MatthewE.60094 (Customer) asked a question.
We are utilizing the LDAP interface to sync user data from Okta to an external application (Igloo). We were able to set up the sync to our main tenant, but now we're trying to set up a secondary connection to a "spoke" tenant that's just for one subset of the business.
We'd like to create a custom Admin role for the Spoke that is restricted to a specific Resource Group so that the import tool only pulls users from that group, but all attempts have failed. I can do a successful test using the main account, but that would also mean that we would need to manage the connection at Corporate instead of passing the utility to the Spoke's IT.
According to the documentation (https://help.okta.com/en-us/Content/Topics/Directory/LDAP-interface-connection-settings.htm), "Must have admin permissions, but can be a read-only admin". Is there a way to do that via Custom Admin settngs?
We solved it; the issue appeared to be with our search string. We were copying the string from the primary sync that uses a full RO Admin account to look up people in a specific group:
(&(objectclass=inetOrgPerson)(memberOf=cn=groupName))
Because this uses a custom RO Admin for a Group, we simplified the search string:
(objectclass=inetOrgPerson)
That pulls just the users in the group where the Admin has access and allows us to proceed. I'll need to do some additional modifications for some subsequent queries but it appears to be working for this small population.
Thanks!