Identity Access Requests

Access Requests

If a user needs access to an application, there are several approaches:

1. The user’s attributes match the existing criteria of a role or organization unit that has already been attached to the Okta application. Access is automatically granted without a request.

2. The organization unit group policy CODEOWNER (ex. division leader or department manager or Executive Business Assistant) can update the policy in accessctl to include the additional role. The manifest of users for the organization unit is automatically recalculated and the users will be added to the organization unit Okta group that has already been attached to the application.

3. The application CODEOWNER can add the additional role group to the application using Terraform.

This provides improved maintenance since the division and department leaders or their delegate (ex. Executive Business Administrator) centrally manage the policies for organization unit groups and which roles are members.

Since the users that are attached to each group are managed by accessctl policies and REST API calls (not Terraform), the changes to Terraform state management are far and few between which simplifies auditability.

View page source - Edit this page - please contribute.