Okta integration
Sign in to Maskflare with Okta and provision people with SCIM
- Single sign-on with OpenID Connect or SAML 2.0, for people at an email domain you have verified with a DNS TXT record
- Enforce single sign-on: removes the Maskflare passwords of everyone at that domain, except one break-glass owner you choose
- SCIM 2.0 provisioning of users and groups: create, update and deactivate members from Okta
- Roles from groups: map each pushed Okta group to Admin, Security, Developer or Auditor, with a default for everyone else
The Maskflare console holds your masking rules, keys and audit trail, so who can sign in and with which role matters. Connecting Okta means people use the account they already have, your sign-in policies apply, and leaving the company ends their access.
There are two separate pieces. Single sign-on sends people at your email domain to Okta to sign in. SCIM provisioning lets Okta add, update and remove members and set their role from Okta groups. You can use either one or both.
What it does
- Single sign-on with OpenID Connect or SAML 2.0, for people at an email domain you have verified with a DNS TXT record
- Enforce single sign-on: removes the Maskflare passwords of everyone at that domain, except one break-glass owner you choose
- SCIM 2.0 provisioning of users and groups: create, update and deactivate members from Okta
- Roles from groups: map each pushed Okta group to Admin, Security, Developer or Auditor, with a default for everyone else
- Provisioned groups and the department attribute can scope policy exceptions
Set up Okta with Maskflare
Okta signs people in to the Maskflare console over OpenID Connect or SAML 2.0, and can provision members and roles over SCIM 2.0. You set it up in the console under Settings.
Single sign-on
- In the Maskflare console, open Settings, then Single sign-on. Under 1. Verify your domains, enter your email domain and select Add domain.
- At your DNS provider, create the TXT record the console shows (TXT name and TXT value), then select Verify. Only a verified domain can be connected.
- In the Okta Admin Console, open Applications and select Create App Integration. Choose OIDC - OpenID Connect, then Web Application.
- Set the Sign-in redirect URI to the Redirect URI / ACS URL shown under 2. Connect your identity provider in Maskflare, and assign the people or groups who should use Maskflare. Save, then copy the Client ID and the Client secret from the app's General tab.
- In Maskflare, set Protocol to OpenID Connect. Enter a Name on the sign-in page (for example Acme Okta), choose the Domain, and enter the Discovery URL (your Okta domain followed by /.well-known/openid-configuration), the Client ID and the Client secret.
- Select Send people of this domain to the identity provider, then Save identity provider.
- Sign in as a test user to check it works. Then, under 3. Enforce single sign-on, choose a Break-glass owner and select Enforce single sign-on. This deletes the Maskflare passwords of everyone at the domain except that owner's, so the owner can still get in if Okta is down.
Provisioning with SCIM (optional)
- In Maskflare, open Settings, then User provisioning and select Create token. Copy the SCIM base URL and the token now: the token is shown once.
- In Okta, add SCIM provisioning to an app integration (Okta's SCIM guide is linked below). Enter the SCIM base URL, use userName as the unique identifier, turn on Push New Users, Push Profile Updates and Push Groups, and choose HTTP Header authentication with the token. Maskflare requires the header Authorization: Bearer followed by the token.
- Assign the people and push the groups you want in Maskflare. Maskflare identifies a person by their email address, so make sure Okta sends it as the user name.
- Back in Maskflare, under Roles from groups, add a mapping from each group name to a role, and choose what Everyone else gets. A person in several mapped groups gets the strongest role.
What data is shared
- At sign-in, Okta sends Maskflare the person's email address, first name and last name (the email, given_name and family_name claims). They are refreshed at every sign-in.
- Through SCIM, Okta sends the user name (email address), given and family name, whether the account is active, an external ID, the department if Okta sends the enterprise extension, and group names with their members.
- Maskflare sends Okta nothing about AI traffic. Okta only sees the sign-in redirect.
- Prompts, files, detected values and traffic metadata are never part of this connection.
Good to know
- SCIM never changes an owner. An owner can't be deactivated, deleted or given another role by provisioning, so a break-glass owner always remains.
- Deactivating someone in Okta disables them in Maskflare, ends their sessions and flags the app keys they created, so you can review them. It does not revoke the keys by itself.
- New people are created only at your verified domains. Without a verified domain, Okta can update existing members but can't add anyone new.
- What the SCIM endpoint supports: Users and Groups, create, read, replace, patch and delete, and filters of the form attribute eq value. It does not support bulk operations, sorting, ETags or password changes.
- Okta offers SCIM provisioning on app integrations created with SAML or SWA. Follow Okta's SCIM guide to choose the app that carries provisioning.
- To use SAML instead of OpenID Connect, choose SAML 2.0 as the Protocol and enter your Okta app's metadata URL. Maskflare expects signed assertions and the email address as the Name ID.
- Directory sync from Okta (your Okta domain and a read-only API token) exists in the platform service and reads users, departments and groups every 15 minutes. The console screen to connect it is not released yet, so it isn't self-service today.
Vendor documentation
Frequently asked questions
Does Maskflare support Okta SAML as well as OIDC?
Yes. The single sign-on page offers OpenID Connect and SAML 2.0. Choose the protocol that suits how you manage apps in Okta.
What happens to existing passwords when we enforce single sign-on?
Enforcing deletes the Maskflare passwords of everyone at the domain except the break-glass owner you choose. Turning enforcement off does not restore them; people use Forgot password.
Can Okta set roles in Maskflare?
Yes, through SCIM. Map each pushed group to Admin, Security, Developer or Auditor under Roles from groups. Owners are never changed by provisioning.
What does the SCIM endpoint cover?
Users and Groups with create, read, replace, patch and delete, and filtering. It does not support bulk operations, sorting or password changes. The token, group-to-role mapping and default role are under Settings, User provisioning.
Does Okta see our prompts?
No. Okta is only used to sign people in and to push users and groups. Prompts and files never go to your identity provider.
Other identity integrations
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →