that don't support federated protocols. SWA applications store user credentials in Okta and automatically fill them in when users access the application through the Okta dashboard. + +The app's login page URL is exposed via the `url` attribute in BloodHound. + +![Okta SWA application in BloodHound](/images/extensions/okta/bloodhound-app-swa.png) + +## Generic OpenID Connect (OIDC) Applications + +Okta supports three types of OIDC applications: + +- Web Application +- Single-Page Application (SPA) +- Native Application + +The default redirect URI of generic (non-Catalog) Okta OIDC single-page applications (SPAs) starts with `http://localhost:8080/`, making it hard to identify the actual application address. The optional Okta-initiated sign-in flow URL is therefore exposed in the `url` attribute in BloodHound instead, if configured. + +OIDC applications can be granted OAuth 2.0 scopes to access Okta APIs on behalf of users: + +![Okta application OIDC grants](/images/extensions/okta/app-oidc-grants.png) + +## SCIM-Enabled Applications + +The `features` attribute of Okta_Application nodes may contain the following SCIM-related values, indicating if SCIM is enabled and which protocol capabilities are supported: + +| Feature | Description | +|------------------------------|--------------------------------------------------------------------------------| +| PUSH_NEW_USERS | Supports pushing new users from Okta to the application | +| PUSH_PASSWORD_UPDATES | Supports pushing password updates from Okta to the application | +| PUSH_PENDING_USERS | Supports pushing users from Okta to the application in pending state | +| PUSH_PROFILE_UPDATES | Supports pushing profile updates from Okta to the application | +| PUSH_USER_DEACTIVATION | Supports pushing user deactivation from Okta to the application | +| REACTIVATE_USERS | Supports reactivating users in the application from Okta | +| IMPORT_NEW_USERS | Supports importing new users into Okta from the application | +| OPP_SCIM_INCREMENTAL_IMPORTS | Supports incremental imports of users from the application into Okta | +| IMPORT_PROFILE_UPDATES | Updates a linked user's app profile in Okta during manual or scheduled imports | +| GROUP_PUSH | Supports pushing groups and group memberships from Okta to the application | | PROFILE_MASTERING | Supports profile mastering in Okta, allowing the application to be the source of truth for user profiles | diff --git a/docs/opengraph/extensions/okta/nodes/okta_authorizationserver.mdx b/docs/opengraph/extensions/okta/nodes/okta_authorizationserver.mdx index 1dda0998..7d1fba95 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_authorizationserver.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_authorizationserver.mdx @@ -1,66 +1,17 @@ ---- -title: 'Okta_AuthorizationServer' -description: 'An authorization server in Okta' -icon: '/images/extensions/okta/okta_authorizationserver.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Authorization servers in Okta are used to issue OAuth 2.0 access tokens for API access. They define the scopes, claims, and access policies that control how tokens are issued and what permissions they grant. Each Okta organization has a default authorization server, and administrators can create additional custom authorization servers for specific use cases. - -Authorization servers are represented as Okta_AuthorizationServer nodes in BloodHound. - - -The relationships between authorization servers and applications are currently not evaluated in BloodHound. +--- +title: 'Okta_AuthorizationServer' +description: 'An authorization server in Okta' +icon: '/images/extensions/okta/okta_authorizationserver.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Authorization servers in Okta are used to issue OAuth 2.0 access tokens for API access. They define the scopes, claims, and access policies that control how tokens are issued and what permissions they grant. Each Okta organization has a default authorization server, and administrators can create additional custom authorization servers for specific use cases. + +Okta authorization servers are represented as Okta_AuthorizationServer nodes. + + +The relationships between authorization servers and applications are currently not evaluated in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_ResourceSetContains](/opengraph/extensions/okta/edges/okta_resourcesetcontains) | [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset) | ✅ | -| [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | - -### Outbound Edges - -No outbound edges are defined by the Okta extension for this node. - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `server.id` | `string` | Unique authorization server identifier. | -| `name` | `server.name` | `string` | Authorization server name. | -| `display_name` | `server.name` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the authorization server exists. | -| `description` | `server.description` | `string` | Human-readable server description. | -| `status` | `server.status` | `string` | Current lifecycle status. | -| `issuer` | `server.issuer` | `string` | Token issuer URL. | -| `issuer_mode` | `server.issuerMode` | `string` | Issuer mode selected in Okta. | -| `audiences` | `server.audiences` | `string[]` | Allowed audience values for issued tokens. | -| `created` | `server.created` | `datetime` | Authorization server creation timestamp. | -| `last_updated` | `server.lastUpdated` | `datetime` | Last update timestamp for the server configuration. | - -## Sample Property Values - -```yaml -id: ausz6ipkn4u0hDzyf697 -name: app creation -display_name: app creation -okta_domain: contoso.okta.com -status: INACTIVE -issuer: https://contoso.okta.com/oauth2/ausz6ipkn4u0hDzyf697 -issuer_mode: DYNAMIC -audiences: - - test -created: 2026-01-14T15:41:28+00:00 -last_updated: 2026-01-14T16:09:30+00:00 -``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_clientsecret.mdx b/docs/opengraph/extensions/okta/nodes/okta_clientsecret.mdx index 8902e698..7bd9d08a 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_clientsecret.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_clientsecret.mdx @@ -1,69 +1,23 @@ ---- -title: 'Okta_ClientSecret' -description: 'A secret used by applications to authenticate to the Okta API' -icon: '/images/extensions/okta/okta_clientsecret.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Client secrets are used by API service integrations and OIDC applications to authenticate with Okta and obtain access tokens. - -![Okta client secret creation](/images/extensions/okta/app-client-secret-creation.png) - -An application can have up to two client secrets configured, to allow for secret rotation. - -![Okta client secret rotation](/images/extensions/okta/app-client-secret-rotation.png) - -Client secrets are represented as Okta_ClientSecret nodes in BloodHound. - - -For security reasons, the OpenHound and OktaHound collectors do not collect client secrets, only their hashed identifiers. - -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_ReadClientSecret](/opengraph/extensions/okta/edges/okta_readclientsecret) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_SecretOf](/opengraph/extensions/okta/edges/okta_secretof) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) | ✅ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `secret.id` | `string` | Unique client secret identifier. | -| `name` | `secret.secretHash` | `string` | Hash of the secret value used as name/display label. | -| `display_name` | `secret.secretHash` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the client secret exists. | -| `status` | `secret.status` | `string` | Current lifecycle status of the secret. | -| `created` | `secret.created` | `datetime` | Secret creation timestamp. | -| `last_updated` | `secret.lastUpdated` | `datetime` | Last update timestamp for the secret metadata. | - -## Sample Property Values - -```yaml -id: ocsxqwizfyqsf0aVG697 -name: T1e6fl4jGqvPkgd94NKx5g -display_name: T1e6fl4jGqvPkgd94NKx5g -okta_domain: contoso.okta.com -status: ACTIVE -created: 2025-11-24T12:24:08.000Z -last_updated: 2025-11-24T12:24:08.000Z -``` - - -For security reasons, the OktaHound collector does not write cleartext client secrets -to the OpenGraph JSON, only their hashed identifiers. +--- +title: 'Okta_ClientSecret' +description: 'A secret used by applications to authenticate to the Okta API' +icon: '/images/extensions/okta/okta_clientsecret.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Client secrets are used by API service integrations and OIDC applications to authenticate with Okta and obtain access tokens. + +![Okta client secret creation](/images/extensions/okta/app-client-secret-creation.png) + +An application can have up to two client secrets configured, to allow for secret rotation. + +![Okta client secret rotation](/images/extensions/okta/app-client-secret-rotation.png) + +Client secrets are represented as Okta_ClientSecret nodes in BloodHound. + + +For security reasons, the OpenHound and OktaHound collectors do not collect client secrets, only their hashed identifiers. diff --git a/docs/opengraph/extensions/okta/nodes/okta_customrole.mdx b/docs/opengraph/extensions/okta/nodes/okta_customrole.mdx index 431c5805..692f5d84 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_customrole.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_customrole.mdx @@ -1,78 +1,36 @@ ---- -title: 'Okta_CustomRole' -description: 'A custom role in Okta created by an administrator' -icon: '/images/extensions/okta/okta_customrole.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Custom roles can be created with specific [permissions](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions/) and then assigned to [users](/opengraph/extensions/okta/nodes/okta_user), [groups](/opengraph/extensions/okta/nodes/okta_group), and [applications](/opengraph/extensions/okta/nodes/okta_application) over [resource sets](/opengraph/extensions/okta/nodes/okta_resourceset). [Complex conditions](https://help.okta.com/oie/en-us/content/topics/security/custom-admin-role/permission-conditions.htm) can be used if the custom admin role has one of the following permissions: - -- okta.users.read -- okta.users.manage -- okta.users.create - -Custom roles are represented as Okta_CustomRole and [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes, similar to built-in roles. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_HasRole](/opengraph/extensions/okta/edges/okta_hasrole) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ❌ | - -### Outbound Edges - -No outbound edges are defined by the Okta extension for this node. - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `role.id` | `string` | Unique custom role identifier. | -| `name` | `role.label` | `string` | Name of the custom role. | -| `display_name` | `role.label` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the custom role exists. | -| `permissions` | `role.permissions` | `string[]` | Effective permission labels associated with the custom role. | -| `created` | `role.created` | `datetime` | Custom role creation timestamp. | -| `last_updated` | `role.lastUpdated` | `datetime` | Last update timestamp of the role definition. | - -## Sample Property Values - -```yaml -id: cr0wwdjuk0w96MpFr697 -name: IAM Readers -display_name: IAM Readers -okta_domain: contoso.okta.com -created: 2025-10-29T12:45:55+00:00 -last_updated: 2025-10-30T13:35:36+00:00 -permissions: - - okta.iam.read -``` - -## Abusable Permissions of Custom Roles in Okta - -The following Okta permissions are particularly interesting from an offensive security perspective, -as they can be abused to escalate privileges in hybrid scenarios: - -- okta.users.manage -- okta.users.credentials.manage -- okta.users.credentials.resetFactors -- okta.users.credentials.resetPassword -- okta.users.credentials.expirePassword -- okta.users.credentials.manageTemporaryAccessCode -- okta.groups.manage -- okta.groups.members.manage -- okta.apps.manage -- okta.apps.clientCredentials.read - - -The research on abusable Okta permissions is still ongoing. - +--- +title: 'Okta_CustomRole' +description: 'A custom role in Okta created by an administrator' +icon: '/images/extensions/okta/okta_customrole.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Custom roles can be created with specific [permissions](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions/) and then assigned to [users](/opengraph/extensions/okta/nodes/okta_user), [groups](/opengraph/extensions/okta/nodes/okta_group), and [applications](/opengraph/extensions/okta/nodes/okta_application) over [resource sets](/opengraph/extensions/okta/nodes/okta_resourceset). [Complex conditions](https://help.okta.com/oie/en-us/content/topics/security/custom-admin-role/permission-conditions.htm) can be used if the custom admin role has one of the following permissions: + +- okta.users.read +- okta.users.manage +- okta.users.create + +Custom roles are represented as Okta_CustomRole and [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) nodes, similar to built-in roles. + +## Abusable Permissions of Custom Roles in Okta + +The following Okta permissions are particularly interesting from an offensive security perspective, as they can be abused to escalate privileges in hybrid scenarios: + +- okta.users.manage +- okta.users.credentials.manage +- okta.users.credentials.resetFactors +- okta.users.credentials.resetPassword +- okta.users.credentials.expirePassword +- okta.users.credentials.manageTemporaryAccessCode +- okta.groups.manage +- okta.groups.members.manage +- okta.apps.manage +- okta.apps.clientCredentials.read + + +The research on abusable Okta permissions is still ongoing. + diff --git a/docs/opengraph/extensions/okta/nodes/okta_device.mdx b/docs/opengraph/extensions/okta/nodes/okta_device.mdx index 6b50c4a3..3989d5a8 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_device.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_device.mdx @@ -1,105 +1,13 @@ ---- -title: 'Okta_Device' -description: 'A device registered in Okta, such as a mobile phone or a computer' -icon: '/images/extensions/okta/okta_device.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Devices in Okta represent the physical or virtual devices that users use to authenticate and access the Okta organization. Devices can optionally be managed by 3rd party MDM solutions, which allow administrators to enforce security compliance policies. - -Devices are represented as Okta_Device nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_MobileAdmin](/opengraph/extensions/okta/edges/okta_mobileadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_OrgAdmin](/opengraph/extensions/okta/edges/okta_orgadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_ResourceSetContains](/opengraph/extensions/okta/edges/okta_resourcesetcontains) | [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset) | ✅ | -| [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_DeviceOf](/opengraph/extensions/okta/edges/okta_deviceof) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ❌ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `device.uuid + "@" + okta_domain` or `device.id` | `string` | Unique device identifier (derived from hardware ID + domain). | -| `name` | `device.resourceDisplayName` | `string` | Device display name from Okta. | -| `display_name` | `device.resourceDisplayName` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the device exists. | -| `okta_id` | `device.id` | `string` | Original Okta device identifier (stored for reference). | -| `created` | `device.created` | `datetime` | Device record creation timestamp. | -| `last_updated` | `device.lastUpdated` | `datetime` | Last update timestamp. | -| `status` | `device.status` | `string` | Device lifecycle/status value. | -| `resource_type` | `device.resourceType` | `string` | Okta device resource type. | -| `platform` | `device.profile.platform` | `string` | Device platform/OS family. | -| `manufacturer` | `device.profile.manufacturer` | `string` | Hardware vendor/manufacturer. | -| `model` | `device.profile.model` | `string` | Device model name. | -| `os_version` | `device.profile.osVersion` | `string` | Operating system version. | -| `registered` | `device.profile.registered` | `bool` | Whether the device is registered in Okta. | -| `secure_hardware_present` | `device.profile.secureHardwarePresent` | `bool` | Indicates secure hardware support (for example Secure Enclave/TPM). | -| `jail_break` | `device.profile.integrityJailbreak` | `bool` | Device jailbreak/root integrity signal. | -| `udid` | `device.profile.udid` | `string` | Apple UDID for iOS devices. | -| `object_sid` | `device.profile.sid` | `string` | SID attribute for Windows/AD-linked devices. | -| `serial_number` | `device.profile.serialNumber` | `string` | Device serial number, when provided and non-empty. | - -## Sample Property Values - -Windows device: - -```yaml -id: 4C4C4544-0057-4C10-8057-C8C04F573934@contoso.okta.com -name: PC01 -display_name: PC01 -okta_domain: contoso.okta.com -okta_id: guoxrzqh8jBxYxEeJ697 -created: 2025-11-25T11:01:53+00:00 -last_updated: 2026-02-17T08:55:45+00:00 -status: ACTIVE -resource_type: UDDevice -platform: WINDOWS -manufacturer: Dell Inc. -model: XPS 14 9440 -os_version: 10.0.26200.7623 -registered: true -secure_hardware_present: true -jail_break: false -udid: 4C4C4544-0057-4C10-8057-C8C04F573934 -object_sid: S-1-5-21-1084505731-826279434-3585917670 -serial_number: HWLWW94 -``` - -iOS device: - -```yaml -id: guowq18eyhZaDlkkA697 -name: John's iPhone -display_name: John's iPhone -okta_domain: contoso.okta.com -okta_id: guowq18eyhZaDlkkA697 -status: ACTIVE -resource_type: UDDevice -platform: IOS -manufacturer: APPLE -model: iPhone17,1 -os_version: 18.6.2 -registered: true -secure_hardware_present: true -jail_break: false -created: 2025-10-23T17:16:46+00:00 -last_updated: 2025-10-23T17:16:47+00:00 -``` +--- +title: 'Okta_Device' +description: 'A device registered in Okta, such as a mobile phone or a computer' +icon: '/images/extensions/okta/okta_device.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Devices in Okta represent the physical or virtual devices that users use to authenticate and access the Okta organization. Devices can optionally be managed by 3rd party MDM solutions, which allow administrators to enforce security compliance policies. + +Okta devices are represented as Okta_Device nodes. diff --git a/docs/opengraph/extensions/okta/nodes/okta_group.mdx b/docs/opengraph/extensions/okta/nodes/okta_group.mdx index e135a455..007ddd46 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_group.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_group.mdx @@ -1,158 +1,44 @@ ---- -title: 'Okta_Group' -description: 'An Okta user group' -icon: '/images/extensions/okta/okta_group.