Unit 3: Okta, Auth0, and OneLogin integration

[TeoSlayer]

Scope

Third-party IdP integrations with provider-specific enhancements beyond standard OIDC.

Deliverables

• Okta: OIDC preset, Okta FastPass (device-bound phishing-resistant auth) documentation
• Auth0: OIDC preset, Auth0 Actions for custom token claims (inject Pilot-specific network assignments)
• OneLogin: OIDC preset, SCIM provisioning support
• SCIM lifecycle: automatic deprovisioning — when HR offboards in IdP, agent loses Pilot network access
• Universal SCIM endpoint on registry for push-based deprovisioning
• Setup guides for each provider

Priority: MEDIUM

[TeoSlayer]

Context: Okta, Auth0, and OneLogin are popular in mid-market and developer-focused enterprises. The key differentiator here is SCIM — automatic lifecycle management. When an employee is deactivated in the IdP, SCIM pushes a deprovisioning event to the registry, which removes the agent from all networks. No manual cleanup needed.