• By -Camille Debay

Okta LDAP Configuration

• Posted on 2023-07-31
• Posted in 3rd party solutions

Workspace ONE can integrate with Okta LDAP, VMware have a KB for it ( https://kb.vmware.com/s/article/2961230 ) however it is outdated this article detail the Workspace ONE configuration required for it to work.

To configure the Okta side follow Okta documentation available here : https://help.okta.com/oie/en-us/Content/Topics/Directory/LDAP-interface-main.htm

These parameters are in All Settings > System > Enterprise Integration > Directory Services

You need to change the value in red to match your tenant configuration.

LDAP

Directory Type	LDAP – Other LDAP
Server	oktatenant.ldap.okta.com
Encryption Type	SSL
Port	636
Protocol Version	3
Use Service Account Credentials	Disabled
Bind Authentication Type	Basic
Bind Username	uid=username,ou=users,dc=oktatenant,dc=okta,dc=com
Domain	Okta
Server	oktatenant.ldap.okta.com

Advanced

Search Subdomains	Disabled
Connection Timeout	30
Request Timeout	300
Search Without Base DN	Disabled
Use Recursive OID At Enrollment	Disabled
Use Recursive OID For Group Sync	Disabled
Object Identifier Data Type	String
Sort Control	Disabled

User

Domain	Base DN
Okta	dc=oktatenant,dc=okta,dc=com
User Object Class	inetOrgPerson
User Search Filter	(&(objectClass=inetOrgPerson)(uid={EnrollmentUser}))

Advanced

Auto Merge	Enabled
Automatically Sync Enabled Or Disabled User Status	Enabled
Value For Disabled Status	DEPROVISIONED / Value Exact Match

Attribute	Mapping Value
Object Identifier	uniqueIdentifier
Username	uid
Member Of	memberOf
Full Name	cn
Display Name	cn
First Name	givenName
Middle Name	middleName
Last Name	sn
Email address	mail
Email Username	Empty
Mobile Phone	Empty
Phone Number	Empty
Distinguished Name	entryDN
User Principal Name	mail
Department	Empty
Status	organizationalStatus
Lockout Time	Empty
Object Class	objectClass
Last Modified	modifyTimestamp
Binding Attribute	Empty
Employee ID	employeeID
Cost Center	Empty
Manager Distinguished Name	Empty

Groups

Domain	Base DN
Okta	dc=OKTATeantName,dc=okta,dc=com
Group Object Class	groupofUniqueNames
Organizational Unit Object Class	organizationalUnit

Advanced

Group Search Filter	(&(objectClass=groupofUniqueNames))
Membership Attribute	User Attribute(“Member of”)
Auto Sync Default	Enabled
Auto Merge Default	Enabled
Maximum Allowable Changes	10
Auto-Update Friendly Name	Enabled

Attribute	Mapping Value
Object Identifier	uniqueldentifier
Name	cn
Member	uniqueMember
Common Name	cn
Member Of	Empty
Distinguished Name	distinguishedName
Group Object Class	objectCIass
Organizational Unit	ou
Organizational Unit Object Class	objectClass