Migrating from Okta to Casdoor: what the Okta syncer can move

Okta is the most expensive identity provider per user in most comparisons, and the first thing teams ask when they look at alternatives is "can we get our users out?" The answer is yes for profiles, no for passwords.

Casdoor has a built-in Okta syncer that reads users directly from Okta's API, so you do not need to export a file and map columns by hand. This guide covers what it moves, what stays behind, and how to run the cutover.

How the Okta syncer works

The syncer is configured in Casdoor under Syncers:

• Host: your Okta domain, such as example.okta.com.
• Password field: an Okta API token, sent as Authorization: SSWS <token>.
• It calls https://<domain>/api/v1/users?limit=200 and follows Okta's pagination links until the list is exhausted.

The fields it maps include login, email, first and last name, display name, mobile and primary phone, street address, city, state, zip code, country, preferred language, locale, timezone, title, department and organization. That covers the profile data most migrations need.

Two limitations are worth stating plainly:

• It is read-only. The syncer pulls users into Casdoor; it does not write changes back to Okta.
• It does not sync groups. Group membership does not come across in the current implementation, so plan to recreate groups in Casdoor and assign users there.

For a full sync of a large tenant, review Okta's API rate limits first. The Users API is rate-limited per organization, and a sync is a burst of reads.

Passwords: Okta will not give them to you

Okta stores password hashes and does not expose them through the API or an export. There is no way to copy the hashes into another product. That leaves three options:

1. Password reset campaign. Import profiles, then send a reset link to every user. Simple, and the support spike is predictable.
2. Reset at next sign-in. Mark migrated users as "must change password" and force the reset when they next sign in. This spreads the support load over weeks.
3. Keep Okta as the upstream during the transition. Configure Casdoor to accept Okta as an OIDC or SAML provider, so users sign in through Okta while applications move to Casdoor. No reset, but you keep paying Okta until the last application is off it.

One more detail: many Okta users do not have a password at all. If they only ever signed in through SSO, a reset campaign is meaningless; those users need either federation or a new credential that you hand out deliberately.

What does not migrate

Beyond passwords, these are the things that have to be rebuilt:

• Applications and app assignments. Each Okta application maps to a Casdoor application with its own client ID and callback URLs. Which users get which app is a Casdoor role or permission, not an Okta assignment.
• Groups. The syncer does not copy them; recreate them and assign users.
• MFA enrollments. TOTP secrets and push registrations stay in Okta. Users re-enroll.
• Policies. Okta sign-on and MFA policies are configuration; map the intent to Casdoor's login and MFA settings rather than trying to copy rules.
• Sessions. Everyone signs in again after the cutover.

The cutover plan

1. Create the API token in Okta with read-only administrator access, ideally scoped to the Users API.
2. Run the syncer into a test organization in Casdoor. Verify names, emails and identifiers for a sample.
3. Decide the password strategy (reset now, reset lazily, or federate). Run it on the sample first.
4. Recreate applications and groups in Casdoor and wire one low-risk application.
5. Run both systems in parallel. Keep Okta authoritative while applications migrate one at a time.
6. Freeze Okta to read-only once everything has moved, keep it for rollback, then cancel.

Why teams move

The usual reasons are cost and control: Okta's per-user pricing scales with headcount, and the smallest plans still carry enterprise procurement overhead. Casdoor is Apache-2.0, self-hostable, and speaks OIDC, SAML 2.0, CAS, SCIM and LDAP; the hosted version starts at $9 per month with unlimited MAU.

Related reading: Okta alternatives and the Casdoor vs Okta comparison.