Active Directory Sync

Overview

Active Directory Sync is an optional GW Apps platform feature that keeps platform accounts aligned with an external directory. When configured, new directory users are added to GW Apps and suspended directory users are deactivated automatically.

GW Apps provides out-of-the-box directory synchronization with Okta. Google directory synchronization can also be provided when required by the client’s needs. Availability must be confirmed for the client’s GW Apps platform before configuration begins.

This article documents the Okta configuration shown in the current interface. Google synchronization is configured according to the client’s requirements and is not covered by the Okta-specific steps below.

Before You Begin

Confirm the following requirements:

• The optional Active Directory Sync feature has been enabled for the client platform.
• You have Super Administrator or other authorized access to Platform Admin.
• An Okta API Services application has been created for the connection.
• The Okta application has the okta.users.read API scope.
• The Okta application is assigned the Read-only Administrator role.
• You have the Okta domain, Client ID, and matching private key for the service application.
• You know whether Demonstrating Proof-of-Possession (DPoP) is enabled in the Okta application.

Open Directory Synchronization

1.  Open Platform Admin from the GW Apps platform header.

2.  Select Directory Synchronization.

3.  Select New Directory Sync to open the configuration dialog.

Configure the Directory Sync

1.  Enter a clear Name that identifies the directory and purpose of the connection.

2.  Optionally enter a Description for administrators who will maintain the connection.

3.  Confirm that Type is set to Okta.

4.  Select the required Sync Frequency.

Select the Sync Frequency

Sync Frequency determines how often GW Apps checks the configured Okta directory for account changes.

Field or option	Description
12 hours	Run directory synchronization twice per day.
1 day	Run directory synchronization once per day.
3 days	Run directory synchronization every three days.
7 days	Run directory synchronization once per week.

Enter the Okta Configuration

1.  Enter the Okta Domain associated with the service application.

2.  Enter the Client ID generated for the Okta API Services application.

3.  Paste the matching private key into the Private Key field.

Required Okta permissions: The connection requires the okta.users.read API scope and the Read-only Administrator role, as shown in the configuration guidance.

Configure DPoP and Create the Sync

1.  Leave Enable Proof of Possession (DPoP) cleared when DPoP is not required by the Okta application.

2.  If DPoP is enabled in the Okta application, enable it in the GW Apps directory sync as well.

3.  Review the configuration and select Create.

Private key security: After the directory sync is created, the private key cannot be viewed or updated. To use a different private key, create a new directory sync entry with the replacement credentials.

How Synchronization Affects Users

• New users found in the configured directory are added to the GW Apps platform.
• Users suspended in the configured directory are deactivated in GW Apps during synchronization.
• Changes are processed according to the selected synchronization frequency.
• Directory synchronization manages platform accounts; application access continues to be controlled through application users and roles.

Troubleshooting

Field or option	Description
The connection cannot be created	Confirm that every required field is populated and that the private key is in the format expected by the Okta service application.
Authentication fails	Confirm that the Okta domain, Client ID, and private key belong to the same API Services application.
The connection is unauthorized	Confirm the okta.users.read scope and Read-only Administrator assignment in Okta.
DPoP authentication fails	Confirm that the DPoP setting is enabled or disabled consistently in both Okta and GW Apps.
The private key must be replaced	Create a new directory sync entry. A saved private key cannot be viewed or updated.
A user has not synchronized	Confirm the user’s status in Okta, the selected sync frequency, and that the next scheduled synchronization has occurred.