OKTA-1137444 OIN submission for 3p actions#6095
Open
vanngo-okta wants to merge 39 commits intomasterfrom
Open
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
vanngo-okta
force-pushed
the
vn-okta-vn-1137444-3p-actions
branch
from
420e6a6 to
281da75
Compare
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
vanngo-okta
force-pushed
the
vn-okta-vn-1137444-3p-actions
branch
from
d62fef5 to
1b369d9
Compare
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
vanngo-okta
force-pushed
the
vn-okta-vn-1137444-3p-actions
branch
from
397c6da to
3eb84a0
Compare
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
* Add UL contracts * Add contract headers * Add prov create/update user contracts * Add activate/deactivate/get user by id contracts * Add more prov group action schemas * Add EM contracts * Edits * Add prov test plan and edits from feedback * Update packages/@okta/vuepress-site/docs/guides/oin-api-actions-contracts/index.md Co-authored-by: grahamsmith-okta <graham.smith@okta.com> * Update packages/@okta/vuepress-site/docs/guides/oin-api-actions-contracts/index.md Co-authored-by: grahamsmith-okta <graham.smith@okta.com> * Update packages/@okta/vuepress-site/docs/guides/oin-api-actions-contracts/index.md Co-authored-by: grahamsmith-okta <graham.smith@okta.com> * Update packages/@okta/vuepress-site/docs/guides/oin-api-actions-contracts/index.md Co-authored-by: grahamsmith-okta <graham.smith@okta.com> * Update packages/@okta/vuepress-site/docs/guides/oin-api-actions-contracts/index.md Co-authored-by: grahamsmith-okta <graham.smith@okta.com> * Update packages/@okta/vuepress-site/docs/guides/oin-api-actions-contracts/index.md Co-authored-by: grahamsmith-okta <graham.smith@okta.com> * Update packages/@okta/vuepress-site/docs/guides/oin-api-actions-contracts/index.md Co-authored-by: grahamsmith-okta <graham.smith@okta.com> * Update packages/@okta/vuepress-site/docs/guides/oin-api-actions-contracts/index.md Co-authored-by: grahamsmith-okta <graham.smith@okta.com> * Apply suggestions from Graham's review Co-authored-by: grahamsmith-okta <graham.smith@okta.com> * Apply suggestions from Graham's code review Co-authored-by: grahamsmith-okta <graham.smith@okta.com> --------- Co-authored-by: grahamsmith-okta <graham.smith@okta.com>
vanngo-okta
force-pushed
the
vn-okta-vn-1137444-3p-actions
branch
from
994046e to
3aa1121
Compare
vanngo-okta
requested review from
barbaravo-okta,
brentschaus-okta,
emikhasyak-okta,
grahamsmith-okta,
ishan-krishna-okta,
janethu-okta,
paulwallace-okta and
susanharper-okta
as code owners
This comment was marked as outdated.
This comment was marked as outdated.
vanngo-okta
commented
May 6, 2026
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
| @@ -1,4 +1,3 @@ | |||
| * [Integration variables](/docs/guides/submit-oin-app/openidconnect/main/#integration-variables) | |||
| > **Note:** See [Update integration considerations](#update-integration-considerations) for backwards compatibility with integration variables. | |||
| * [Tenant settings](/docs/guides/submit-oin-app/openidconnect/main/#tenant-settings) for backwards compatibility with integration variables. | |||
Contributor
There was a problem hiding this comment.
Suggested change
| * [Tenant settings](/docs/guides/submit-oin-app/openidconnect/main/#tenant-settings) for backwards compatibility with integration variables. | |
| * [Tenant settings](/docs/guides/submit-oin-app/openidconnect/main/#tenant-settings) for backward compatibility with integration variables. |
| 1. Test the logout flow manually for Universal Logout integration. See [Test your Universal Logout integration](/docs/guides/submit-oin-app/openidconnect/main/#test-your-universal-logout-integration). | ||
|
|
||
| > **Note:** Okta recommends that you execute the Runscope CRUD tests and the manual Okta SCIM integration tests on a published-version SCIM instance for backwards compatibility. The results of the backwards-compatibility tests aren't requirements for submission. No newline at end of file | ||
| > **Note:** Okta recommends that you execute the Runscope CRUD tests and the manual Okta SCIM integration tests on a published-version SCIM instance for backwards compatibility. The results of the backward-compatibility tests aren't requirements for submission. No newline at end of file |
Contributor
There was a problem hiding this comment.
Suggested change
| > **Note:** Okta recommends that you execute the Runscope CRUD tests and the manual Okta SCIM integration tests on a published-version SCIM instance for backwards compatibility. The results of the backward-compatibility tests aren't requirements for submission. | |
| > **Note:** Okta recommends that you execute the Runscope CRUD tests and the manual Okta SCIM integration tests on a published-version SCIM instance for backward compatibility. The results of the backward compatibility tests aren't requirements for submission. |
| 1. Test the logout flow manually for Universal Logout integration. See [Test your Universal Logout integration](/docs/guides/submit-oin-app/openidconnect/main/#test-your-universal-logout-integration). | ||
|
|
||
| > **Note:** Okta recommends that you execute the Runscope CRUD tests and the manual Okta SCIM integration tests on a published-version SCIM instance for backwards compatibility. The results of the backwards-compatibility tests aren't requirements for submission. No newline at end of file | ||
| > **Note:** Okta recommends that you execute the Runscope CRUD tests and the manual Okta SCIM integration tests on a published-version SCIM instance for backwards compatibility. The results of the backward-compatibility tests aren't requirements for submission. No newline at end of file |
Contributor
There was a problem hiding this comment.
