
ÉricF.83978 (Customer) asked a question.
Device subject mapping in SSF Security Event Tokens
We would like to send device compliance change CAEP events from our MDM to Okta, and we are wondering how Okta can associate the event with a given device. For each event included in a SET, there is a subject.device attribute. We can use the iss_sub format for this, but would Okta expect the device serial number as "sub" ?

Hello @ÉricF.83978 (Customer)
Thank you for posting on our Community page!
Please see our documentation on this matter below:
https://okta-help.pixtulate.com/oie/en-us/content/topics/itp/configure-shared-signal-provider.htm
https://okta-developer.pixtulate.com/docs/api/openapi/okta-management/management/tag/SSFSecurityEventToken/
Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
I had read those pages, and this is why I asked the question. The example is incomplete on the SSF SET page (empty device subject). I cannot find any information about the device identifier expected by Okta (serial number ?)
Some updates. I have managed to send a session revoked event and link it to a user, but the device target it contains doesn't show up. I have tried the device UDID, the device Serial Number.
The examples at https://okta-developer.pixtulate.com/docs/api/openapi/okta-management/management/tag/SSFSecurityEventToken/ have been updated and now contains {"format": "opaque", "id": "device-identifier-001"} but when I post something like this, I get a 400 error saying that "sub" is a required attribute.