auditclaw-idp_skill

Overview

This skill performs read-only identity provider compliance checks for Google Workspace and Okta and stores evidence in the shared AuditClaw GRC database. It runs eight automated checks that verify MFA, admin configuration, inactive accounts, password strength/policies, and session policies. Results are recorded as structured evidence for downstream reporting and controls mapping.

How this skill works

The skill uses provider APIs with read-only scopes to collect audit data and evaluate defined checks. Google Workspace is accessed via a service account with domain-wide delegation; Okta uses an API token. Each check emits JSON evidence items into the auditclaw-grc database (~/.openclaw/grc/compliance.sqlite) with metadata including source, control_id, description, and file_content.

When to use it

• Onboarding or periodic compliance sweeps to collect IDP evidence
• Before audits to validate MFA, password, and admin configurations
• After identity policy changes to verify enforcement
• When consolidating evidence into a central GRC database
• To monitor inactive accounts and session policy drift

Best practices

• Run with least-privilege read-only credentials and never provide write access
• Store service account JSON and API tokens in secure environment variables, not in code
• Schedule regular sweeps and track evidence timestamps to demonstrate continuous compliance
• Validate provider connectivity with the --test-connection option before full runs
• Limit Google impersonation to a designated admin account with domain-wide delegation configured

Example use cases

• Run a full IDP evidence sweep before a SOC 2 readiness assessment
• Verify all Google Workspace super admins have 2SV enforced
• Confirm Okta password policy meets minimum length, history, and max-age requirements
• Detect active users who haven’t logged in for over 90 days in either provider
• Collect session and MFA evidence to support control mappings for ISO/NIST/HIPAA