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Groups in Okta are collections of users that can be used to manage access to applications and resources. Groups can be created manually or synchronized from external directories such as Active Directory. The built-in **Everyone** group always contains all users in the Okta organization. Only users can be members of groups and groups cannot be nested. - -Groups are represented as Okta_Group nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_AddMember](/opengraph/extensions/okta/edges/okta_addmember) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_GroupAdmin](/opengraph/extensions/okta/edges/okta_groupadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_GroupMembershipAdmin](/opengraph/extensions/okta/edges/okta_groupmembershipadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_GroupPull](/opengraph/extensions/okta/edges/okta_grouppull) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_IdpGroupAssignment](/opengraph/extensions/okta/edges/okta_idpgroupassignment) | [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider) | ❌ | -| [Okta_MemberOf](/opengraph/extensions/okta/edges/okta_memberof) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_MembershipSync](/opengraph/extensions/okta/edges/okta_membershipsync) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Group](/resources/nodes/group), [AZGroup](/resources/nodes/az-group) | ✅ | -| [Okta_OrgAdmin](/opengraph/extensions/okta/edges/okta_orgadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_ResourceSetContains](/opengraph/extensions/okta/edges/okta_resourcesetcontains) | [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset) | ✅ | -| [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_AddMember](/opengraph/extensions/okta/edges/okta_addmember) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_AppAdmin](/opengraph/extensions/okta/edges/okta_appadmin) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) | ✅ | -| [Okta_AppAssignment](/opengraph/extensions/okta/edges/okta_appassignment) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ❌ | -| [Okta_GroupAdmin](/opengraph/extensions/okta/edges/okta_groupadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_GroupMembershipAdmin](/opengraph/extensions/okta/edges/okta_groupmembershipadmin) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_GroupPush](/opengraph/extensions/okta/edges/okta_grouppush) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ❌ | -| [Okta_HasRole](/opengraph/extensions/okta/edges/okta_hasrole) | [Okta_Role](/opengraph/extensions/okta/nodes/okta_role), [Okta_CustomRole](/opengraph/extensions/okta/nodes/okta_customrole) | ❌ | -| [Okta_HasRoleAssignment](/opengraph/extensions/okta/edges/okta_hasroleassignment) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | -| [Okta_HelpDeskAdmin](/opengraph/extensions/okta/edges/okta_helpdeskadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_ManageApp](/opengraph/extensions/okta/edges/okta_manageapp) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_MembershipSync](/opengraph/extensions/okta/edges/okta_membershipsync) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Group](/resources/nodes/group), [AZGroup](/resources/nodes/az-group) | ✅ | -| [Okta_MobileAdmin](/opengraph/extensions/okta/edges/okta_mobileadmin) | [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) | ✅ | -| [Okta_OrgAdmin](/opengraph/extensions/okta/edges/okta_orgadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) | ✅ | -| [Okta_ReadClientSecret](/opengraph/extensions/okta/edges/okta_readclientsecret) | [Okta_ClientSecret](/opengraph/extensions/okta/nodes/okta_clientsecret) | ✅ | -| [Okta_ResetFactors](/opengraph/extensions/okta/edges/okta_resetfactors) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_ResetPassword](/opengraph/extensions/okta/edges/okta_resetpassword) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_SuperAdmin](/opengraph/extensions/okta/edges/okta_superadmin) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | - -## Properties - -Standard Okta group properties: - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `group.id` | `string` | Unique group identifier. | -| `name` | `group.profile.name` | `string` | Group name in Okta (or synchronized source). | -| `display_name` | `group.profile.name` | `string` | Display label used in BloodHound. | -| `description` | `group.profile.description` | `string` | Group description text. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the group exists. | -| `has_role_assignments` | Calculated | `bool` | Indicates whether the group is assigned any administrative roles. | -| `okta_group_type` | `group.type` | `string` | Group type (for example `OKTA_GROUP`, `APP_GROUP`, `BUILT_IN`). | -| `object_class` | `group.objectClass[0]` | `string` | Source object class (for example AD security principal). | -| `created` | `group.created` | `datetime` | Group creation timestamp. | -| `last_updated` | `group.lastUpdated` | `datetime` | Last update timestamp. | -| `last_membership_updated` | `group.lastMembershipUpdated` | `datetime` | Last membership change timestamp. | - -Additional properties of groups synchronized from Active Directory: - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `object_sid` | `group.profile.objectSid` | `string` | Security Identifier (SID) for the AD group. | -| `distinguished_name` | `group.profile.dn` | `string` | Active Directory distinguished name. | -| `sam_account_name` | `group.profile.samAccountName` | `string` | Security Account Manager (SAM) account name. | -| `domain_qualified_name` | `group.profile.windowsDomainQualifiedName` | `string` | Domain-qualified name of the AD group. | -| `group_scope` | `group.profile.groupScope` | `string` | AD group scope (for example global, domainLocal, universal). | -| `group_type` | `group.profile.groupType` | `string` | AD group type, i.e., security or distribution. | -| `object_guid` | `Base64ToGuid(group.profile.externalId)` | `string` | AD object GUID. | - -## Sample Property Values - -Example of a group created directly in Okta: - -```yaml -id: 00gxg12p4kFOkyXLb697 -name: Engineering -display_name: Engineering -description: Engineering department group -okta_domain: contoso.okta.com -has_role_assignments: false -okta_group_type: OKTA_GROUP -object_class: okta:user_group -created: 2025-11-14T08:00:25+00:00 -last_updated: 2025-11-14T08:00:25+00:00 -last_membership_updated: 2025-11-14T08:00:25+00:00 -``` - -Example of a group synchronized from Active Directory: - -```yaml -id: 00gxga7s3yDJ71OzW697 -name: Sales -display_name: Sales -description: Sales department group -okta_domain: contoso.okta.com -has_role_assignments: false -okta_group_type: APP_GROUP -object_class: okta:windows_security_principal -object_sid: S-1-5-21-71365889-924527929-2677699343-2536 -distinguished_name: CN=Sales,CN=Groups,DC=contoso,DC=local -sam_account_name: Sales -domain_qualified_name: CONTOSO\Sales -group_scope: Global -group_type: Security -object_guid: 4ab65ef0-ab82-4017-b5ee-1c20facd4d6a -created: 2025-11-14T12:58:13+00:00 -last_updated: 2025-11-14T13:05:44+00:00 -last_membership_updated: 2025-11-14T12:58:13+00:00 -``` - -## Synchronization with External Directories - -Similarly to users, groups can also be synchronized from external directories. The Okta API exposes the original Active Directory attributes: - -![Group synchronized from AD](/images/extensions/okta/bloodhound-ad-synced-group.png) - -Nested (transitive) group memberships in Active Directory are always flattened (resolved) when synchronized to Okta, as illustrated below: - -```mermaid -graph TB - subgraph ad["Active Directory"] - ag1("Group A") - ag2("Group B") - u1("User 1") - u2("User 2") - u1 -- MemberOf --> ag1 - u2 -- MemberOf --> ag2 - ag2 -- MemberOf --> ag1 - end - subgraph Okta - og1("Okta_Group A") - og2("Okta_Group B") - u1o("Okta_User 1") - u2o("Okta_User 2") - u1o -- Okta_MemberOf --> og1 - u2o -- Okta_MemberOf --> og1 - u2o -- Okta_MemberOf --> og2 - end - ad == Sync ==> Okta +--- +title: 'Okta_Group' +description: 'An Okta user group' +icon: '/images/extensions/okta/okta_group.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Groups in Okta are collections of users that can be used to manage access to applications and resources. Groups can be created manually or synchronized from external directories such as Active Directory. The built-in **Everyone** group always contains all users in the Okta organization. Only users can be members of groups and groups cannot be nested. + +Okta groups are represented as Okta_Group nodes. + +## Synchronization with External Directories + +Similarly to users, groups can also be synchronized from external directories. The Okta API exposes the original Active Directory attributes: + +![Group synchronized from AD](/images/extensions/okta/bloodhound-ad-synced-group.png) + +Nested (transitive) group memberships in Active Directory are always flattened (resolved) when synchronized to Okta, as illustrated below: + +```mermaid +graph TB + subgraph ad["Active Directory"] + ag1("Group A") + ag2("Group B") + u1("User 1") + u2("User 2") + u1 -- MemberOf --> ag1 + u2 -- MemberOf --> ag2 + ag2 -- MemberOf --> ag1 + end + subgraph Okta + og1("Okta_Group A") + og2("Okta_Group B") + u1o("Okta_User 1") + u2o("Okta_User 2") + u1o -- Okta_MemberOf --> og1 + u2o -- Okta_MemberOf --> og1 + u2o -- Okta_MemberOf --> og2 + end + ad == Sync ==> Okta ``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_identityprovider.mdx b/docs/opengraph/extensions/okta/nodes/okta_identityprovider.mdx index a7268748..9d6da0e0 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_identityprovider.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_identityprovider.mdx @@ -1,82 +1,19 @@ ---- -title: 'Okta_IdentityProvider' -description: 'An identity provider trusted by Okta for authentication' -icon: '/images/extensions/okta/okta_identityprovider.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Identity Providers (IdPs) in Okta represent external authentication sources that can be used to authenticate users. These can include social identity providers (such as Google, Facebook, or Microsoft), enterprise identity providers using SAML or OIDC, or other Okta organizations in an Org2Org configuration. - -When users authenticate through an external identity provider, Okta can optionally create or link user accounts, enabling federated authentication across multiple systems. - -Identity providers are represented as Okta_IdentityProvider nodes in BloodHound. - - -The inbound identity provider routing rules and JIT (Just-In-Time) provisioning settings are currently not evaluated. +--- +title: 'Okta_IdentityProvider' +description: 'An identity provider trusted by Okta for authentication' +icon: '/images/extensions/okta/okta_identityprovider.