Okta+AWS v2

cmd/baton-okta/config.go

@@ -15,15 +15,21 @@ var (
 	ciam               = field.BoolField("ciam", field.WithDescription("Whether to run in CIAM mode or not. In CIAM mode, only roles and the users assigned to roles are synced"))
 	ciamEmailDomains   = field.StringSliceField("ciam-email-domains",
 		field.WithDescription("The email domains to use for CIAM mode. Any users that don't have an email address with one of the provided domains will be ignored, unless explicitly granted a role"))
-	cache    = field.BoolField("cache", field.WithDescription("Enable response cache"), field.WithDefaultValue(true))
-	cacheTTI = field.IntField("cache-tti", field.WithDescription("Response cache cleanup interval in seconds"), field.WithDefaultValue(60))
-	cacheTTL = field.IntField("cache-ttl", field.WithDescription("Response cache time to live in seconds"), field.WithDefaultValue(300))
+	cache                 = field.BoolField("cache", field.WithDescription("Enable response cache"), field.WithDefaultValue(true))
+	cacheTTI              = field.IntField("cache-tti", field.WithDescription("Response cache cleanup interval in seconds"), field.WithDefaultValue(60))
+	cacheTTL              = field.IntField("cache-ttl", field.WithDescription("Response cache time to live in seconds"), field.WithDefaultValue(300))
+	awsIdentityCenterMode = field.BoolField("aws-identity-center-mode",
+		field.WithDescription("Whether to run in AWS Identity center mode or not. In AWS mode, only samlRoles for groups and the users assigned to groups are synced"))
+	awsOktaAppId = field.StringField("aws-okta-app-id", field.WithDescription("The Okta app id for the AWS application"))
 )
 
 var relationships = []field.SchemaFieldRelationship{
 	field.FieldsDependentOn([]field.SchemaField{oktaPrivateKeyId, oktaPrivateKey}, []field.SchemaField{oktaClientId}),
+	field.FieldsDependentOn([]field.SchemaField{awsOktaAppId}, []field.SchemaField{awsIdentityCenterMode}),
 	field.FieldsMutuallyExclusive(apiToken, oktaClientId),
 	field.FieldsAtLeastOneUsed(apiToken, oktaClientId),
+	field.FieldsMutuallyExclusive(ciam, awsIdentityCenterMode),
+	field.FieldsRequiredTogether(awsIdentityCenterMode, awsOktaAppId),
 }
 
 var configuration = field.NewConfiguration([]field.SchemaField{
@@ -39,4 +45,6 @@ var configuration = field.NewConfiguration([]field.SchemaField{
 	cache,
 	cacheTTI,
 	cacheTTL,
+	awsIdentityCenterMode,
+	awsOktaAppId,
 }, relationships...)

cmd/baton-okta/main.go

@@ -51,6 +51,8 @@ func getConnector(ctx context.Context, v *viper.Viper) (types.ConnectorServer, e
 		Cache:            v.GetBool("cache"),
 		CacheTTI:         v.GetInt32("cache-tti"),
 		CacheTTL:         v.GetInt32("cache-ttl"),
+		AWSMode:          v.GetBool("aws-identity-center-mode"),
+		AWSOktaAppId:     v.GetString("aws-okta-app-id"),
 	}
 
 	cb, err := connector.New(ctx, ccfg)

go.mod

@@ -4,6 +4,7 @@ go 1.22.2
 
 require (
 	github.com/conductorone/baton-sdk v0.2.25
+	github.com/deckarep/golang-set/v2 v2.6.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/okta/okta-sdk-golang/v2 v2.20.0
 	github.com/spf13/viper v1.19.0
@@ -37,7 +38,6 @@ require (
 	github.com/aws/smithy-go v1.20.2 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
-	github.com/deckarep/golang-set/v2 v2.6.0 // indirect
 	github.com/doug-martin/goqu/v9 v9.19.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect

pkg/connector/app.go

@@ -304,6 +304,19 @@ func oktaAppsToOktaApplications(ctx context.Context, apps []okta.App) ([]*okta.A
 	return applications, nil
 }
 
+func oktaAppToOktaApplication(ctx context.Context, app okta.App) (*okta.Application, error) {
+	var oktaApp okta.Application
+	b, err := json.Marshal(app)
+	if err != nil {
+		return nil, fmt.Errorf("okta-connectorv2: error marshalling okta app: %w", err)
+	}
+	err = json.Unmarshal(b, &oktaApp)
+	if err != nil {
+		return nil, fmt.Errorf("okta-connectorv2: error unmarshalling okta app: %w", err)
+	}
+	return &oktaApp, nil
+}
+
 func appResource(ctx context.Context, app *okta.Application) (*v2.Resource, error) {
 	appProfile := map[string]interface{}{
 		"status": app.Status,