Migrate from Okta

# connectors/okta-scim.yaml
apiVersion: v1
kind: Connector
metadata:
  name: okta-production
spec:
  type: scim
  config:
    # Okta SCIM endpoint
    endpoint: https://your-domain.okta.com/api/v1/scim/v2

    # Authentication
    auth:
      type: oauth2
      client_id: $OKTA_CLIENT_ID
      client_secret: $OKTA_CLIENT_SECRET
      token_url: https://your-domain.okta.com/oauth2/v1/token

    # Sync settings
    sync_interval: 15m  # Sync every 15 minutes
    full_sync_interval: 24h  # Full resync daily

    # What to sync
    resources:
      - users
      - groups
      - group_memberships

    # Attribute mapping (Okta -> TigerIdentity)
    attribute_mapping:
      user:
        email: emails[primary eq true].value
        first_name: name.givenName
        last_name: name.familyName
        department: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department
        manager: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager.value
        employee_id: externalId
        job_title: title
        cost_center: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:costCenter

      group:
        name: displayName
        external_id: externalId

# connectors/okta-api.yaml
apiVersion: v1
kind: Connector
metadata:
  name: okta-api-connector
spec:
  type: okta
  config:
    domain: your-domain.okta.com
    api_token: $OKTA_API_TOKEN  # Create in Okta Admin > Security > API

    sync_interval: 15m

    # Additional Okta-specific data
    sync_options:
      include_suspended_users: false
      include_app_assignments: true  # Import app assignments as resources
      include_admin_roles: true  # Sync Okta admin roles

# Deploy connector
tigeridentity connector create -f connectors/okta-scim.yaml

# Trigger initial sync
tigeridentity connector sync okta-production --full

# Check sync status
tigeridentity connector status okta-production

# Verify user count matches
tigeridentity principals list --source okta-production --count
# Should match your Okta active user count

# Verify groups imported
tigeridentity groups list --source okta-production

# policies/migrate-from-okta-example.yaml
apiVersion: v1
kind: Policy
metadata:
  name: prod-database-access
  description: "Migrated from Okta group: engineering-prod-db-access"

spec:
  # Resources (what)
  resources:
    - type: database
      environment: production

  # Default deny
  default_decision: deny

  rules:
    # Engineers get JIT access with approval
    - name: engineering-jit-access
      effect: allow_with_approval

      principals:
        # Map from Okta groups
        groups: [engineering, platform-team]
        # Or use department attribute
        department: engineering

      actions: [query, admin]

      approval:
        required: true
        approvers:
          - type: manager
          - type: group
            group: database-admins

      session:
        max_duration: 2h
        require_justification: true

    # Database admins get longer sessions
    - name: dba-extended-access
      effect: allow_with_approval

      principals:
        groups: [database-admins]

      actions: [query, admin, configure]

      approval:
        required: true
        approvers:
          - type: role
            role: security_lead

      session:
        max_duration: 8h

    # Break-glass emergency access
    - name: emergency-access
      effect: allow

      principals:
        groups: [oncall-engineers, database-admins]

      context:
        emergency: true

      session:
        max_duration: 4h

      notifications:
        - channel: slack
          webhook: https://hooks.slack.com/services/...
          message: "Emergency DB access: {principal} -> {resource}"

# Deploy policies in audit mode (log only, don't enforce)
tigeridentity policy deploy prod-database-access \
  --mode audit \
  --duration 7d

# TigerIdentity will:
# 1. Evaluate every access request
# 2. Log what the decision WOULD be
# 3. NOT block any access
# 4. Compare to Okta's decision

# Review audit logs
tigeridentity audit query \
  --policy prod-database-access \
  --mode audit \
  --output comparison.json

# Look for discrepancies
{
  "total_requests": 1247,
  "matches": 1198,  # TigerIdentity and Okta agree
  "discrepancies": 49,  # Investigate these
  "breakdown": {
    "tigeridentity_allow_okta_deny": 12,
    "tigeridentity_deny_okta_allow": 37
  }
}

// Example: Shadow mode in application code
async function checkAccess(user, resource, action) {
  // Production: Okta decision is enforced
  const oktaDecision = await oktaClient.checkAccess(user, resource);

  // Shadow: TigerIdentity evaluated but not enforced
  const tigerDecision = await tigerIdentityClient.checkAccess({
    principal: user.id,
    resource: resource.id,
    action: action,
    mode: "shadow"
  });

  // Log discrepancies
  if (oktaDecision.allowed !== tigerDecision.allowed) {
    logger.warn("Access decision mismatch", {
      user, resource, action,
      okta: oktaDecision.allowed,
      tigeridentity: tigerDecision.allowed
    });
  }

  // Only enforce Okta for now
  return oktaDecision.allowed;
}

# Enable enforcement for specific app
tigeridentity policy deploy prod-database-access \
  --mode enforce \
  --scope '{"resources": {"app": "internal-dashboard"}}'

# Monitor for issues
tigeridentity audit tail --policy prod-database-access --live

# If all good, expand to more apps
tigeridentity policy deploy prod-database-access \
  --mode enforce \
  --scope '{"resources": {"environment": "development"}}'

# Finally, full production
tigeridentity policy deploy prod-database-access \
  --mode enforce \
  --scope all

# Verify Okta is no longer making authorization decisions
# (Keep Okta for SSO/authentication)