$schemaType = [Microsoft.MetadirectoryServices.SchemaType]::Create($t.Name,$lockAnchorDefinition)
  ...

  $schemaType = [Microsoft.MetadirectoryServices.SchemaType]::Create($t.Name,$lockAnchorDefinition)
  ...
foreach ($a in $t.Attributes.SchemaAttribute)
      {
        if ($a.IsAnchor -eq 1)
        {
          $schemaType.Attributes.Add([Microsoft.MetadirectoryServices.SchemaAttribute]::CreateAnchorAttribute($a.Name,$a.DataType,$a.AllowedAttributeOperation))
        }
        elseif ($a.IsMultiValued -eq 1)
        {
          $schemaType.Attributes.Add([Microsoft.MetadirectoryServices.SchemaAttribute]::CreateMultiValuedAttribute($a.Name,$a.DataType,$a.AllowedAttributeOperation))
        }
        else
        {
          $schemaType.Attributes.Add([Microsoft.MetadirectoryServices.SchemaAttribute]::CreateSingleValuedAttribute($a.Name,$a.DataType,$a.AllowedAttributeOperation))
        }
      }

# Import Script
<#
.SYNOPSIS
    This script imports provisioned and deprovisioned users from Okta into a Metaverse.

.DESCRIPTION
    The script retrieves user data from Okta using the Okta API and transforms it into CSEntryChange objects
    that can be imported into the Metaverse. The imported users are then processed and added to the import results.

.PARAMETER ConfigParameters
    The configuration parameters for the script.

.PARAMETER Schema
    The schema of the Metaverse.

.PARAMETER OpenImportConnectionRunStep
    The run step for opening the import connection.

.PARAMETER GetImportEntriesRunStep
    The run step for retrieving the import entries.

.PARAMETER PSCredential
    The credentials for authenticating with the Okta API.

.FUNCTIONS
    The script contains the following functions:
    - Write-DebugLog: Writes a debug log message to a log file.
    - GetTokenFromCredentials: Retrieves the token from the provided credentials.
    - Import-OktaProvisionedUsers: Imports provisioned and deprovisioned users from Okta.

.OUTPUTS
    The script outputs the import results, which include the CSEntryChange objects to be imported into the Metaverse.

.EXAMPLE
    Import-OktaProvisionedUsers -ConfigParameters $ConfigParameters -Schema $Schema -OpenImportConnectionRunStep $OpenImportConnectionRunStep -GetImportEntriesRunStep $GetImportEntriesRunStep -PSCredential $PSCredential
#>

param(
    [System.Collections.ObjectModel.KeyedCollection[string, Microsoft.MetadirectoryServices.ConfigParameter]]
    [ValidateNotNull()]
    $ConfigParameters,
    [Microsoft.MetadirectoryServices.Schema]
    [ValidateNotNull()]
    $Schema,
    [Microsoft.MetadirectoryServices.OpenImportConnectionRunStep]
    $OpenImportConnectionRunStep,
    [Microsoft.MetadirectoryServices.ImportRunStep]
    $GetImportEntriesRunStep,
    [pscredential]
    $PSCredential
)

#region Functions

function Write-DebugLog {
    param
    (
        [string]$Message
    )
  
    $logPath = "C:\ImportScript.log"
    $logMessage = "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - $Message"
    Add-Content -Path $logPath -Value $logMessage
  
}

function GetTokenFromCredentials {
    param (
      [System.Management.Automation.PSCredential]$Credentials
    )
     Write-DebugLog "Retrieving TOKEN"
    $token = $Credentials.GetNetworkCredential().Password
    Write-DebugLog "TOKEN Retrieval completed"
    return $token
  }

#endregion

#region SCIM Functions

function Import-OktaProvisionedUsers {
    param (
        
    )
    $Token = GetTokenFromCredentials -Credentials $PSCredential

    $headers = @{
        "Accept" = "application/json"
        "Content-Type" = "application/json"
        "Authorization" = "SSWS $Token"
        "Cookie" = "JSESSIONID=74D0E3DCA57D73E89D7019244B2255D1"
    }
    $results = New-Object System.Collections.Generic.List[PSObject]

    $response = Invoke-RestMethod 'https://trial-8839557-admin.okta.com//api/v1/users?filter=status eq "PROVISIONED"' -Method 'GET' -Headers $headers
    foreach ($user in $response) {
        $results.Add([PSCustomObject]@{
            "status" = if ($user.status -eq "PROVISIONED") { "Active" } else { "Inactive" }
            "firstName" = $user.Profile.firstName
            "lastName" = $user.Profile.lastName
            "nickName" = $user.Profile.nickName
            "displayName" = $user.Profile.displayName
            "email" = $user.Profile.email
            "secondEmail" = $user.Profile.secondEmail
            "profileUrl" = $user.Profile.profileUrl
            "preferredLanguage" = $user.Profile.preferredLanguage
            "userType" = $user.Profile.userType
            "organization" = $user.Profile.organization
            "title" = $user.Profile.title
            "division" = $user.Profile.division
            "department" = $user.Profile.department
            "costCenter" = $user.Profile.costCenter
            "employeeNumber" = $user.Profile.employeeNumber
            "mobilePhone" = $user.Profile.mobilePhone
            "primaryPhone" = $user.Profile.primaryPhone
            "streetAddress" = $user.Profile.streetAddress
            "city" = $user.Profile.city
            "state" = $user.Profile.state
            "zipCode" = $user.Profile.zipCode
            "countryCode" = $user.Profile.countryCode
            "login" = $user.Profile.login
            
        })
    }
    $responseDeprovisioned = Invoke-RestMethod 'https://trial-8839557-admin.okta.com//api/v1/users?filter=status eq "DEPROVISIONED"' -Method 'GET' -Headers $headers
    foreach ($user in $responseDeprovisioned) {
        $results.Add([PSCustomObject]@{
            "status" = if ($user.status -eq "DEPROVISIONED") { "Inactive" } else { "Active" }
            "firstName" = $user.Profile.firstName
            "lastName" = $user.Profile.lastName
            "nickName" = $user.Profile.nickName
            "displayName" = $user.Profile.displayName
            "email" = $user.Profile.email
            "secondEmail" = $user.Profile.secondEmail
            "profileUrl" = $user.Profile.profileUrl
            "preferredLanguage" = $user.Profile.preferredLanguage
            "userType" = $user.Profile.userType
            "organization" = $user.Profile.organization
            "title" = $user.Profile.title
            "division" = $user.Profile.division
            "department" = $user.Profile.department
            "costCenter" = $user.Profile.costCenter
            "employeeNumber" = $user.Profile.employeeNumber
            "mobilePhone" = $user.Profile.mobilePhone
            "primaryPhone" = $user.Profile.primaryPhone
            "streetAddress" = $user.Profile.streetAddress
            "city" = $user.Profile.city
            "state" = $user.Profile.state
            "zipCode" = $user.Profile.zipCode
            "countryCode" = $user.Profile.countryCode
            
        })
    }
    
    Write-DebugLog "Imported Users from Okta"
    $responseJSON = $results | ConvertTo-Json
    Write-DebugLog "$responseJSON"
    $results

    
}


#endregion

Set-PSDebug -Strict
Write-DebugLog "Starting Import Script"

$commonModule = (Join-Path -Path ([Microsoft.MetadirectoryServices.MAUtils]::MAFolder) -ChildPath $ConfigParameters['Common Module Script Name (with extension)'].Value)
Import-Module -Name $commonModule -Verbose:$false -ErrorAction Stop

$importResults = New-Object -TypeName 'Microsoft.MetadirectoryServices.GetImportEntriesResults'

$csEntries = New-Object -TypeName 'System.Collections.Generic.List[Microsoft.MetadirectoryServices.CSEntryChange]'

$columnsToImport = $Schema.Types[0].Attributes

Write-DebugLog "Loaded $($columnsToImport.Count) attributes to import"
foreach ($column in $columnsToImport)
{
    Write-DebugLog "Attribute: $($column.Name)"
}

$recordsToImport = Import-OktaProvisionedUsers

Write-DebugLog "Imported $($recordsToImport.Count) records"


foreach ($record in $recordsToImport)
{

    Write-DebugLog 'Starting new record'

    ##TODO: Handle a missing anchor (what exception to throw?)

    $foundValidColumns = $false

    $entrySchema = $Schema.Types[0];
    $csEntry = New-xADSyncPSConnectorCSEntryChange -ObjectType $entrySchema.Name -ModificationType Add

    foreach ($column in $columnsToImport)
    {

        $columnName = $column.Name

        Write-DebugLog "Processing column $columnName"

        if ($record.$columnName)
        {

            Write-DebugLog 'Found column'

            $foundValidColumns = $true

            ##TODO: Support multivalue?

            $anchorAttrName = $entrySchema.AnchorAttributes[0].Name
            $value = [string]$record.$columnName

            Write-DebugLog "$columnName with value equal $value"


            if ($columnName -eq $anchorAttrName) {


                $csEntry.AnchorAttributes.Add([Microsoft.MetadirectoryServices.AnchorAttribute]::Create($columnName, $value))
            }


            $csEntry | Add-xADSyncPSConnectorCSAttribute -ModificationType Add -Name $columnName -Value ([Collections.IList]($record.$columnName.Split(";")))

        }

    }

    if ($foundValidColumns)
    {

        Write-DebugLog 'Publishing CSEntryChange'

        $csEntries.Add($csEntry)

    }

    Write-DebugLog 'Record completed'

}

##TODO: Support paging

$importResults.CSEntries = $csEntries

$importResults.MoreToImport = $false

Write-Output $importResults

# Export Script
<#
.SYNOPSIS
This script exports data from a Metadirectory Services (MIM) connector to Okta.

.DESCRIPTION
The script exports data from a Metadirectory Services (MIM) connector to Okta by making REST API calls to the Okta API. It retrieves the necessary credentials, creates custom PS objects, and performs operations such as adding, updating, and deleting Okta users.

.PARAMETER ConfigParameters
A collection of configuration parameters required for the script.

.PARAMETER Schema
The schema of the Metadirectory Services (MIM) connector.

.PARAMETER OpenExportConnectionRunStep
The run step for opening the export connection.

.PARAMETER CSEntries
A list of CSEntryChange objects representing the changes to be exported.

.PARAMETER PSCredential
The PowerShell credential object containing the necessary credentials for authentication.

.EXAMPLE
.\Export Script Okta.ps1 -ConfigParameters $ConfigParameters -Schema $Schema -OpenExportConnectionRunStep $OpenExportConnectionRunStep -CSEntries $CSEntries -PSCredential $PSCredential
#>

param(
  [System.Collections.ObjectModel.KeyedCollection[string, Microsoft.MetadirectoryServices.ConfigParameter]]
  $ConfigParameters,
  [Microsoft.MetadirectoryServices.Schema]
  $Schema,
  [Microsoft.MetadirectoryServices.OpenExportConnectionRunStep]
  $OpenExportConnectionRunStep,
  [System.Collections.Generic.IList[Microsoft.MetaDirectoryServices.CSEntryChange]]
  $CSEntries,
  [pscredential]
  $PSCredential
)

Set-PSDebug -Strict

$commonModule = (Join-Path -Path ([Microsoft.MetadirectoryServices.MAUtils]::MAFolder) -ChildPath $ConfigParameters['Common Module Script Name (with extension)'].Value)
Import-Module -Name $commonModule -Verbose:$false -ErrorAction Stop

#region function

function CreateCustomPSObject {

  param
  (
    $PropertyNames = @()
  )

  $template = New-Object -TypeName System.Object

  foreach ($property in $PropertyNames) {

    $template | Add-Member -MemberType NoteProperty -Name $property -Value $null

  }

  return $template
}


function Write-DebugLog {
  param
  (
    [string]$Message
  )

  $logPath = "C:\ExportScript.log"
  $logMessage = "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - $Message"
  Add-Content -Path $logPath -Value $logMessage

}

function GetTokenFromCredentials {
  param (
    [System.Management.Automation.PSCredential]$Credentials
  )
  Write-DebugLog "Retrieving TOKEN"
  $token = $Credentials.GetNetworkCredential().Password
  Write-DebugLog "TOKEN Retrieval completed"
  return $token
}



#region OKTA Functions
function Add-OktaProvisionedUser {
  param (
    $baseObject
  )

  $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
  $Token = GetTokenFromCredentials -Credentials $PSCredential
  $headers.Add("Accept", "application/json")
  $headers.Add("Content-Type", "application/json")
  $headers.Add("Authorization", "SSWS $Token")
  $headers.Add("Cookie", "JSESSIONID=C0B3B05DB3903768410F4B0AD4EC7BE3")
  
  $body = @"
  {
          `"profile`": {
                  `"login`": `"Vasco.brock@example.com`",
                  `"firstName`": `"Vasco`",
                  `"lastName`": `"Brock`",
                  `"nickName`": `"Vasco`",
                  `"displayName`": `"Vasco Brock`",
                  `"email`": `"Vasco.brock@example.com`",
                  `"secondEmail`": `"Vasco@example.org`",
                  `"profileUrl`": `"http://www.example.com/profile`",
                  `"userType`": `"Employee`",
                  `"organization`": `"Okta`",
                  `"title`": `"Director`",
                  `"division`": `"R&D`",
                  `"department`": `"Engineering`",
                  `"costCenter`": `"10`",
                  `"employeeNumber`": `"187`",
                  `"mobilePhone`": `"+1-555-415-1337`",
                  `"primaryPhone`": `"+1-555-514-1337`",
                  `"streetAddress`": `"301 Brannan St.`",
                  `"city`": `"San Francisco`",
                  `"state`": `"CA`",
                  `"zipCode`": `"94107`",
                  `"countryCode`": `"US`"
          }
  }
"@
  $body = $body.Replace("Vasco.brock@example.com", $($baseObject.login))
  $body = $body.Replace("Vasco", $($baseObject.firstName))
  $body = $body.Replace("Brock", $($baseObject.lastName))
  $body = $body.Replace("Vasco", $($baseObject.nickName))
  $body = $body.Replace("Vasco Brock", $($baseObject.displayName))
  $body = $body.Replace("Vasco.brock@example.com", $($baseObject.email))
  $body = $body.Replace("Vasco@example.org", $($baseObject.secondEmail))
  $body = $body.Replace("http://www.example.com/profile", $($baseObject.profileUrl))
  #$body = $body.Replace("en-US", $($baseObject.preferredLanguage))
  $body = $body.Replace("Employee", $($baseObject.userType))
  $body = $body.Replace("Okta", $($baseObject.organization))
  $body = $body.Replace("Director", $($baseObject.title))
  $body = $body.Replace("R&D", $($baseObject.division))
  $body = $body.Replace("Engineering", $($baseObject.department))
  $body = $body.Replace("10", $($baseObject.costCenter))
  $body = $body.Replace("187", $($baseObject.employeeNumber))
  $body = $body.Replace("+1-555-415-1337", $($baseObject.mobilePhone))
  $body = $body.Replace("+1-555-514-1337", $($baseObject.primaryPhone))
  $body = $body.Replace("301 Brannan St.", $($baseObject.streetAddress))
  $body = $body.Replace("San Francisco", $($baseObject.city))
  $body = $body.Replace("CA", $($baseObject.state))
  $body = $body.Replace("94107", $($baseObject.zipCode))
  $body = $body.Replace("US", $($baseObject.countryCode))
  Write-DebugLog -Message "Body for AddObject:\n $body"
  
  try {
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $response = Invoke-RestMethod 'https://trial-8839557-admin.okta.com//api/v1/users?activate=true' -Method 'POST' -Headers $headers -Body $body
    $response = $response | ConvertTo-Json 
    Write-DebugLog -Message "Response: $response"
  
