OTKA SCIM only integration

[smallinsky]

What

• Added app_group_sync_disabled okta plugin setting that will allow to disabled Okta Application and Groups sync.
• Added types.KindSAML, services.ReadNoSecrets() to types.RoleOkta (SCIM Handler and User sync need to fetch attributes to role mapping set proper user roles during SCIM user createa/updatea and during SCIM sync when user is created/updated)
• Added ability to install okta plugin with different behaviors
  • SCIM only integration without APIToken:

  $ tctl plugins install okta  \
     --org https://trial-....okta.com \ 
     --saml-connector okta-integration \ 
     --no-users-sync \ 
     --no-accesslist-sync  \
     --no-appgroup-sync \
     --scim
     
  Successfully created OKTA plugin "okta"
  
  SCIM Base URL: https://example.net:443/v1/webapi/scim/okta
  SCIM Identifier field for users: userName
  SCIM Baerar Token: daf2d4...
  
  See https://goteleport.com/docs/application-access/okta/hosted-guide for help configuring provisioning in Okta
  

• SCIM only integration with APIToken:

  $ tctl plugins install okta  \
     --org https://trial-....okta.com \ 
     --saml-connector okta-integration \ 
     --no-users-sync \ 
     --no-accesslist-sync  \
     --no-appgroup-sync \
     --scim \ 
     --api-token=secreetOKTAAPIToken
  

Related: https://github.com/gravitational/teleport.e/pull/4213

[tcsc]

Good idea

[tcsc]

Was dubious about this feature until I saw that it only prints out tokens it generates. Nice.

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.