mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-26 07:30:11 +00:00
Illia PolosukhinandClaude Opus 4.6
810ba58fd2
Sandboxed WASM tool that integrates with Okta's Management API and MyAccount API. Supports user profile CRUD, listing all SSO app chiclets, searching apps by name, retrieving SSO launch links, and fetching org info. Uses OAuth2 with PKCE against the Org Authorization Server, with the domain stored in workspace at okta/domain. Co-Authored-By: Claude Opus 4.6 <[email protected]>
94 lines
2.9 KiB
JSON
94 lines
2.9 KiB
JSON
{
|
|
"http": {
|
|
"allowlist": [
|
|
{
|
|
"host": "*.okta.com",
|
|
"path_prefix": "/api/v1/",
|
|
"methods": ["GET", "POST", "PUT"]
|
|
},
|
|
{
|
|
"host": "*.okta.com",
|
|
"path_prefix": "/idp/myaccount/",
|
|
"methods": ["GET", "PUT"]
|
|
},
|
|
{
|
|
"host": "*.okta.com",
|
|
"path_prefix": "/oauth2/v1/",
|
|
"methods": ["POST"]
|
|
},
|
|
{
|
|
"host": "*.oktapreview.com",
|
|
"path_prefix": "/api/v1/",
|
|
"methods": ["GET", "POST", "PUT"]
|
|
},
|
|
{
|
|
"host": "*.oktapreview.com",
|
|
"path_prefix": "/idp/myaccount/",
|
|
"methods": ["GET", "PUT"]
|
|
},
|
|
{
|
|
"host": "*.oktapreview.com",
|
|
"path_prefix": "/oauth2/v1/",
|
|
"methods": ["POST"]
|
|
},
|
|
{
|
|
"host": "*.okta-emea.com",
|
|
"path_prefix": "/api/v1/",
|
|
"methods": ["GET", "POST", "PUT"]
|
|
},
|
|
{
|
|
"host": "*.okta-emea.com",
|
|
"path_prefix": "/idp/myaccount/",
|
|
"methods": ["GET", "PUT"]
|
|
},
|
|
{
|
|
"host": "*.okta-emea.com",
|
|
"path_prefix": "/oauth2/v1/",
|
|
"methods": ["POST"]
|
|
}
|
|
],
|
|
"credentials": {
|
|
"okta_oauth_token": {
|
|
"secret_name": "okta_oauth_token",
|
|
"location": { "type": "bearer" },
|
|
"host_patterns": ["*.okta.com", "*.oktapreview.com", "*.okta-emea.com"]
|
|
}
|
|
},
|
|
"rate_limit": {
|
|
"requests_per_minute": 30,
|
|
"requests_per_hour": 500
|
|
},
|
|
"timeout_secs": 30
|
|
},
|
|
"workspace": {
|
|
"allowed_prefixes": ["okta/"]
|
|
},
|
|
"secrets": {
|
|
"allowed_names": ["okta_oauth_token"]
|
|
},
|
|
"auth": {
|
|
"secret_name": "okta_oauth_token",
|
|
"display_name": "Okta",
|
|
"oauth": {
|
|
"authorization_url": "https://{okta_domain}/oauth2/v1/authorize",
|
|
"token_url": "https://{okta_domain}/oauth2/v1/token",
|
|
"client_id_env": "OKTA_OAUTH_CLIENT_ID",
|
|
"client_secret_env": "OKTA_OAUTH_CLIENT_SECRET",
|
|
"scopes": [
|
|
"openid",
|
|
"profile",
|
|
"email",
|
|
"offline_access",
|
|
"okta.users.read.self",
|
|
"okta.users.manage.self",
|
|
"okta.apps.read"
|
|
],
|
|
"use_pkce": true
|
|
},
|
|
"instructions": "1. In your Okta Admin Console, go to Applications > Create App Integration\n2. Select 'OIDC - OpenID Connect', then 'Web Application'\n3. Set Sign-in redirect URI to http://localhost:9876/callback (through :9886)\n4. Under Okta API Scopes, grant: okta.users.read.self, okta.users.manage.self, okta.apps.read\n5. Copy the Client ID and Client Secret\n6. IMPORTANT: You must use the Org Authorization Server (not a custom one)\n7. Store your Okta domain in workspace at 'okta/domain' (e.g., 'mycompany.okta.com')\n8. For custom domains, add them to okta-tool.capabilities.json allowlist",
|
|
"setup_url": "https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/",
|
|
"token_hint": "OAuth2 access token (JWT)",
|
|
"env_var": "OKTA_OAUTH_TOKEN"
|
|
}
|
|
}
|