A complete solution for open data platforms, enterprise data catalogs, data lakes and data management. Open source, mature, fully-featured and production ready.

DataHub

Hello, We’ve enabled okta integration to DataHub. I am looking for how the Okta user/Okta group/Policies work, basically mapping between Okta groups and Okta users. Let me know if anyone has docs related to this or any pointers. THanks!

So once you get Okta users onto DataHub you can begin to add them to DataHub Policies. For example you can assign particular groups to "Admin" Policies, metadata editor policies, viewer policies, etc. <@U02DZ51RCK0> Can actually speak more about this :slightly_smiling_face:

Hi <@U01GCJKA8P9>, Thanks for the response! I was looking for answers/pointers around
```Will the Okta groups be populated into Datahub? Or Will the Okta groups that the Okta users are part of would be considered at all for authorization perspective?
Okta is used only as Authentication layer and authorization is completely handled by DatHub groups &amp; DataHub policies?
Do we've to manually add newly created Okta users on DataHub to groups(with our own policies) which we have create separately on DataHub?```

```Will the Okta groups be populated into Datahub? Or Will the Okta groups that the Okta users are part of would be considered at all for authorization perspective?```
When a user logs in, their groups will be pulled and created in DataHub. This is called _just-in-time provisioning._ These groups will be considered for authorization, but the groups must have datahub privileges added to them.

```Okta is used only as Authentication layer and authorization is completely handled by DatHub groups &amp; DataHub policies?```
Correct!

```Do we've to manually add newly created Okta users on DataHub to groups(with our own policies) which we have create separately on DataHub?```
No. Your users's group membership will come from Okta!

Awesome! Thanks for the quick response. I am not seeing the Okta equivalent groups/groups from okta being created on DataHub

Are you using OIDC? If yes, you may need to make sure Okta is configured to return the groups claim to DataHub!

If it is not, then DataHub cannot provision the groups :disappointed:

Check this step: <https://datahubproject.io/docs/how/auth/sso/configure-oidc-react-okta/#4-configure-datahub-frontend-to-enable-oidc-authentication>

```If yes, you may need to make sure Okta is configured to return the groups claim to DataHub!```
Cool, looks like I have to check with my SSO team for this. Any config I need to pass to `datahub-frontend`  pod specifically to get the groups? I am passing `groups`  as an option in the list for `AUTH_OICD_SCOPE` . Would this be enough for getting info about user’s groups?

Hi <@U01GCJKA8P9>, We see that groups from okta are getting created on Datahub now. However, we’re running into a different issue now. Once I get past Okta SSO, UI keeps reloading without displaying Datahub UI on the browser. We see these error constantly printed in `datahub-frontend`  pod logs-
```18:07:03 [application-akka.actor.default-dispatcher-5480] ERROR auth.sso.oidc.OidcCallbackLogic - Unable to renew the session. The session store may not support this feature```
Please let me know when you get a chance. Thanks

Hi <@U03J8FFTDPY> , how did you get the groups populated? Thanks!