          
  }
  catch {
    Write-DebugLog -Message "Error: $_"
  }

  
}

function Update-OktaUser {
  param (
      
    [Parameter(Mandatory = $true)]
    [string]$attributeName,

    [Parameter(Mandatory = $true)]
    [string]$attributeValue,

    [Parameter(Mandatory = $true)]
    [string]$userId
  )

  $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
  $token = GetTokenFromCredentials -Credentials $PSCredential
  $headers.Add("Accept", "application/json")
  $headers.Add("Content-Type", "application/json")
  $headers.Add("Authorization", "SSWS $token")
  $headers.Add("Cookie", "JSESSIONID=D6E791D528C893BC8B32EDDA0FD2A8F7")

  if ($attributeName -eq "status") {
    if ($attributeValue -eq "Active") {
      try {
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
        $response = Invoke-RestMethod "https://trial-8839557-admin.okta.com//api/v1/users/$userId/lifecycle/activate?sendEmail=false" -Method 'POST' -Headers $headers
        $response = $response | ConvertTo-Json 
        Write-DebugLog -Message "Response: $response"
        
      }
      catch {
        Write-DebugLog -Message "Error: $_"
      }
      
    }
    if ($attributeValue -eq "Inactive") {
      try {
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
        $response = Invoke-RestMethod "https://trial-8839557-admin.okta.com//api/v1/users/$userId/lifecycle//deactivate?sendEmail=false" -Method 'POST' -Headers $headers
        $response = $response | ConvertTo-Json 
        Write-DebugLog -Message "Response: $response"
        
      }
      catch {
        Write-DebugLog -Message "Error: $_"
      }
    }
  }
  else {
    $body = @{
      profile = @{
        $attributeName = $attributeValue
      }
    } | ConvertTo-Json
    try {
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      $response = Invoke-RestMethod "https://trial-8839557-admin.okta.com//api/v1/users/$userId" -Method 'POST' -Headers $headers -Body $body
      $response = $response | ConvertTo-Json 
      Write-DebugLog -Message "Response: $response"
  
        
    }
    catch {
      Write-DebugLog -Message "Error: $_"
    }

  }
  

  
}

function Delete-OktaUser {
  param (
    
    [Parameter(Mandatory = $true)]
    [string]$userId

  )

  $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
  $token = GetTokenFromCredentials -Credentials $PSCredential
  $headers.Add("Accept", "application/json")
  $headers.Add("Content-Type", "application/json")
  $headers.Add("Authorization", "SSWS $token")
  $headers.Add("Cookie", "JSESSIONID=D6E791D528C893BC8B32EDDA0FD2A8F7")


  
  try {
    
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $url = "https://trial-8839557-admin.okta.com//api/v1/users/$userId"
    Write-DebugLog -Message "URL: $url"
    $response = Invoke-RestMethod -Uri $url -Method 'DELETE' -Headers $headers
    $response = $response | ConvertTo-Json 
    Write-DebugLog -Message "Response: $response"

   
  }
  catch {
    Write-DebugLog -Message "Error: $_"
  }


}

#endregion

Write-DebugLog -Message "-----------------------------------------------------------------------------"
Write-DebugLog -Message "Starting Export Script Main Function"

$csentryChangeResults = New-Object "System.Collections.Generic.List[Microsoft.MetadirectoryServices.CSEntryChangeResult]"


$columnsToExport = @()

foreach ($attribute in $Schema.Types[0].Attributes) {

  $columnsToExport += $attribute.Name

  Write-DebugLog -Message "Added attribute $($attribute.Name) to export list"

}



Write-DebugLog -Message "Processing object $($entry.Identifier)"


foreach ($entry in $CSEntries) {
  
  

