mirror of
https://github.com/hashicorp/vault.git
synced 2025-11-11 22:01:23 +01:00
5c6720e9e0
* remove mount accessor from MFA config * Update login_mfa_duo_test.go * DUO test with entity templating * using identitytpl.PopulateString to perform templating * minor refactoring * fixing fmt failures in CI * change username format to username template * fixing username_template example
153 lines
3.9 KiB
Plaintext
153 lines
3.9 KiB
Plaintext
---
|
||
layout: api
|
||
page_title: /identity/mfa/method/okta - HTTP API
|
||
description: >-
|
||
The '/identity/mfa/method/okta' endpoint focuses on managing Okta MFA behaviors in Vault.
|
||
---
|
||
|
||
## Configure Okta MFA Method
|
||
|
||
This endpoint defines an MFA method of type Okta.
|
||
|
||
| Method | Path |
|
||
| :----- |:--------------------------------|
|
||
| `POST` | `/identity/mfa/method/okta/:id` |
|
||
|
||
### Parameters
|
||
|
||
- `id` `(string: "")` - Optional UUID to specify if updating an existing method.
|
||
|
||
- `mount_accessor` `(string: <required>)` - The mount to tie this method to for use in automatic mappings. The mapping
|
||
will use the Name field of Aliases associated with this mount as the username in the mapping. Note that this can
|
||
be from the current namespace or a child namespace.
|
||
|
||
- `username_template` `(string)` - A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `"{{identity.entity.name}}@example.com"`. If blank, the Entity's Name field is used as-is.
|
||
|
||
- `org_name` `(string: <required>)` - Name of the organization to be used in the Okta API.
|
||
|
||
- `api_token` `(string: <required>)` - Okta API key.
|
||
|
||
- `base_url` `(string)` - If set, will be used as the base domain for API requests. Examples are okta.com, oktapreview.com, and okta-emea.com.
|
||
|
||
- `primary_email` `(bool: false)` - If set, the username will only match the primary email for the account.
|
||
|
||
### Sample Payload
|
||
|
||
```json
|
||
{
|
||
"mount_accessor": "auth_userpass_1793464a",
|
||
"org_name": "dev-262778",
|
||
"api_token": "0081u7KrReNkzmABZJAP2oDyIXccveqx9vIOEyCZDC"
|
||
}
|
||
```
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request POST \
|
||
--data @payload.json \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/okta
|
||
```
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request POST \
|
||
--data @payload.json \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/okta/1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc
|
||
```
|
||
|
||
## Read Okta MFA Method
|
||
|
||
This endpoint queries the MFA configuration of Okta type for a given method
|
||
name.
|
||
|
||
| Method | Path |
|
||
| :----- |:--------------------------------|
|
||
| `GET` | `/identity/mfa/method/okta/:id` |
|
||
|
||
### Parameters
|
||
|
||
- `id` `(string: <required>)` – UUID of the MFA method.
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request GET \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/okta/1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc
|
||
|
||
```
|
||
|
||
### Sample Response
|
||
|
||
```json
|
||
{
|
||
"data": {
|
||
"api_token": "0081u7KrReNkzmABZJAP2oDyIXccveqx9vIOEyCZDC",
|
||
"id": "1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc",
|
||
"mount_accessor": "auth_userpass_1793464a",
|
||
"name": "my_okta",
|
||
"org_name": "dev-262778",
|
||
"type": "okta",
|
||
"username_template": ""
|
||
}
|
||
}
|
||
```
|
||
|
||
## Delete Okta MFA Method
|
||
|
||
This endpoint deletes a Okta MFA method. The MFA methods can only be deleted if they're not currently in use
|
||
by a [login enforcement](/api/secret/identity/mfa/login-enforcement).
|
||
|
||
| Method | Path |
|
||
| :------- |:--------------------------------|
|
||
| `DELETE` | `/identity/mfa/method/okta/:id` |
|
||
|
||
### Parameters
|
||
|
||
- `id` `(string: <required>)` - UUID of the MFA method.
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request DELETE \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/okta/1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc
|
||
|
||
```
|
||
|
||
## List Okta MFA Methods
|
||
|
||
This endpoint lists Okta MFA methods that are visible in the current namespace or in parent namespaces.
|
||
|
||
| Method | Path |
|
||
|:-------|:----------------------------|
|
||
| `LIST` | `/identity/mfa/method/okta` |
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request LIST \
|
||
http://127.0.0.1:8200/v1/identity/mfa/method/okta
|
||
|
||
```
|
||
|
||
### Sample Response
|
||
|
||
```json
|
||
{
|
||
"data": {
|
||
"keys": [
|
||
"1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc"
|
||
]
|
||
}
|
||
}
|
||
```
|