How it works.
The Okta integration is the deepest identity integration on the wrxstack platform. It uses two Okta-managed surfaces, federated to the wrxstack identity layer. SAML 2.0 handles sign-on. The Okta API handles policy-aware MFA enforcement for sensitive in-product actions. The integration is set up as a standard SAML application that you configure in your own Okta tenant.
When a user signs in for the first time, Okta posts a SAML assertion to the wrxstack ACS endpoint. If the user is new, just-in-time provisioning creates a wrxstack identity from the assertion attributes. Returning users attach to their existing identity. Group claims map to wrxstack roles using a configurable rule set. Step-up MFA is requested when a user takes an action that the workspace policy marks as sensitive, for example exporting an audit log or changing a security setting.
Setup steps.
Search the Okta Integration Network for "wrxstack" and install the official app to your tenant. Approve the listed scopes.
Copy the wrxstack ACS URL and entity ID from your wrxstack admin panel into the Okta app. Set NameID format to EmailAddress.
Map first name, last name, email, and groups. wrxstack reads the groups claim to assign roles. JIT provisioning uses the email claim as the unique key.
In the wrxstack admin panel, write rules that map Okta group names to wrxstack roles. Default-deny is the default. Save and test with a non-admin account.
Optional. In Okta, define an application sign-on policy that requires Push or WebAuthn for the wrxstack app. wrxstack honors the policy on every assertion.
The full setup takes about thirty minutes for a first-time Okta admin and ten minutes for an experienced one. We have a step-through wizard in the wrxstack admin panel that walks through each step and validates the configuration before activation.
What it syncs.
| Surface | Direction | Cadence | Notes |
|---|---|---|---|
| role assignments | Derived | On every assertion | wrxstack roles computed from group claims plus rule set. |
| mfa enforcement | Okta → wrxstack | Per-request | Sensitive actions trigger Okta step-up; result honored. |
| audit events | wrxstack → audit log | Real-time | All identity events are recorded in the workspace audit log. |
Security model.
SAML assertions are validated against the Okta IdP signing certificate fingerprint and require an XML signature on every assertion. We reject assertions older than five minutes regardless of NotOnOrAfter, and we enforce a per-tenant clock skew tolerance that the admin can configure (default sixty seconds). NameID is bound to the wrxstack identity; we do not match by email alone.
Group-to-role mapping is deny-by-default. A user with a group claim that does not match any configured rule receives the workspace baseline role, which has no write permissions. Rule changes are versioned and audit-logged. The full configuration is exportable as YAML for review.
Common use cases.
- Single sign-on for the workspace.Users land on their Okta dashboard, click the wrxstack tile, and are signed in. No second password. No bookmarklets. No "where do I sign in?" tickets.
- Step-up MFA for sensitive actions.Changing a security setting, exporting an audit log, or installing a new integration each require Push or WebAuthn. Okta enforces. wrxstack honors.
- Role explainability.A user can see why they have a role by clicking through to their profile. The mapping path is shown, end to end, from Okta group to wrxstack role, including the rule that produced the assignment.
Troubleshooting.
- Users sign in but have no role.The group claim is missing or no rule matches. Open the wrxstack admin panel, view the latest sign-in event, and check the group claim Okta sent. Add or fix the rule.
- Step-up MFA prompts every action.The Okta app sign-on policy is set too aggressively. Move policies that require constant re-authentication to the wrxstack action-level policy instead.
- Deprovisioned user can still sign in for a few seconds.Sessions are revoked within thirty seconds. If you need immediate cutoff, use the Okta Universal Logout endpoint we expose in the admin panel.
- Assertion fails with InvalidSignature.The IdP certificate in wrxstack does not match the active one in Okta. Re-import the certificate from the Okta app metadata URL.