Skip to content

Cross-App Access: update Okta setup steps to Okta's current Admin Console - #41269

Closed
samanthasample wants to merge 1 commit into
masterfrom
samantha/xaa-okta-steps
Closed

samanthasample wants to merge 1 commit into
masterfrom
samantha/xaa-okta-steps

Conversation

@samanthasample

Copy link
Copy Markdown

What does this PR do? What is the motivation?

The Okta steps on the Cross-App Access page use labels from an older Okta Admin Console. This PR updates them to match Okta's current Cross App Access docs:

  • Resource app: Machine Assignments > Callers > Cross App Access (XAA) replaces the "Resource Server" tab. The OIN app sets Issuer URL and Scopes; the admin enters the org UUID as Audience/tenant ID.
  • AI agent: Directory > AI Agents > Register AI Agent, with the Claude app linked under Allow users to access this agent (replaces the Delegations tab), the public key on the Client registration tab (replaces Credentials), and users assigned on the User access tab.
  • Resource connection: the resource URL moves here as Resource indicator. "Client ID at resource" becomes AI agent's client ID registered in this app, and "Scope Condition: Allow all" becomes Scopes: Allow any scope.
  • Prerequisites: replaces the two feature-flag names with Okta's SSO requirement and its 250 ID-JAG tokens per user, per resource app, per month limit.
  • Issuer: notes that the issuer must be the Okta org URL, not a custom authorization server or a custom URL domain.

Okta sources: overview, resource app, AI agent, connection, token exchange.

Needs a check in a live Okta org before merge. The labels come from Okta's public docs, not the console. Please confirm:

  • the Datadog OIN app pre-fills Issuer URL and Scopes
  • the agent's Client ID is what Anthropic needs (the old text said "AI Agent ID")
  • an owner is still required before activation (kept from the old text; Okta's page doesn't mention it)
  • the public/private key method is the right one for Claude

This touches the same file as #41188 but stays out of the issuer-rules lines it edits.

Merge readiness

  • Ready for merge

AI assistance

Drafted with Claude Code from Okta's public docs and the Datadog XAA backend.

🤖 Generated with Claude Code

…sole

Match Okta's current labels and paths: Machine Assignments > Callers for
the resource app, Directory > AI Agents registration with a linked app and
Client registration tab, Resource indicator and "AI agent's client ID
registered in this app" on the resource connection, and "Allow any scope".
Replace the feature-flag prerequisite with Okta's SSO requirement and token
limit, and note that the issuer must be the Okta org URL.

Environment: Datadog workspace

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

Preview links (active after the build_preview check completes)

Modified Files

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant