Add Okta users driver and name resolver

The driver lists GET /api/v1/users (limit=200) on the customer's org
host and follows the RFC 5988 Link header, pinning pagination to the
configured host so a response cannot redirect the crawl off-tenant.
User status maps to the three-valued Active flag (SUSPENDED and
DEPROVISIONED are inactive); ExternalID is the stable Okta user id.

The name resolver reads /api/v1/org and returns ("", nil) on any
non-2xx so a read-only token lacking org-settings read does not loop
the source-name worker.

The org domain is operator-supplied and feeds the URL host, so it is
the one SSRF-sensitive input: NormalizeOktaDomain validates and
strips it on the write path and IsValidOktaDomain re-checks it at
driver construction, on top of the transport's SSRF protection.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/okta_test.go

@@ -0,0 +1,79 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package drivers
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOktaDriver(t *testing.T) {
+	t.Parallel()
+
+	rec := newRecorder(t, "testdata/okta", "OKTA_API_TOKEN")
+
+	authValue := ""
+	if token := os.Getenv("OKTA_API_TOKEN"); token != "" {
+		authValue = "SSWS " + token
+	}
+
+	client := newVCRClient(rec, authValue)
+
+	domain := os.Getenv("OKTA_DOMAIN")
+	if domain == "" {
+		domain = "acme.okta.com"
+	}
+
+	driver := NewOktaDriver(client, domain)
+	records, err := driver.ListAccounts(context.Background())
+	require.NoError(t, err)
+
+	// Two pages followed via the Link header; the third page-1 user has no
+	// email and is dropped, so three records survive.
+	require.Len(t, records, 3)
+
+	// Alice: active, displayName preferred, title + timestamps populated.
+	assert.Equal(t, "alice@example.com", records[0].Email)
+	assert.Equal(t, "Alice Active", records[0].FullName)
+	assert.Equal(t, "Security Engineer", records[0].JobTitle)
+	require.NotNil(t, records[0].Active)
+	assert.True(t, *records[0].Active)
+	assert.Equal(t, "00u1aaaaaaaaaaaaa0h7", records[0].ExternalID)
+	require.NotNil(t, records[0].CreatedAt)
+	require.NotNil(t, records[0].LastLogin)
+
+	// Bob: SUSPENDED → inactive, no displayName (falls back to first+last),
+	// null lastLogin stays nil.
+	assert.Equal(t, "bob@example.com", records[1].Email)
+	assert.Equal(t, "Bob Suspended", records[1].FullName)
+	assert.Empty(t, records[1].JobTitle)
+	require.NotNil(t, records[1].Active)
+	assert.False(t, *records[1].Active)
+	assert.Equal(t, "00u2bbbbbbbbbbbbb1h7", records[1].ExternalID)
+	assert.Nil(t, records[1].LastLogin)
+	require.NotNil(t, records[1].CreatedAt)
+
+	// Carol: page 2, DEPROVISIONED → inactive.
+	assert.Equal(t, "carol@example.com", records[2].Email)
+	assert.Equal(t, "Carol Gone", records[2].FullName)
+	assert.Equal(t, "Contractor", records[2].JobTitle)
+	require.NotNil(t, records[2].Active)
+	assert.False(t, *records[2].Active)
+	assert.Equal(t, "00u4ddddddddddddd4h7", records[2].ExternalID)
+}