# Provision and deprovision Talon.One users in Okta

> Okta: Provision and deprovision Talon.One users via SSO.

> For the complete documentation index, see [llms.txt](https://docs.talon.one/llms.txt).

This tutorial describes how to set up provisioning and deprovisioning of Talon.One users with [single sign-on (SSO)](/docs/product/account/account-settings/set-up-sso.md) using Okta.

User provisioning and deprovisioning with single sign-on allows administrators to manage
user access across multiple service providers using a single identity provider, thereby
simplifying the user management process and enhancing security.

In this tutorial, the service provider is Talon.One, and the supported identity provider
is [Okta](https://www.okta.com). For more information about Okta, see the Okta
[integration documentation](https://developer.okta.com/docs/guides/).

## Prerequisites

- You have admin rights in Okta.
- You have [admin rights](/docs/product/account/account-settings/manage-roles.md#admin-role)
  in Talon.One.
- You have [set up single sign-on with Okta](/docs/dev/tutorials/sso-with-okta.md) in Talon.One.

## Create a Management API key in Talon.One

To enable Okta to communicate with Talon.One, in Talon.One, you need to create a
[Management API key](/docs/product/account/dev-tools/manage-mapi-keys.md):

1. On the leftmost menu, click <Account className="icon"/> **Account** > <Tools className="icon" /> **Tools** > **Management API keys**.
1. Click **Create Key**.
1. In **Key name**, type a name to identify the key.
1. In **Key expiration date**, select a date.
1. In **Allowed endpoints**, select the `/v1/provisioning/okta` endpoint.
1. Click **Create Key**.
1. Copy and save the generated API key in a secure location.

   :::note
   You cannot display the API key after this step. If you lose the value, create a
   new API key.
   :::

## Create an event hook in Okta

Creating an [event hook](https://help.okta.com/oie/en-us/content/topics/automation-hooks/event-hooks-main.htm)
in Okta allows Talon.One to receive updates about user status changes.

To create an event hook:

1. In the Okta Admin Console, go to **Workflow** > **Event Hooks**.
1. Click **Create Event Hook**.
1. In **Name**, enter a descriptive name for the event hook.
1. In **URL**, enter `https://yourdeployment.talon.one/v1/provisioning/okta`, replacing
   `yourdeployment` to match your Talon.One base URL.
1. In **Authentication field**, type `Authorization`.
1. In **Authentication secret**, type `ManagementKey-v1 {key}`, replacing `{key}` with the
   API key you [created in Talon.One](#create-a-management-api-key-in-talonone).
1. In **Subscribe to events**, select the following events:
   - **User deleted**
   - **User deactivated**
   - **User assigned to app**
   - **User unassigned from app**
1. Click **Save & Continue**.
1. In the **Verify Endpoint Ownership** window, click **Verify**.

## Set up event hook filters in Okta

[Event hook filters](https://help.okta.com/oie/en-us/content/topics/automation-hooks/event-hooks-filters.htm)
ensure that only relevant events trigger the event hook. Without the filters for the
Talon.One application, users added to other applications in Okta will also be mistakenly
added to Talon.One.

### Prerequisites

- In a separate browser tab, you have opened the [system log](https://help.okta.com/oie/en-us/content/topics/reports/reports_syslog.htm) of the Talon.One application.
- In **Settings** > **Features**, you have enabled the **Event Hook Filtering** feature.

### Set up the event hook filters

To set up the event hook filters for the Talon.One application:

1. In the Okta Admin Console, in **Workflow** > **Event Hooks**, open the
   [event hook you created](#create-an-event-hook-in-okta).
1. In the **Filters** tab, click **Edit**.
1. In **User unassigned from app**, click **Apply filter** and configure the following
   parameters:
   - For **Field**, from the dropdown, select `target.id`.
   - For **Operator**, ensure `eq` is selected.
   - For **Value**, copy and paste the `target.id` value (without the quotes) from the
     Talon.One application system log.
1. Click **Add Another** and configure the following parameters:
   - For **Field**, from the dropdown, select `target.type`.
   - For **Operator**, ensure `eq` is selected.
   - For **Value**, copy and paste the `target.type` value (without the quotes) from the
     Talon.One application system log.
1. Repeat the previous two steps for the **User assigned to app** filter.
1. Click **Save**.

## Manage Talon.One users in Okta

After you've created the event hook and set up the filters for the Talon.One application,
you can invite, disable, and delete Talon.One users directly from Okta.

### Invite Talon.One users

To invite a Talon.One user from Okta:

1. In the Okta Admin Console, in the Talon.One application, click **Assign** > **Assign to People**.
1. To the right of the user you want to invite, click **Assign**.
1. In **Username**, type the name of the user you want displayed in Talon.One.
1. Click **Save & Go Back**.

An invitation is sent to the user's email address with steps to sign in to Talon.One with
their Okta account.

### Disable and delete Talon.One users

- To disable a Talon.One user from Okta, [unassign the user](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-unassign-apps.htm) from the Talon.One application.
- To delete a Talon.One user from Okta, follow the steps to [delete a user account](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-deactivate-user-account.htm).

## Related pages

- [Set up single sign-on](/docs/product/account/account-settings/set-up-sso.md)
- [Set up single sign-on with Okta](/docs/dev/tutorials/sso-with-okta.md)
- [Assign Talon.One roles in Okta](/docs/dev/tutorials/assign-roles-in-okta.md)