OktaHound

OktaHound is a BloodHound OpenGraph collector for Okta. It is an alternative to the SpecterOps-supported OpenHound Okta collector.

OktaHound works with the BloodHound Okta Extension and produces OpenGraph JSON output that can be uploaded to BloodHound.

OktaHound supports three ways to authenticate to the Okta API:

• OAuth 2.0 service application using a client ID and private key. This is the recommended option.
• OAuth 2.0 client secret using a client ID and client secret. Use this option for API service integrations, which do not support private key authentication.
• SSWS API token using a token tied to an Okta administrator account.

For service application setup, follow the OpenHound Okta app registration guide. The same registration process applies to OktaHound.

Download the latest release for your platform from the releases page, or build from source with dotnet build.

Create an okta.yaml file in the same directory as the OktaHound executable, or point the collector at a configuration file in another location with the --config option.

For OAuth 2.0 private key authentication, start from okta.sample.oauth.yaml:

okta:
  client:
    oktaDomain: "https://TODO.okta.com"
    authorizationMode: "PrivateKey"
    clientId: "TODO"
    privateKey:
      "d": "TODO"
      "p": "TODO"
      "q": "TODO"
      "dp": "TODO"
      "dq": "TODO"
      "qi": "TODO"
      "kty": "RSA"
      "e": "AQAB"
      "kid": "TODO"
      "n": "TODO"

For OAuth 2.0 client secret authentication, start from okta.sample.clientsecret.yaml:

okta:
  client:
    oktaDomain: "https://TODO.okta.com"
    authorizationMode: "BearerToken"
    clientId: "TODO"
    clientSecret: "TODO"

The client secret can alternatively be provided through the --client-secret command line parameter.

For SSWS token authentication, start from okta.sample.token.yaml:

okta:
  client:
    oktaDomain: "https://TODO.okta.com"
    authorizationMode: "SSWS"
    token: "TODO"

Run OktaHound with the collect command:

OktaHound collect --output ./output --verbosity Trace

Useful options:

• --skip-mfa skips collecting user authentication factors.
• --zip compresses each exported JSON file after it is written.
• --export-ad-nodes writes the optional Active Directory subgraph output.
• --domain and --token can be used to override okta.yaml when using SSWS authentication.
• --domain, --client-id, and --client-secret can be used to override okta.yaml when using OAuth 2.0 client secret authentication.
• --client-id, optionally together with --domain, can also override okta.yaml when using OAuth 2.0 private key authentication, e.g. when the same key is registered in multiple Okta organizations. The private key itself can only be provided through a configuration file.
• --config reads the configuration from a custom YAML or JSON file path instead of the default okta.yaml locations, which is useful for switching between multiple Okta organizations.

By default, the collector writes output files to ./output:

• okta-graph.json
• okta-graph-ad.json when --export-ad-nodes is used and AD nodes exist
• okta-graph-hybrid.json when hybrid edges exist

To use the collected Okta data in BloodHound, follow the Okta Extension getting started guide to install the extension and import the Okta Cypher queries and Privilege Zone rules.

After that, upload the generated JSON files to BloodHound.

See Okta Extension - Schema.