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Identity Providers (IdPs) in Okta represent external authentication sources that can be used to authenticate users. These can include social identity providers (such as Google, Facebook, or Microsoft), enterprise identity providers using SAML or OIDC, or other Okta organizations in an Org2Org configuration. + +When users authenticate through an external identity provider, Okta can optionally create or link user accounts, enabling federated authentication across multiple systems. + +Okta identity providers are represented as Okta_IdentityProvider nodes. + + +The inbound identity provider routing rules and JIT (Just-In-Time) provisioning settings are currently not evaluated. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_InboundOrgSSO](/opengraph/extensions/okta/edges/okta_inboundorgsso) | [AZTenant](/resources/nodes/az-tenant) | ✅ | -| [Okta_OutboundOrgSSO](/opengraph/extensions/okta/edges/okta_outboundorgsso) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_ResourceSetContains](/opengraph/extensions/okta/edges/okta_resourcesetcontains) | [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_IdentityProviderFor](/opengraph/extensions/okta/edges/okta_identityproviderfor) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_IdpGroupAssignment](/opengraph/extensions/okta/edges/okta_idpgroupassignment) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ❌ | - -## Properties - -These properties are common for all identity provider types: - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `idp.id` | `string` | Unique identity provider identifier. | -| `name` | `idp.name` | `string` | Identity provider name. | -| `display_name` | `idp.name` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the identity provider exists. | -| `issuer_mode` | `idp.issuerMode` | `string` | Issuer mode for the identity provider. | -| `type` | `idp.type` | `string` | Identity provider category/type. | -| `enabled` | `idp.status == "ACTIVE"` | `bool` | Whether the IdP is active/enabled. | -| `auto_user_provisioning` | `idp.policy.provisioning.action == "AUTO"` | `bool` | Whether automatic user provisioning is enabled. | -| `governed_group_ids` | `idp.policy.provisioning.groups` | `string[]` | Group IDs governed by this IdP provisioning policy. | -| `protocol_type` | `idp.protocol.*.type[0]` | `string` | Protocol configured for authentication through this IdP. | -| `url` | `idp.protocol.*.endpoints.*.url[0]` | `string` | Primary authorization/SSO endpoint URL for the IdP. | -| `created` | `idp.created` | `datetime` | IdP creation timestamp. | - -Additional properties are provider-specific: - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `entra_tenant_id` | `TenantIdFromSamlEndpoint(url)` | `string` | Associated Entra tenant ID when identifiable. | - -## Sample Property Values - -```yaml -id: 0oazpi53t1cRNcPL4697 -name: Microsoft Entra ID -display_name: Microsoft Entra ID -okta_domain: contoso.okta.com -created: 2026-01-31T15:21:37+00:00 -issuer_mode: DYNAMIC -type: MICROSOFT -enabled: false -auto_user_provisioning: true -governed_group_ids: [] -protocol_type: OIDC -url: https://login.microsoftonline.com/common/oauth2/v2.0/authorize -``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_jwk.mdx b/docs/opengraph/extensions/okta/nodes/okta_jwk.mdx index 7d458a26..3c4009a6 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_jwk.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_jwk.mdx @@ -1,58 +1,13 @@ ---- -title: 'Okta_JWK' -description: 'An Okta JSON Web Key' -icon: '/images/extensions/okta/okta_jwk.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -JSON Web Keys (JWKs) are used by OAuth 2.0 client applications to authenticate with Okta using the `private_key_jwt` client authentication method. This is an asymmetric authentication mechanism where the application possesses a private key and Okta stores the corresponding public key. A service application can have multiple JWKs configured for key rotation purposes. - +--- +title: 'Okta_JWK' +description: 'An Okta JSON Web Key' +icon: '/images/extensions/okta/okta_jwk.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +JSON Web Keys (JWKs) are used by OAuth 2.0 client applications to authenticate with Okta using the `private_key_jwt` client authentication method. This is an asymmetric authentication mechanism where the application possesses a private key and Okta stores the corresponding public key. A service application can have multiple JWKs configured for key rotation purposes. + JWKs are represented as Okta_JWK nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -No inbound edges are defined by the Okta extension for this node. - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_KeyOf](/opengraph/extensions/okta/edges/okta_keyof) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `jwk.id` | `string` | Unique JSON Web Key identifier. | -| `name` | `jwk.kid` (fallback `jwk.id`) | `string` | Key identifier used as node name. | -| `display_name` | `jwk.kid` (fallback `jwk.id`) | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the key exists. | -| `status` | `jwk.status` | `string` | Current lifecycle status of the key. | -| `kid` | `jwk.kid` | `string` | JSON Web Key identifier (`kid`). | -| `kty` | `jwk.kty` | `string` | Key type (`RSA`, `EC`, ...). | -| `use` | `jwk.use` | `string` | Intended key usage (`sig`, `enc`). | -| `created` | `jwk.created` | `datetime` | Key creation timestamp. | -| `last_updated` | `jwk.lastUpdated` | `datetime` | Last update timestamp. | - -## Sample Property Values - -```yaml -id: pksw0py294dQ80EdI697 -name: ncxmNARybDrxlemwkrvyphCYQ2VwMG9cxV95jgVziZ4 -display_name: ncxmNARybDrxlemwkrvyphCYQ2VwMG9cxV95jgVziZ4 -okta_domain: contoso.okta.com -status: ACTIVE -kid: ncxmNARybDrxlemwkrvyphCYQ2VwMG9cxV95jgVziZ4 -kty: RSA -use: sig -created: 2025-10-02T10:14:44Z -last_updated: 2025-10-02T10:26:27Z -``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_organization.mdx b/docs/opengraph/extensions/okta/nodes/okta_organization.mdx index d4a05749..62cb3a97 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_organization.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_organization.mdx @@ -1,57 +1,13 @@ ---- -title: 'Okta_Organization' -description: 'An Okta organization' -icon: '/images/extensions/okta/okta_organization.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -The Organization entity represents the Okta tenant itself. It contains general information about the organization, such as its name, domain, and settings. - -The organization is represented as a single Okta_Organization node in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | -| [Okta_SuperAdmin](/opengraph/extensions/okta/edges/okta_superadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration), [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset), [Okta_Role](/opengraph/extensions/okta/nodes/okta_role), [Okta_CustomRole](/opengraph/extensions/okta/nodes/okta_customrole), [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment), [Okta_Realm](/opengraph/extensions/okta/nodes/okta_realm), [Okta_AgentPool](/opengraph/extensions/okta/nodes/okta_agentpool), [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider), [Okta_AuthorizationServer](/opengraph/extensions/okta/nodes/okta_authorizationserver), [Okta_Policy](/opengraph/extensions/okta/nodes/okta_policy) | ✅ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `settings.id` | `string` | Unique organization identifier. | -| `name` | `okta_domain` | `string` | Okta organization domain name. | -| `display_name` | `settings.companyName` | `string` | Organization/company display name. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain name. | -| `subdomain` | `settings.subdomain` | `string` | Okta subdomain value. | -| `status` | `settings.status` | `string` | Organization lifecycle status. | -| `created` | `settings.created` | `datetime` | Organization creation timestamp. | -| `last_updated` | `settings.lastUpdated` | `datetime` | Last organization metadata update timestamp. | - -## Sample Property Values - -```yaml -id: 00ow0o8if0CNwsKmk697 -name: contoso.okta.com -display_name: Contoso -okta_domain: contoso.okta.com -subdomain: contoso -status: ACTIVE -created: 2025-10-02T09:21:31+00:00 -last_updated: 2025-12-09T23:04:15+00:00 -``` +--- +title: 'Okta_Organization' +description: 'An Okta organization' +icon: '/images/extensions/okta/okta_organization.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +The Organization entity represents the Okta tenant itself. It contains general information about the organization, such as its name, domain, and settings. + +The Okta organization is represented as a single Okta_Organization node. diff --git a/docs/opengraph/extensions/okta/nodes/okta_policy.mdx b/docs/opengraph/extensions/okta/nodes/okta_policy.mdx index 2785b349..a0e3a4ad 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_policy.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_policy.mdx @@ -1,77 +1,31 @@ ---- -title: 'Okta_Policy' -description: 'A policy defining rules for authentication, password, or other features in Okta' -icon: '/images/extensions/okta/okta_policy.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Policies in Okta define the rules and conditions that govern authentication, authorization, and security behaviors within an organization. They control aspects such as password requirements, MFA enrollment, session management, and application access. - -Policies are represented as Okta_Policy nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_ResourceSetContains](/opengraph/extensions/okta/edges/okta_resourcesetcontains) | [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_PolicyMapping](/opengraph/extensions/okta/edges/okta_policymapping) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ❌ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `policy.id` | `string` | Unique policy identifier. | -| `name` | `policy.name` | `string` | Policy name. | -| `display_name` | `policy.name` | `string` | Display-friendly policy name. