## General Information

The traversable Okta_PasswordSync edge represents password synchronization between user accounts. This indicates that credentials are synchronized from a source user to a target user.

In **Active Directory** hybrid setups, this edge is created between User (AD) and Okta_User when delegated authentication or password push is enabled. In **Org2Org** setups, this edge is created between Okta_User nodes across organizations when password synchronization is configured.

> [!WARNING]
> The Okta API does not indicate if the actual password or a randomly generated value is pushed to the other organization.

### Active Directory Hybrid

```mermaid
graph LR
    subgraph ad["Active Directory"]
        adu1("User john\@contoso.com")
    end
    subgraph okta["Okta"]
        u1("Okta_User john\@contoso.com")
        adu1 -->|Okta_PasswordSync| u1
        adu1 .->|Okta_UserSync| u1
    end
```

### Org2Org

```mermaid
graph LR
    subgraph source_org["Okta Org Contoso"]
        u1("Okta_User alice\@contoso.com")
        app1("Okta_Application Adatum Org2Org App")
    end
    subgraph target_org["Okta Org Adatum"]
        u2("Okta_User alice\@adatum.com")
        idp2("Okta_IdentityProvider Contoso Org2Org OIDC")
        app2("Okta_Application Contoso Sync API Service")
    end
    u1 -->|Okta_PasswordSync| u2
    u1 -->|Okta_OutboundSSO| u2
    u1 .->|Okta_UserSync| u2
    u1 .->|Okta_UserPush| app1
    u1 .->|Okta_AppAssignment| app1
    app1 -->|Okta_ReadPasswordUpdates| u1
    app1 -->|Okta_OutboundOrgSSO| idp2
    idp2 -->|Okta_IdentityProviderFor| u2
```
