When configuring the SailPoint Okta Connector to use OAuth 2.0 authentication, Okta generates an HTTP 403 error when attempting to manage or aggregate roles. This issue occurs because the integration lacks the appropriate API permissions. Grant the okta.roles.read and okta.roles.manage scopes from the Okta API Scopes tab in the Okta Admin Console to resolve the error.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• SailPoint Okta Connector
• OAuth 2.0 Authentication
• Role Management

The OAuth 2.0 application configured in Okta lacks the required API scopes to access or modify role data.

How is the HTTP 403 error resolved when managing roles?

Navigate to the SailPoint application settings in the Admin Console and grant the required role management scopes from the Okta API Scopes tab.

1. Log in to the Okta Admin Console.
2. Navigate to Applications > Applications.
3. Select the SailPoint application.
4. Select the Okta API Scopes tab.
5. Review the list of granted scopes.
6. Select Grant next to the okta.roles.read scope to enable reading roles.
7. Select Grant next to the okta.roles.manage scope to enable managing roles.

Refer to Authenticate with OAuth 2.0 for more details.

Related References

• Authenticate with OAuth 2.0