Bridge Okta Connectivity with Apache NiFi

Apache NiFi supports powerful and scalable directed graphs of data routing, transformation, and system mediation logic. When paired with the CData JDBC Driver for Okta, NiFi can work with live Okta data. This article describes how to connect to and query Okta data from an Apache NiFi Flow.

With built-in optimized data processing, the CData JDBC driver offers unmatched performance for interacting with live Okta data. When you issue complex SQL queries to Okta, the driver pushes supported SQL operations, like filters and aggregations, directly to Okta and utilizes the embedded SQL engine to process unsupported operations client-side (often SQL functions and JOIN operations). Its built-in dynamic metadata querying allows you to work with and analyze Okta data using native data types.

Connecting to Okta Data in Apache NiFi

1. Download the CData JDBC Driver for Okta installer, unzip the package, run the .exe file to install the driver.

2. Copy the CData JDBC Driver JAR file (and license file if it exists), cdata.jdbc.okta.jar (and cdata.jdbc.okta.lic), to the Apache NiFi lib subfolder, for example, C:\nifi-1.3.0-bin\nifi-1.3.0\lib.

   On Windows, the default location for the CData JDBC Driver is C:\Program Files\CData\CData JDBC Driver for Okta.

3. Start Apache NiFi by running the run-nifi.bat file in bin subfolder, for example, C:\nifi-1.3.0-bin\nifi-1.3.0\bin.

   (OR)

   Use the command prompt to navigate to the particular directory and run the run-nifi.bat file for example:

   cd C:\nifi-1.3.0-bin\nifi-1.3.0\bin
   .\run-nifi.bat
   

4. Navigate to the Apache NiFi UI in your web browser: It should be https://localhost:8443/nifi.

   Note: If users are utilizing an older version of Apache NiFi, they should access it via http://localhost:8080/nifi. In earlier versions, HTTP was the protocol employed. However, in the most recent version, HTTPS is the standard. By default, HTTP operates on port 8080, while HTTPS uses port 8443.

5. When accessing Apache NiFi via a URL, it prompts you to enter a username and password for login.

   To retrieve login credentials, users should consult the 'App.log' file located within the log directory of their NiFi installation. This file typically contains the necessary details for accessing the NiFi interface.

6. Click the (Configuration) button from the Operate sidebar under the "NiFi Flow" process group.
7. In the NiFi Flow Configuration page, navigate to the "Controller Services" tab.
8. Click the button to create a new controller service.
9. In the Add Controller Service page, select "DBCPConnectionPool", and then click Add.
10. In the Configure Controller Service page, navigate to the "Properties" tab.
11. Click the gear button to configure the new DBCPConnection Pool.

12. Fill in the properties:

    Property	Value
    Database Connection URL	jdbc:okta:Domain=dev-44876464.okta.com;InitiateOAuth=GETANDREFRESH
    Database Driver Class Name	cdata.jdbc.okta.OktaDriver
    Database Driver Location(s)	Path to your Apache NiFi's lib folder where the JAR files are present.

    Built-in Connection String Designer

    For assistance in constructing the JDBC URL, use the connection string designer built into the Okta JDBC Driver. Either double-click the JAR file or execute the JAR file from the command-line.

    java -jar cdata.jdbc.okta.jar

    Fill in the connection properties and copy the connection string to the clipboard.

    To connect to Okta, set the Domain connection string property to your Okta domain.

    You will use OAuth to authenticate with Okta, so you need to create a custom OAuth application.

    Creating a Custom OAuth Application

    From your Okta account:

    1. Sign in to your Okta developer edition organization with your administrator account.
    2. In the Admin Console, go to Applications > Applications.
    3. Click Create App Integration.
    4. For the Sign-in method, select OIDC - OpenID Connect.
    5. For Application type, choose Web Application.
    6. Enter a name for your custom application.
    7. Set the Grant Type to Authorization Code. If you want the token to be automatically refreshed, also check Refresh Token.
    8. Set the callback URL:
       • For desktop applications and headless machines, use http://localhost:33333 or another port number of your choice. The URI you set here becomes the CallbackURL property.
       • For web applications, set the callback URL to a trusted redirect URL. This URL is the web location the user returns to with the token that verifies that your application has been granted access.
    9. In the Assignments section, either select Limit access to selected groups and add a group, or skip group assignment for now.
    10. Save the OAuth application.
    11. The application's Client Id and Client Secret are displayed on the application's General tab. Record these for future use. You will use the Client Id to set the OAuthClientId and the Client Secret to set the OAuthClientSecret.
    12. Check the Assignments tab to confirm that all users who must access the application are assigned to the application.
    13. On the Okta API Scopes tab, select the scopes you wish to grant to the OAuth application. These scopes determine the data that the app has permission to read, so a scope for a particular view must be granted for the driver to have permission to query that view. To confirm the scopes required for each view, see the view-specific pages in Data Model < Views in the Help documentation.
13. To establish a connection and execute a select query, simply drag and drop the processor (indicated by the yellow highlight) into the workspace.
14. Select the 'ExecuteSQL' processor and click the 'Add' button to make it visible in the workspace.
15. Click on the added processor (ExecuteSQL)to open the connection page.
16. Click on the Verify Properties button and verify to test the connection.
17. Ensure that all the verification results are successful, and then click on APPLY.
18. Activate the connection by clicking the small button at the right corner of the screen.

Your Okta data is now available for use in Apache NiFi. For example, you can use the DBCPConnection Pool as the source for a QueryDatabaseTable processor (shown below).

Download a free, 30-day trial of the CData JDBC Driver for Okta and start working with your live Okta data in Apache NiFi. Reach out to our Support Team if you have any questions.