idp_users

Creates, updates, deletes, gets or lists an idp_users resource.

Overview

Name	idp_users
Type	Resource
Id	okta.idps.idp_users

Fields

The following fields are returned by SELECT queries:

get_identity_provider_application_user

Name	Datatype	Description
id	string	Unique key of the user
_embedded	object	Embedded resources related to the IdP user
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
created	string (date-time)	Timestamp when the object was created (example: 2016-01-03T18:15:47.000Z)
externalId	string	Unique IdP-specific identifier for the user (example: saml.jackson@example.com)
lastUpdated	string (date-time)	Timestamp when the object was last updated (example: 2016-01-03T18:15:47.000Z)
profile	object	IdP-specific profile for the user. IdP user profiles are IdP-specific but may be customized by the Profile Editor in the Admin Console. > Note: Okta variable names have reserved characters that may conflict with the name of an IdP assertion attribute. You can use the External name to define the attribute name as defined in an IdP assertion such as a SAML attribute name.

list_identity_provider_application_users

Name	Datatype	Description
id	string	Unique key of the user
_embedded	object	Embedded resources related to the IdP user
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
created	string (date-time)	Timestamp when the object was created (example: 2016-01-03T18:15:47.000Z)
externalId	string	Unique IdP-specific identifier for the user (example: saml.jackson@example.com)
lastUpdated	string (date-time)	Timestamp when the object was last updated (example: 2016-01-03T18:15:47.000Z)
profile	object	IdP-specific profile for the user. IdP user profiles are IdP-specific but may be customized by the Profile Editor in the Admin Console. > Note: Okta variable names have reserved characters that may conflict with the name of an IdP assertion attribute. You can use the External name to define the attribute name as defined in an IdP assertion such as a SAML attribute name.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_identity_provider_application_user	select	idpId, userId, subdomain		Retrieves a linked identity provider (IdP) user by ID
list_identity_provider_application_users	select	idpId, subdomain	q, after, limit, expand	Lists all the users linked to an identity provider (IdP)
unlink_user_from_identity_provider	delete	idpId, userId, subdomain		Unlinks the Okta user and the identity provider (IdP) user. The next time the user federates into Okta through this IdP, they have to re-link their account according to the account link policy.
link_user_to_identity_provider	exec	idpId, userId, subdomain		Links an Okta user to an existing SAML or social identity provider (IdP). The SAML IdP must have honorPersistentNameId set to true to use this API. The Name Identifier Format of the incoming assertion must be urn:oasis:names:tc:SAML:2.0:nameid-format:persistent.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
idpId	string	id of IdP
subdomain	string	(default: my-org)
userId	string	ID of an existing Okta user
after	string	The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination and Link header.
expand	string	Expand user data
limit	integer	A limit on the number of objects to return
q	string	Searches the records for matching value

SELECT examples

get_identity_provider_application_user

Retrieves a linked identity provider (IdP) user by ID

SELECT
id,
_embedded,
_links,
created,
externalId,
lastUpdated,
profile
FROM okta.idps.idp_users
WHERE idpId = '{{ idpId }}' -- required
AND userId = '{{ userId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_identity_provider_application_users

Lists all the users linked to an identity provider (IdP)

SELECT
id,
_embedded,
_links,
created,
externalId,
lastUpdated,
profile
FROM okta.idps.idp_users
WHERE idpId = '{{ idpId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND q = '{{ q }}'
AND after = '{{ after }}'
AND limit = '{{ limit }}'
AND expand = '{{ expand }}'
;

DELETE examples

unlink_user_from_identity_provider

Unlinks the Okta user and the identity provider (IdP) user. The next time the user federates into Okta through this IdP, they have to re-link their account according to the account link policy.

DELETE FROM okta.idps.idp_users
WHERE idpId = '{{ idpId }}' --required
AND userId = '{{ userId }}' --required
AND subdomain = '{{ subdomain }}' --required
;

Lifecycle Methods

link_user_to_identity_provider

Links an Okta user to an existing SAML or social identity provider (IdP).

The SAML IdP must have honorPersistentNameId set to true to use this API.
The Name Identifier Format of the incoming assertion must be urn:oasis:names:tc:SAML:2.0:nameid-format:persistent.

EXEC okta.idps.idp_users.link_user_to_identity_provider 
@idpId='{{ idpId }}' --required, 
@userId='{{ userId }}' --required, 
@subdomain='{{ subdomain }}' --required 
@@json=
'{
"externalId": "{{ externalId }}"
}'
;