Okta collector for OpenHound
About
OpenHound is a standardized framework for building and running OpenGraph collectors and converters. It is built in Python and powered by the Data Load Tool (DLT) library, giving you a consistent workflow to collect, process, and convert data from any source into BloodHound-compatible graphs.
The openhound-okta extension collects Okta resources and transforms these into usable nodes and edges for BloodHound.
For SAML catalog integrations, see the OIN route evidence and resolver contract. The collector prefers explicit deployed routes and otherwise fails closed unless a reviewed catalog resolver has the complete settings it requires.
Getting Started
Follow the OpenHound docs to get started:
OAuth app authentication behavior
When the collector uses Okta OAuth app credentials, it shares one bearer token across endpoint clients and refreshes that token before it expires. Long-running collections can therefore continue across the Okta access-token lifetime without failing active resource pagination. If a transient proactive refresh fails while the current token is still valid, the collector temporarily keeps using that token and suppresses repeated refresh attempts for a short cooldown. If Okta rejects a bearer token with HTTP 401, the collector retries once for stale, invalid, or unknown token responses while preserving the current token for known non-token authorization failures. Classic SSWS API token authentication remains static.
Rate-limit behavior
The collector coordinates requests by Okta API endpoint family. It limits concurrent requests, observes
X-Rate-Limit-Remaining and X-Rate-Limit-Reset on successful responses, and paces later requests before a bucket
is exhausted. HTTP 429 responses retry the same request and pagination cursor until a bounded elapsed-time budget is
reached. Transport failures and HTTP 5xx responses retain DLT's retry coverage.
Fan-out resources use explicit page sizes where Okta documents safe maxima. Expanded group collection requests 200 rows per page, application-user collection requests 500 rows per page, application-group assignment collection requests 200 rows per page, group-push mapping collection requests 1,000 rows per page, and identity-provider user collection requests 200 rows per page. Application-group assignments are collected from each application's public assignment endpoint and retain Okta's assignment timestamp, priority, and profile field names without publishing assignment profile values to the graph. Rows stream to DLT; an exhausted required request fails the collection so DLT does not publish an incomplete replacement. If the initial expanded group page repeatedly times out, the collector retries that first page with successively halved limits before failing. With the default configuration, that sequence is 200, 100, then 50.
The defaults can be adjusted with DLT source configuration environment variables:
| Environment variable | Default | Purpose |
|---|---|---|
SOURCES__SOURCE__OKTA__APPLICATION_USERS_PAGE_SIZE |
500 |
Application users per page, from 1 through 500 |
SOURCES__SOURCE__OKTA__GROUPS_PAGE_SIZE |
200 |
Expanded groups per page, from 1 through 200 |
SOURCES__SOURCE__OKTA__APPLICATION_GROUP_ASSIGNMENTS_PAGE_SIZE |
200 |
Application-group assignments per page, from 20 through 200 |
SOURCES__SOURCE__OKTA__GROUP_PUSH_MAPPINGS_PAGE_SIZE |
1000 |
Group push mappings per page, from 1 through 1,000 |
SOURCES__SOURCE__OKTA__IDENTITY_PROVIDER_USERS_PAGE_SIZE |
200 |
Identity-provider users per page, from 1 through 200 |
SOURCES__SOURCE__OKTA__ENDPOINT_CONCURRENCY |
2 |
Maximum simultaneous requests per endpoint family |
SOURCES__SOURCE__OKTA__RATE_LIMIT_MAX_ELAPSED_SECONDS |
900 |
Maximum elapsed retry window for an individual 429 request |
SOURCES__SOURCE__OKTA__RATE_LIMIT_REMAINING_RESERVE |
1 |
Requests held in reserve when pacing against a rate-limit window |
Release files for openhound-okta 0.4.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| openhound_okta-0.4.0.tar.gz | 3.6 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| openhound_okta-0.4.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 3.7 MB
Release files / openhound_okta-0.4.0.tar.gz
| Download URL | openhound_okta-0.4.0.tar.gz |
|---|---|
| Size | 3.6 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
1d89f93bd4e5f7af681906540cc0e5319fe797212d694d8d966e75f082a64276
|
|
BLAKE2b-256 checksum How to use checksums |
acd4641f9a13bac66fb551af6761ebb68b99c5122f072821c0c5a2bae0c629a0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.12.8 {"installer":{"name":"uv","version":"0.12.8","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / openhound_okta-0.4.0-py3-none-any.whl
| Download URL | openhound_okta-0.4.0-py3-none-any.whl |
|---|---|
| Size | 117.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
2078e13571b0e945bf3d15590aae31bc09049445d8dab57395a29d3374b2269f
|
|
BLAKE2b-256 checksum How to use checksums |
2d905d30019769336b675d0566df1c7ddaf920e8ccf53cb5aaa0f2057d8e364c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.12.8 {"installer":{"name":"uv","version":"0.12.8","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