Suggested change
| > **Note:** Okta recommends that you execute the Runscope CRUD tests and the manual Okta SCIM integration tests on a published-version SCIM instance for backwards compatibility. The results of the backward-compatibility tests aren't requirements for submission. | |
| > **Note:** Okta recommends that you execute the Runscope CRUD tests and the manual Okta SCIM integration tests on a published-version SCIM instance for backward compatibility. The results of the backward compatibility tests aren't requirements for submission. |
| > * Your integration doesn't support SSO JIT. | ||
| > * The **Create User** SCIM operation is enabled. | ||
| > * You should already have an instance of your published integration for SSO backwards-compatibility testing. The OIN Wizard ensures that an SSO published instance is available in your org before you update your integration. If you don't have a published-version instance for SSO testing, exit the OIN Wizard and create the SSO OIN-published instance. See [Add existing app integrations](https://help.okta.com/okta_help.htm?type=oie&id=csh-apps-add-app) to create an OIN-published instance for backwards-compatibility testing. | ||
| > * You should already have an instance of your published integration for SSO backward-compatibility testing. The OIN Wizard ensures that an SSO published instance is available in your org before you update your integration. If you don't have a published-version instance for SSO testing, exit the OIN Wizard and create the SSO OIN-published instance. See [Add existing app integrations](https://help.okta.com/okta_help.htm?type=oie&id=csh-apps-add-app) to create an OIN-published instance for backward-compatibility testing. |
Contributor
There was a problem hiding this comment.
Suggested change
| > * You should already have an instance of your published integration for SSO backward-compatibility testing. The OIN Wizard ensures that an SSO published instance is available in your org before you update your integration. If you don't have a published-version instance for SSO testing, exit the OIN Wizard and create the SSO OIN-published instance. See [Add existing app integrations](https://help.okta.com/okta_help.htm?type=oie&id=csh-apps-add-app) to create an OIN-published instance for backward-compatibility testing. | |
| > * You should already have an instance of your published integration for SSO backward compatibility testing. The OIN Wizard ensures that an SSO published instance is available in your org before you update your integration. If you don't have a published-version instance for SSO testing, exit the OIN Wizard and create the SSO OIN-published instance. See [Add existing app integrations](https://help.okta.com/okta_help.htm?type=oie&id=csh-apps-add-app) to create an OIN-published instance for backward compatibility testing. |
| * [OIN catalog properties](/docs/guides/submit-oin-app/scim/main/#oin-catalog-properties) | ||
| * [Integration variables](/docs/guides/submit-oin-app/scim/main/#integration-variables) | ||
| * [Tenant settings](/docs/guides/submit-oin-app/scim/main/#tenant-settings) | ||
| > **Note:** See [Update integration considerations](#update-integration-considerations) for backwards compatibility with integration variables. |
Contributor
There was a problem hiding this comment.
Suggested change
| > **Note:** See [Update integration considerations](#update-integration-considerations) for backwards compatibility with integration variables. | |
| > **Note:** See [Update integration considerations](#update-integration-considerations) for backward compatibility with integration variables. |
| @@ -1,10 +1,10 @@ | |||
| For example, if you have an OIDC configuration variable called `subdomain`, then you can set your **Redirect URI** string to `https://{app.subdomain}.example.org/strawberry/login`. When your customer sets their `subdomain` variable value to `berryfarm`, then `https://berryfarm.example.org/strawberry/login` is their redirect URL. | |||
| For example, if you have an OIDC setting variable called `subdomain`, then you can set your **Redirect URI** string to `https://{app.subdomain}.example.org/strawberry/login`. When your customer admin sets their `subdomain` setting value to `berryfarm`, then `https://berryfarm.example.org/strawberry/login` is their redirect URL. | |||
Contributor
There was a problem hiding this comment.
What is a customer admin?
| > * See [Troubleshoot the OIN Submission Tester](/docs/guides/submit-app-prereq/main/#troubleshoot-the-oin-submission-tester) if you have issues loading the OIN Submission Tester. | ||
|
|
||
| The OIN Submission Tester includes the mechanism to test the following flows: | ||
|
|
Contributor
There was a problem hiding this comment.
Are these flows usually called IdP-initiated and SP-initiated?
| * Your app tile appears on the Okta End-User Dashboard. | ||
| * The tester selects the app tile and you're signed in to your app. | ||
|
|
||
| 1. Verify that the test end user signed in to your app with the correct profile. |
Contributor
There was a problem hiding this comment.
Suggested change
| 1. Verify that the test end user signed in to your app with the correct profile. | |
| 1. Verify that the test end user is signed in to your app with the correct profile. |
| A new Chrome browser in incognito mode appears for you to sign in. | ||
|
|
||
| 1. Sign in to your app as the test end user who's assigned to your app instance. | ||
| 1. Verify that the test end user signed in to your app with the correct profile. |
Contributor
There was a problem hiding this comment.
Suggested change
| 1. Verify that the test end user signed in to your app with the correct profile. | |
| 1. Verify that the test end user is signed in to your app with the correct profile. |
| 1. Selects the app tile. | ||
| 1. Wait for confirmation that the new test user signed in and was provisioned in your app. You're responsible for verifying this step. | ||
|
|
||
| 1. Verify that the test user signed in to your app with the correct first name, last name, and email attributes. |
Contributor
There was a problem hiding this comment.
Suggested change
| 1. Verify that the test user signed in to your app with the correct first name, last name, and email attributes. | |
| 1. Verify that the test user is signed in to your app with the correct first name, last name, and email attributes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Resolves:
Netlify Preview Link:
Preview