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the policy exists. | -| `description` | `policy.description` | `string` | Policy description text. | -| `type` | `policy.type` | `string` | Policy type identifier (for example `OKTA_SIGN_ON`, `ACCESS_POLICY`, `PROFILE_ENROLLMENT`). | -| `priority` | `policy.priority` | `integer` | Policy evaluation order priority. | -| `system` | `policy.system` | `bool` | Indicates whether the policy is system-managed. | -| `created` | `policy.created` | `datetime` | Policy creation timestamp. | - -## Sample Property Values - -```yaml -id: rstw0o8il8ktUxo3t697 -name: Okta Account Management Policy -display_name: Okta Account Management Policy -okta_domain: contoso.okta.com -description: This policy defines how users must authenticate for authenticator enrollment, password reset, or unlock account. Password policy rules control whether to enforce this policy for password reset and unlock account. -type: ACCESS_POLICY -priority: 1 -system: false -created: 2025-10-02T09:21:37+00:00 -``` - -## Policy Types - -The following [policy types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) are supported by Okta: - -| Policy Type ID | Description | -|----------------|-------------| -| OKTA_SIGN_ON | [Global session policies](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/about-okta-sign-on-policies.htm) | -| PASSWORD | [Password policies](https://help.okta.com/en-us/content/topics/security/policies/about-password-policies.htm) | -| MFA_ENROLL | [Authenticator enrollment policies](https://help.okta.com/en-us/content/topics/security/policies/configure-mfa-policies.htm) | -| IDP_DISCOVERY | [Identity Provider routing rules](https://help.okta.com/en-us/content/topics/security/identity_provider_discovery.htm) | -| ACCESS_POLICY | [App sign-in policies](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/about-app-sign-on-policies.htm) | -| DEVICE_SIGNAL_COLLECTION | [Device signal collection policies](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/create-device-signal-collection-ruleset.htm) | -| PROFILE_ENROLLMENT | [User profile policies](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/create-profile-enrollment-policy.htm) | -| POST_AUTH_SESSION | [Identity Threat Protection policies](https://help.okta.com/oie/en-us/content/topics/itp/overview.htm) | -| ENTITY_RISK | [Entity risk policies](https://help.okta.com/oie/en-us/content/topics/itp/entity-risk-policy.htm) | - -The collector specifically reads the `IDP_DISCOVERY` policies to check if the [Agentless Desktop SSO](https://help.okta.com/en-us/content/topics/directory/configuring_agentless_sso.htm) feature is enabled in the organization through at least one such policy. +--- +title: 'Okta_Policy' +description: 'A policy defining rules for authentication, password, or other features in Okta' +icon: '/images/extensions/okta/okta_policy.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Policies in Okta define the rules and conditions that govern authentication, authorization, and security behaviors within an organization. They control aspects such as password requirements, MFA enrollment, session management, and application access. + +Okta policies are represented as Okta_Policy nodes. + +## Policy Types + +The following [policy types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) are supported by Okta: + +| Policy Type ID | Description | +|----------------|-------------| +| OKTA_SIGN_ON | [Global session policies](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/about-okta-sign-on-policies.htm) | +| PASSWORD | [Password policies](https://help.okta.com/en-us/content/topics/security/policies/about-password-policies.htm) | +| MFA_ENROLL | [Authenticator enrollment policies](https://help.okta.com/en-us/content/topics/security/policies/configure-mfa-policies.htm) | +| IDP_DISCOVERY | [Identity Provider routing rules](https://help.okta.com/en-us/content/topics/security/identity_provider_discovery.htm) | +| ACCESS_POLICY | [App sign-in policies](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/about-app-sign-on-policies.htm) | +| DEVICE_SIGNAL_COLLECTION | [Device signal collection policies](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/create-device-signal-collection-ruleset.htm) | +| PROFILE_ENROLLMENT | [User profile policies](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/create-profile-enrollment-policy.htm) | +| POST_AUTH_SESSION | [Identity Threat Protection policies](https://help.okta.com/oie/en-us/content/topics/itp/overview.htm) | +| ENTITY_RISK | [Entity risk policies](https://help.okta.com/oie/en-us/content/topics/itp/entity-risk-policy.htm) | + +The OpenHound collector specifically reads the `IDP_DISCOVERY` policies to check if the [Agentless Desktop SSO](https://help.okta.com/en-us/content/topics/directory/configuring_agentless_sso.htm) feature is enabled in the organization through at least one such policy. diff --git a/docs/opengraph/extensions/okta/nodes/okta_realm.mdx b/docs/opengraph/extensions/okta/nodes/okta_realm.mdx index 173aa512..6e64896e 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_realm.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_realm.mdx @@ -1,64 +1,17 @@ ---- -title: 'Okta_Realm' -description: 'An Okta realm' -icon: '/images/extensions/okta/okta_realm.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Okta Realms are used to define authentication boundaries within an Okta organization. They allow administrators to segment users and applications based on different criteria, such as geographic location, business unit, or security requirements. - -Okta Realms are represented as Okta_Realm nodes in BloodHound. - - -Okta Realms are currently not supported due to licensing restrictions. +--- +title: 'Okta_Realm' +description: 'An Okta realm' +icon: '/images/extensions/okta/okta_realm.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Okta Realms are used to define authentication boundaries within an Okta organization. They allow administrators to segment users and applications based on different criteria, such as geographic location, business unit, or security requirements. + +Okta Realms are represented as Okta_Realm nodes. + + +Okta Realms are currently not supported due to licensing restrictions. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_RealmContains](/opengraph/extensions/okta/edges/okta_realmcontains) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `realm.id` | `string` | Unique realm identifier. | -| `name` | `realm.profile.name` | `string` | Realm name. | -| `display_name` | `realm.profile.name` | `string` | Display-friendly realm name. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the realm exists. | -| `type` | `realm.profile.realmType` | `string` | Realm type classification, such as `PARTNER` or `DEFAULT`. | -| `is_default` | `realm.isDefault` | `bool` | Whether this is the default realm. | -| `domains` | `realm.profile.domains` | `string[]` | List of domains allowed in the realm. | -| `created` | `realm.created` | `datetime` | Realm creation timestamp. | -| `last_updated` | `realm.lastUpdated` | `datetime` | Last realm update timestamp. | - -## Sample Property Values - -```yaml -id: guor3k19x7pVQ6Abc0g7 -name: Car Co -display_name: Car Co -okta_domain: contoso.okta.com -type: PARTNER -is_default: false -domains: - - atko.com - - user.com -created: 2025-06-01T08:00:00.0000000+00:00 -last_updated: 2026-02-20T07:45:12.0000000+00:00 -``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_resourceset.mdx b/docs/opengraph/extensions/okta/nodes/okta_resourceset.mdx index 47f804e3..2c8a1997 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_resourceset.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_resourceset.mdx @@ -1,84 +1,37 @@ ---- -title: 'Okta_ResourceSet' -description: 'A resource set containing users, groups, applications, and other Okta objects' -icon: '/images/extensions/okta/okta_resourceset.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Resource sets are collections of entities that can be used to scope custom role assignments in Okta. A resource set can contain the following object types: - -- [x] [Users](/opengraph/extensions/okta/nodes/okta_user) -- [x] [Groups](/opengraph/extensions/okta/nodes/okta_group) -- [x] [Applications](/opengraph/extensions/okta/nodes/okta_application) -- [x] [API Service Integrations](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) -- [x] [Devices](/opengraph/extensions/okta/nodes/okta_device) -- [x] [Authorization servers](/opengraph/extensions/okta/nodes/okta_authorizationserver) -- [x] [Identity Providers](/opengraph/extensions/okta/nodes/okta_identityprovider) -- [x] [Policies](/opengraph/extensions/okta/nodes/okta_policy) - - [x] Entity risk policy - - [x] Session protection policy - - [x] Authentication policy - - [x] Global session policy - - [x] End user account management policy -- [ ] Shared Signals Framework (SSF) Receivers -- [ ] ~~Workflows~~ (Gaps in the Okta API) -- [ ] ~~Customizations~~ (Gaps in the Okta API) -- [ ] ~~Support cases~~ (Gaps in the Okta API) -- [ ] ~~Identity and Access Management Resources~~ (Gaps in the Okta API) - - -Only the marked resource types are currently supported as resource set members. Some resource types, such as Workflows, are not accessible via the Okta API at all. - -![Okta Resource Set displayed in BloodHound](/images/extensions/okta/bloodhound-resource-set.png) - -Resource sets are represented as Okta_ResourceSet nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_ResourceSetContains](/opengraph/extensions/okta/edges/okta_resourcesetcontains) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device), [Okta_AuthorizationServer](/opengraph/extensions/okta/nodes/okta_authorizationserver), [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider), [Okta_Policy](/opengraph/extensions/okta/nodes/okta_policy) | ✅ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `resourceSet.id + "@" + okta_domain` or `resourceSet.id` | `string` | Unique resource set identifier (domain-qualified). | -| `name` | `resourceSet.label` | `string` | Resource set name. | -| `display_name` | `resourceSet.label` | `string` | Display-friendly resource set name. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the resource set exists. | -| `description` | `resourceSet.description` | `string` | Resource set description text. | -| `created` | `resourceSet.created` | `datetime` | Resource set creation timestamp. | -| `last_updated` | `resourceSet.lastUpdated` | `datetime` | Last resource set update timestamp. | - - -The built-in resource set `Workflows Resource Set` has the `WORKFLOWS_IAM_POLICY` identifier in all Okta organizations. -To make it unique, the collector adds the organization domain name as a suffix to the resource set's ID, e.g., `WORKFLOWS_IAM_POLICY@contoso.okta.com`. - - -## Sample Property Values - -```yaml -id: WORKFLOWS_IAM_POLICY@contoso.okta.com -name: Workflows Resource Set -display_name: Workflows Resource Set -okta_domain: contoso.okta.com -description: A resource set managed by Workflows Administrator -created: 2025-10-22T13:29:26+00:00 -last_updated: 2025-10-22T13:29:26+00:00 -``` +--- +title: 'Okta_ResourceSet' +description: 'A resource set containing users, groups, applications, and other Okta objects' +icon: '/images/extensions/okta/okta_resourceset.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Resource sets are collections of entities that can be used to scope custom role assignments in Okta. A resource set can contain the following object types: + +- [x] [Users](/opengraph/extensions/okta/nodes/okta_user) +- [x] [Groups](/opengraph/extensions/okta/nodes/okta_group) +- [x] [Applications](/opengraph/extensions/okta/nodes/okta_application) +- [x] [API Service Integrations](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) +- [x] [Devices](/opengraph/extensions/okta/nodes/okta_device) +- [x] [Authorization servers](/opengraph/extensions/okta/nodes/okta_authorizationserver) +- [x] [Identity Providers](/opengraph/extensions/okta/nodes/okta_identityprovider) +- [x] [Policies](/opengraph/extensions/okta/nodes/okta_policy) + - [x] Entity risk policy + - [x] Session protection policy + - [x] Authentication policy + - [x] Global session policy + - [x] End user account management policy +- [ ] Shared Signals Framework (SSF) Receivers +- [ ] ~~Workflows~~ (Gaps in the Okta API) +- [ ] ~~Customizations~~ (Gaps in the Okta API) +- [ ] ~~Support cases~~ (Gaps in the Okta API) +- [ ] ~~Identity and Access Management Resources~~ (Gaps in the Okta API) + + +Only the marked resource types are currently supported as resource set members. Some resource types, such as Workflows, are not accessible via the Okta API at all. + +![Okta Resource Set displayed in BloodHound](/images/extensions/okta/bloodhound-resource-set.png) + +Okta resource sets are represented as Okta_ResourceSet nodes. diff --git a/docs/opengraph/extensions/okta/nodes/okta_role.mdx b/docs/opengraph/extensions/okta/nodes/okta_role.mdx index 2aecd611..7ff4f25a 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_role.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_role.mdx @@ -1,115 +1,60 @@ ---- -title: 'Okta_Role' -description: 'A built-in role in Okta, such as Super Admin or Group Admin' -icon: '/images/extensions/okta/okta_role.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -Okta provides a handful of [built-in administrative roles](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm) that can be assigned to users, groups, and applications to delegate administrative tasks. These roles have predefined permissions and cannot be modified. - -The following roles are organization-wide: - -- Super Administrator -- Organization Administrator -- API Access Management Administrator -- Mobile Administrator -- Workflows Administrator -- Report Administrator -- Read-only Administrator - -The most powerful role is the **Super Administrator**, which has full access to all features and settings in the Okta organization. - -The following roles can either be scoped to specific resources or assigned organization-wide: - -- Group Administrator (AKA User Administrator) -- Group Membership Administrator -- Help Desk Administrator -- Application Administrator - - -Although the Workflows Administrator role is a built-in role, the Okta API treats it as a custom role that is scoped to the built-in `Workflows Resource Set`. - -Built-in roles are represented as Okta_Role nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_HasRole](/opengraph/extensions/okta/edges/okta_hasrole) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ❌ | - -### Outbound Edges - -No outbound edges are defined by the Okta extension for this node. - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `role.id + "@" + okta_domain` | `string` | Unique role identifier (domain-qualified). | -| `name` | `role.label` | `string` | Role name. | -| `display_name` | `role.label` | `string` | Display-friendly role name. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the role exists. | -| `description` | `role.description` | `string` | Role description text when available. | -| `permissions` | Hardcoded mapping | `string[]` | Effective permission labels associated with the role. | - -## Sample Property Values - -```yaml -id: APP_ADMIN@contoso.okta.com -name: Application Administrator -display_name: Application Administrator -okta_domain: contoso.okta.com -permissions: - - okta.apps.manage - - okta.apps.read - - okta.apps.assignment.manage - - okta.apps.clientCredentials.read - - okta.users.appAssignment.manage - - okta.groups.appAssignment.manage - - okta.policies.manage - - okta.policies.read - - okta.users.read - - okta.groups.read - - okta.users.userprofile.manage - - okta.users.userprofile.read - - okta.profilesources.import.run - - okta.agents.register - - okta.realms.read -``` - -## Built-In Role Identifiers - -When working with roles using the Okta API, the built-in roles are referenced by the following identifiers: - -| Role Identifier | Role Name | -|-----------------------------|-------------------------------------| -| SUPER_ADMIN | Super Administrator | -| ORG_ADMIN | Organization Administrator | -| USER_ADMIN | Group Administrator | -| GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator | -| APP_ADMIN | Application Administrator | -| API_ACCESS_MANAGEMENT_ADMIN | API Access Management Administrator | -| ~~API_ADMIN~~ | API Administrator (Deprecated?) | -| HELP_DESK_ADMIN | Help Desk Administrator | -| MOBILE_ADMIN | Mobile Administrator | -| WORKFLOWS_ADMIN | Workflows Administrator | -| REPORT_ADMIN | Report Administrator | -| READ_ONLY_ADMIN | Read-Only Administrator | - -To make the role identifiers unique, the collector adds the organization domain name as a suffix to each role's ID, e.g., `SUPER_ADMIN@contoso.okta.com`. - -## Built-In Role Permissions - -Unlike custom roles, built-in roles have fixed permissions that cannot be changed. -However, the exact OAuth 2.0 scopes granted to each built-in role are not publicly documented by Okta and cannot even be retrieved via the API. -We therefore did the mapping by ourselves based on the role descriptions in the Okta documentation. -Hence, the resulting permissions ingested to BloodHound are best-effort approximations and may not be 100% accurate. +--- +title: 'Okta_Role' +description: 'A built-in role in Okta, such as Super Admin or Group Admin' +icon: '/images/extensions/okta/okta_role.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +Okta provides a handful of [built-in administrative roles](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm) that can be assigned to users, groups, and applications to delegate administrative tasks. These roles have predefined permissions and cannot be modified. + +The following roles are organization-wide: + +- Super Administrator +- Organization Administrator +- API Access Management Administrator +- Mobile Administrator +- Workflows Administrator +- Report Administrator +- Read-only Administrator + +The most powerful role is the **Super Administrator**, which has full access to all features and settings in the Okta organization. + +The following roles can either be scoped to specific resources or assigned organization-wide: + +- Group Administrator (AKA User Administrator) +- Group Membership Administrator +- Help Desk Administrator +- Application Administrator + + +Although the Workflows Administrator role is a built-in role, the Okta API treats it as a custom role that is scoped to the built-in `Workflows Resource Set`. + +Okta built-in roles are represented as Okta_Role nodes. + +## Built-In Role Identifiers + +When working with roles using the Okta API, the built-in roles are referenced by the following identifiers: + +| Role Identifier | Role Name | +|-----------------------------|-------------------------------------| +| SUPER_ADMIN | Super Administrator | +| ORG_ADMIN | Organization Administrator | +| USER_ADMIN | Group Administrator | +| GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator | +| APP_ADMIN | Application Administrator | +| API_ACCESS_MANAGEMENT_ADMIN | API Access Management Administrator | +| ~~API_ADMIN~~ | API Administrator (Deprecated?) | +| HELP_DESK_ADMIN | Help Desk Administrator | +| MOBILE_ADMIN | Mobile Administrator | +| WORKFLOWS_ADMIN | Workflows Administrator | +| REPORT_ADMIN | Report Administrator | +| READ_ONLY_ADMIN | Read-Only Administrator | + +To make the role identifiers unique, the OpenHound collector adds the organization domain name as a suffix to each role's ID, e.g., `SUPER_ADMIN@contoso.okta.com`. + +## Built-In Role Permissions + +Unlike custom roles, built-in roles have fixed permissions that cannot be changed. However, the exact OAuth 2.0 scopes granted to each built-in role are not publicly documented by Okta and cannot even be retrieved via the API. We therefore did the mapping by ourselves based on the role descriptions in the Okta documentation. Hence, the resulting permissions ingested to BloodHound are best-effort approximations and may not be 100% accurate. diff --git a/docs/opengraph/extensions/okta/nodes/okta_roleassignment.mdx b/docs/opengraph/extensions/okta/nodes/okta_roleassignment.mdx index 4760f9f3..f54059c6 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_roleassignment.