  Write-DebugLog -Message "-------------------------------------------------------------------------------------------------------"
    
  foreach ($attributeName in $entry.ChangedAttributeNames) {
    Write-DebugLog -Message "Attribute: $attributeName"
    Write-DebugLog -Message "Value: $($entry.AttributeChanges[$attributeName].ValueChanges[0].Value)"
    $anchorAttributeValue = $entry.AnchorAttributes[0].Value.ToString();
    Write-DebugLog -Message "Anchor Attribute: $($entry.AnchorAttributes[0].Name)"
    Write-DebugLog -Message "Anchor Value: $anchorAttributeValue"
    if ($entry.ObjectModificationType -eq 'Replace') {
      Update-OktaUser -attributeName $attributeName -attributeValue $entry.AttributeChanges[$attributeName].ValueChanges[0].Value -userId $anchorAttributeValue


    }
    
    
  }
 
  Write-DebugLog -Message "Processing object $($entry.Identifier). ObjectModificationType $($entry.ObjectModificationType)"

  [bool]$objectHasAttributes = $false

  
  $baseObject = CreateCustomPSObject -PropertyNames $columnsToExport

  if ($entry.ObjectModificationType -eq 'Replace') {
    $anchorAttributeName = $entry.AnchorAttributes[0].Name;
    $anchorAttributeValue = $entry.AnchorAttributes[0].Value.ToString();
    
    

    foreach ($attribute in $entry.ChangedAttributeNames) {
      
      $value = Get-CSEntryChangeValue -CSEntryChange $entry -AttributeName $attribute
      Write-DebugLog -Message " Changed Attribute Value is : $value"
      
      

    }
  }


  if ($entry.ObjectModificationType -ne 'Delete') {

    foreach ($attribute in $columnsToExport) {

      if (($entry.AttributeChanges.Contains($attribute)) -eq $false -and ($entry.AnchorAttributes.Contains($attribute) -eq $false)) {

        continue

      }


      if ($entry.AnchorAttributes[$attribute].Value) {

        $baseObject.$attribute = $entry.AnchorAttributes[$attribute].Value

        $objectHasAttributes = $true

      }

      elseif ($entry.AttributeChanges[$attribute].ValueChanges[0].Value) {

        $baseObject.$attribute = ($entry.AttributeChanges[$attribute].ValueChanges | Select-Object -Expand Value) -join ";"

        $objectHasAttributes = $true

      }
      elseif ($entry.AttributeChanges[$attribute].DataType -eq "Boolean") {
        $baseObject.$attribute = ($entry.AttributeChanges[$attribute].ValueChanges | Select-Object -Expand Value) -join ";"

        

      }

    }

    if ($objectHasAttributes) {

      foreach ($property in $baseObject.PSObject.Properties) { 
        if ($property.Value -eq $null) {
          $baseObject.($property.Name) = ""
        }
      }
      
      
      foreach ($property in $baseObject.PSObject.Properties) {
        Write-DebugLog -Message "Added $($property.Name) with value $($property.Value)"
      }
      if ($entry.ObjectModificationType -eq 'Add') {
        Write-DebugLog -Message "Adding user to OKTA with Email $($baseObject.Email) and DisplayName $($baseObject.DisplayName) and UserName $($baseObject.UserName) and AzureObjectID $($baseObject.AzureObjectID)"
        Add-OktaProvisionedUser -baseObject $baseObject
      }

      

    }

  }
  else {
    $anchorAttributeName = $entry.AnchorAttributes[0].Name;
    $anchorAttributeValue = $entry.AnchorAttributes[0].Value.ToString();
    Write-DebugLog -Message "Delete the object with attribute '$($anchorAttributeName)' equals '$($anchorAttributeValue)'"
    Delete-OktaUser -userId $anchorAttributeValue
  }

  $csentryChangeResult = [Microsoft.MetadirectoryServices.CSEntryChangeResult]::Create($entry.Identifier, $null, "Success")
  $csentryChangeResults.Add($csentryChangeResult)

  Write-DebugLog -Message "Completed processing object $($entry.Identifier)"

}

$closedType = [type]"Microsoft.MetadirectoryServices.PutExportEntriesResults"

return [Activator]::CreateInstance($closedType, $csentryChangeResults)