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_roleassignment.mdx @@ -1,57 +1,11 @@ ---- -title: 'Okta_RoleAssignment' -description: 'A set of permissions assigned to a user, group, or an application in Okta' -icon: '/images/extensions/okta/okta_roleassignment.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - +--- +title: 'Okta_RoleAssignment' +description: 'A set of permissions assigned to a user, group, or an application in Okta' +icon: '/images/extensions/okta/okta_roleassignment.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + To help visualize role assignments in BloodHound, Okta_RoleAssignment nodes are created for each role assignment in Okta. These nodes represent the relationship between a [user](/opengraph/extensions/okta/nodes/okta_user), [group](/opengraph/extensions/okta/nodes/okta_group), or [application](/opengraph/extensions/okta/nodes/okta_application) and a role ([built-in](/opengraph/extensions/okta/nodes/okta_role) or [custom](/opengraph/extensions/okta/nodes/okta_customrole)). -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_HasRoleAssignment](/opengraph/extensions/okta/edges/okta_hasroleassignment) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization), [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device), [Okta_AuthorizationServer](/opengraph/extensions/okta/nodes/okta_authorizationserver) | ❌ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `roleAssignment.id + "_" + assignee.id` | `string` | Unique role-assignment identifier derived from role assignment and assignee IDs. | -| `name` | `roleAssignment.label` | `string` | Role name associated with this assignment. | -| `display_name` | `roleAssignment.label` | `string` | Display label used in BloodHound. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the role assignment exists. | -| `assignment_type` | `roleAssignment.assignmentType` | `string` | Assignment scope/type (for example user or group assignment). | -| `type` | `roleAssignment.type` | `string` | Assigned role identifier (for example `WORKFLOWS_ADMIN`, `APP_ADMIN`). | -| `status` | `roleAssignment.status` | `string` | Role assignment lifecycle status. | -| `created` | `roleAssignment.created` | `datetime` | Role assignment creation timestamp. | -| `last_updated` | `roleAssignment.lastUpdated` | `datetime` | Last role assignment update timestamp. | - -## Sample Property Values - -```yaml -id: irbwnwe8vjjXl4FbX697_00uw2sodowQc75SUm697 -name: Workflows Administrator -display_name: Workflows Administrator -okta_domain: contoso.okta.com -assignment_type: USER -type: WORKFLOWS_ADMIN -status: ACTIVE -created: 2025-10-22T13:29:26+00:00 -last_updated: 2025-10-22T13:29:26+00:00 -``` diff --git a/docs/opengraph/extensions/okta/nodes/okta_user.mdx b/docs/opengraph/extensions/okta/nodes/okta_user.mdx index 641d4313..d884d6be 100644 --- a/docs/opengraph/extensions/okta/nodes/okta_user.mdx +++ b/docs/opengraph/extensions/okta/nodes/okta_user.mdx @@ -1,158 +1,41 @@ ---- -title: 'Okta_User' -description: 'An Okta user account' -icon: '/images/extensions/okta/okta_user.png' ---- - -Applies to BloodHound Enterprise and CE - -## Overview - -User objects (AKA People) represent individuals who have access to the Okta organization. Each user has a unique identifier, username in the email address format, and various attributes such as email, first name, last name, and status. - -Users are represented as Okta_User nodes in BloodHound. -## Edges - - -The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [Okta_ApiTokenFor](/opengraph/extensions/okta/edges/okta_apitokenfor) | [Okta_ApiToken](/opengraph/extensions/okta/nodes/okta_apitoken) | ✅ | -| [Okta_Contains](/opengraph/extensions/okta/edges/okta_contains) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_DeviceOf](/opengraph/extensions/okta/edges/okta_deviceof) | [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) | ❌ | -| [Okta_GroupAdmin](/opengraph/extensions/okta/edges/okta_groupadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_HelpDeskAdmin](/opengraph/extensions/okta/edges/okta_helpdeskadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_IdentityProviderFor](/opengraph/extensions/okta/edges/okta_identityproviderfor) | [Okta_IdentityProvider](/opengraph/extensions/okta/nodes/okta_identityprovider) | ✅ | -| [Okta_InboundSSO](/opengraph/extensions/okta/edges/okta_inboundsso) | [AZUser](/resources/nodes/az-user) | ✅ | -| [Okta_ManagerOf](/opengraph/extensions/okta/edges/okta_managerof) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ❌ | -| [Okta_OrgAdmin](/opengraph/extensions/okta/edges/okta_orgadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_OutboundSSO](/opengraph/extensions/okta/edges/okta_outboundsso) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_PasswordSync](/opengraph/extensions/okta/edges/okta_passwordsync) | [User](/resources/nodes/user), [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_ReadPasswordUpdates](/opengraph/extensions/okta/edges/okta_readpasswordupdates) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_RealmContains](/opengraph/extensions/okta/edges/okta_realmcontains) | [Okta_Realm](/opengraph/extensions/okta/nodes/okta_realm) | ✅ | -| [Okta_ResetFactors](/opengraph/extensions/okta/edges/okta_resetfactors) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_ResetPassword](/opengraph/extensions/okta/edges/okta_resetpassword) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_ResourceSetContains](/opengraph/extensions/okta/edges/okta_resourcesetcontains) | [Okta_ResourceSet](/opengraph/extensions/okta/nodes/okta_resourceset) | ✅ | -| [Okta_ScopedTo](/opengraph/extensions/okta/edges/okta_scopedto) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | -| [Okta_UserPull](/opengraph/extensions/okta/edges/okta_userpull) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ❌ | -| [Okta_UserSync](/opengraph/extensions/okta/edges/okta_usersync) | [User](/resources/nodes/user), [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [SNOW_User](https://github.com/SpecterOps/SnowHound) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [Okta_AddMember](/opengraph/extensions/okta/edges/okta_addmember) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_AppAdmin](/opengraph/extensions/okta/edges/okta_appadmin) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application), [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) | ✅ | -| [Okta_AppAssignment](/opengraph/extensions/okta/edges/okta_appassignment) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ❌ | -| [Okta_CreatorOf](/opengraph/extensions/okta/edges/okta_creatorof) | [Okta_ApiServiceIntegration](/opengraph/extensions/okta/nodes/okta_apiserviceintegration) | ❌ | -| [Okta_GroupAdmin](/opengraph/extensions/okta/edges/okta_groupadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_GroupMembershipAdmin](/opengraph/extensions/okta/edges/okta_groupmembershipadmin) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_HasRole](/opengraph/extensions/okta/edges/okta_hasrole) | [Okta_Role](/opengraph/extensions/okta/nodes/okta_role), [Okta_CustomRole](/opengraph/extensions/okta/nodes/okta_customrole) | ❌ | -| [Okta_HasRoleAssignment](/opengraph/extensions/okta/edges/okta_hasroleassignment) | [Okta_RoleAssignment](/opengraph/extensions/okta/nodes/okta_roleassignment) | ❌ | -| [Okta_HelpDeskAdmin](/opengraph/extensions/okta/edges/okta_helpdeskadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_ManageApp](/opengraph/extensions/okta/edges/okta_manageapp) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ✅ | -| [Okta_ManagerOf](/opengraph/extensions/okta/edges/okta_managerof) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ❌ | -| [Okta_MemberOf](/opengraph/extensions/okta/edges/okta_memberof) | [Okta_Group](/opengraph/extensions/okta/nodes/okta_group) | ✅ | -| [Okta_MobileAdmin](/opengraph/extensions/okta/edges/okta_mobileadmin) | [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) | ✅ | -| [Okta_OrgAdmin](/opengraph/extensions/okta/edges/okta_orgadmin) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [Okta_Group](/opengraph/extensions/okta/nodes/okta_group), [Okta_Device](/opengraph/extensions/okta/nodes/okta_device) | ✅ | -| [Okta_OutboundSSO](/opengraph/extensions/okta/edges/okta_outboundsso) | [AZUser](/resources/nodes/az-user), [GH_User](/opengraph/extensions/github/nodes/gh_user), [jamf_Account](/opengraph/extensions/jamf/nodes/jamf_account), [SNOW_User](https://github.com/SpecterOps/SnowHound), [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_PasswordSync](/opengraph/extensions/okta/edges/okta_passwordsync) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [User](/resources/nodes/user) | ✅ | -| [Okta_ReadClientSecret](/opengraph/extensions/okta/edges/okta_readclientsecret) | [Okta_ClientSecret](/opengraph/extensions/okta/nodes/okta_clientsecret) | ✅ | -| [Okta_ResetFactors](/opengraph/extensions/okta/edges/okta_resetfactors) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_ResetPassword](/opengraph/extensions/okta/edges/okta_resetpassword) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user) | ✅ | -| [Okta_SuperAdmin](/opengraph/extensions/okta/edges/okta_superadmin) | [Okta_Organization](/opengraph/extensions/okta/nodes/okta_organization) | ✅ | -| [Okta_SWA](/opengraph/extensions/okta/edges/okta_swa) | [GH_User](/opengraph/extensions/github/nodes/gh_user), [jamf_Account](/opengraph/extensions/jamf/nodes/jamf_account), [OP_User](https://github.com/SpecterOps/1PassHound), [SNOW_User](https://github.com/SpecterOps/SnowHound) | ❌ | -| [Okta_UserPush](/opengraph/extensions/okta/edges/okta_userpush) | [Okta_Application](/opengraph/extensions/okta/nodes/okta_application) | ❌ | -| [Okta_UserSync](/opengraph/extensions/okta/edges/okta_usersync) | [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [User](/resources/nodes/user), [AZUser](/resources/nodes/az-user), [OP_User](https://github.com/SpecterOps/1PassHound), [SNOW_User](https://github.com/SpecterOps/SnowHound) | ❌ | - -## Properties - -| Name | Source | Type | Description | -| ---- | ------ | ---- | ----------- | -| `id` | `user.id` | `string` | Unique user identifier. | -| `name` | `user.profile.login` | `string` | Okta username/login. | -| `display_name` | `user.profile.displayName` | `string` | User display name. | -| `okta_domain` | Collector context (non-API) | `string` | Okta organization domain where the user exists. | -| `login` | `user.profile.login` | `string` | User login/UPN value. | -| `email` | `user.profile.email` | `string` | Primary email address. | -| `first_name` | `user.profile.firstName` | `string` | User first/given name. | -| `last_name` | `user.profile.lastName` | `string` | User last/family name. | -| `title` | `user.profile.title` | `string` | Job title from user profile when present. | -| `department` | `user.profile.department` | `string` | Department value from user profile when present. | -| `city` | `user.profile.city` | `string` | City/location value from user profile when present. | -| `state` | `user.profile.state` | `string` | State/region value from user profile when present. | -| `country_code` | `user.profile.countryCode` | `string` | ISO-like country code from user profile when present. | -| `status` | `user.status` | `string` | User lifecycle status. | -| `enabled` | `IsEnabled(user.status)` | `bool` | Boolean status projection used by BloodHound. | -| `has_role_assignments` | Calculated | `bool` | Indicates whether the user is assigned any administrative roles. | -| `credential_provider_name` | `user.credentials.provider.name` | `string` | Authentication provider name for this user. | -| `credential_provider_type` | `user.credentials.provider.type` | `string` | Authentication provider type for this user. | -| `manager_id` | `user.profile.managerId` | `string` | Manager identifier from user profile synchronization. | -| `activated` | `user.activated` | `datetime` | Timestamp when the user account was activated. | -| `created` | `user.created` | `datetime` | User creation timestamp. | -| `password_changed` | `user.passwordChanged` | `datetime` | Timestamp when the password was last changed. | -| `last_login` | `user.lastLogin` | `datetime` | Timestamp of the most recent successful login. | -| `last_updated` | `user.lastUpdated` | `datetime` | Last profile/update timestamp. | - -## Sample Property Values - -```yaml -id: 00uw2sodn4ZPJJQyx697 -name: john.doe@contoso.com -display_name: John Doe -okta_domain: contoso.okta.com -login: john.doe@contoso.com -email: john.doe@contoso.com -first_name: John -last_name: Doe -title: Senior Identity Engineer -department: Security Engineering -city: Seattle -state: WA -country_code: US -status: ACTIVE -enabled: true -has_role_assignments: false -credential_provider_name: OKTA -credential_provider_type: OKTA -manager_id: joe.smith@contoso.com -created: 2025-10-03T18:45:57+00:00 -activated: 2025-10-03T19:02:11+00:00 -password_changed: 2026-01-12T14:27:03+00:00 -last_login: 2026-02-20T09:41:55+00:00 -last_updated: 2025-10-29T11:09:47+00:00 -``` - -## User Status - -User status can have [multiple values](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User), as illustrated below: - -![Okta user status](https://developer.okta.com/docs/api/images/users/okta-user-status.png) - -To simplify analysis in BloodHound, the collector maps the **Status** attribute to the virtual boolean **Enabled** attribute as follows: - -| Okta User Status | Enabled | Explanation | -|------------------|---------|----------------------------------| -| ACTIVE | ✅ | User can authenticate. | -| PASSWORD_EXPIRED | ✅ | User's password has expired but can still authenticate. | -| LOCKED_OUT | ✅ | User is locked out but can still authenticate after unlocking. | -| PROVISIONED | ✅ | User is provisioned but cannot authenticate yet. | -| RECOVERY | ✅ | User is in recovery mode and cannot authenticate. | -| SUSPENDED | ❌ | User is suspended and cannot authenticate. | -| STAGED | ❌ | User is staged and cannot authenticate yet. | -| DEPROVISIONED | ❌ | User is deprovisioned and cannot authenticate. | - - -This mapping is a simplification and may not cover all edge cases. -Always refer to the actual **Status** attribute for precise user state information. - - -## Synchronization with External Directories - -Users can be synchronized from external directories such as Active Directory (AD) or LDAP. When synchronized, certain attributes may be mapped from the external directory to the Okta user profile. - +--- +title: 'Okta_User' +description: 'An Okta user account' +icon: '/images/extensions/okta/okta_user.png' +--- + +Applies to BloodHound Enterprise and CE + +## Overview + +User objects (AKA People) represent individuals who have access to the Okta organization. Each user has a unique identifier, username in the email address format, and various attributes such as email, first name, last name, and status. + +Okta users are represented as Okta_User nodes. + +## User Status + +User status can have [multiple values](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User), as illustrated below: + +![Okta user status](https://developer.okta.com/docs/api/images/users/okta-user-status.png) + +To simplify analysis in BloodHound, the OpenHound collector maps the **Status** attribute to the virtual boolean **Enabled** attribute as follows: + +| Okta User Status | Enabled | Explanation | +|------------------|---------|----------------------------------| +| ACTIVE | ✅ | User can authenticate. | +| PASSWORD_EXPIRED | ✅ | User's password has expired but can still authenticate. | +| LOCKED_OUT | ✅ | User is locked out but can still authenticate after unlocking. | +| PROVISIONED | ✅ | User is provisioned but cannot authenticate yet. | +| RECOVERY | ✅ | User is in recovery mode and cannot authenticate. | +| SUSPENDED | ❌ | User is suspended and cannot authenticate. | +| STAGED | ❌ | User is staged and cannot authenticate yet. | +| DEPROVISIONED | ❌ | User is deprovisioned and cannot authenticate. | + + +This mapping is a simplification and may not cover all edge cases. Always refer to the actual **Status** attribute for precise user state information. + +## Synchronization with External Directories + +Users can be synchronized from external directories such as Active Directory (AD) or LDAP. When synchronized, certain attributes may be mapped from the external directory to the Okta user profile. + ![Additional Active Directory attributes](/images/extensions/okta/user-ad-attributes.png) diff --git a/docs/opengraph/extensions/okta/privilege-zone-rules.mdx b/docs/opengraph/extensions/okta/privilege-zone-rules.mdx index e010b657..a016b188 100644 --- a/docs/opengraph/extensions/okta/privilege-zone-rules.mdx +++ b/docs/opengraph/extensions/okta/privilege-zone-rules.mdx @@ -10,6 +10,21 @@ The following Privilege Zone rules can be imported into BloodHound to group node This file is automatically generated from the [JSON Privilege Zone rule files](https://github.com/SpecterOps/openhound-okta/tree/main/extension/privilege_zone_rules). +## Operational Directory Agents with Delegated Authentication + +Operational Okta AD and LDAP agents associated with applications configured for outbound delegated authentication. + +Zone: Tier Zero + +```cypher +MATCH (agent:Okta_Agent {operational_status: 'OPERATIONAL'})-[:Okta_AgentMemberOf]->(:Okta_AgentPool)-[:Okta_AgentPoolFor]->(app:Okta_Application) +WHERE 'OUTBOUND_DEL_AUTH' IN app.features +AND agent.type IN ['AD', 'LDAP'] +RETURN agent +``` + +This rule is defined in the [operational-directory-agents.json](https://github.com/SpecterOps/openhound-okta/tree/main/extension/privilege_zone_rules/operational-directory-agents.json) file. + ## Organization Organization nodes in Okta. diff --git a/docs/opengraph/extensions/okta/queries.mdx b/docs/opengraph/extensions/okta/queries.mdx index 5265161f..bcffa179 100644 --- a/docs/opengraph/extensions/okta/queries.mdx +++ b/docs/opengraph/extensions/okta/queries.mdx @@ -291,7 +291,6 @@ LIMIT 1000 This query can be imported into BloodHound from the [privileged-principals-hybrid-indirect.json](https://github.com/SpecterOps/openhound-okta/tree/main/extension/saved_searches/privileged-principals-hybrid-indirect.json) file. - ## Privileged Users with Old Passwords (Direct) Finds users whose last password change was more than a year ago and directly hold privileged role assignments. @@ -558,4 +557,4 @@ LIMIT 1000 ``` This query can be imported into BloodHound from the [users-api-tokens.json](https://github.com/SpecterOps/openhound-okta/tree/main/extension/saved_searches/users-api-tokens.json) file. - + diff --git a/docs/opengraph/extensions/okta/schema.mdx b/docs/opengraph/extensions/okta/schema.mdx index d48cfc08..9d183cbc 100644 --- a/docs/opengraph/extensions/okta/schema.mdx +++ b/docs/opengraph/extensions/okta/schema.mdx @@ -9,7 +9,7 @@ icon: circle-nodes **Name:** SOOkta
**Display Name:** Okta Extension (by SpecterOps)
-**Version:** v2.8.1
+**Version:** v2.8.3
**Namespace:** Okta
**Environment Kind:** Okta_Organization
**Source Kind:** Okta