Authenticator or Directory Service Entity for OKTA Integration

I'm looking to somehow integrate our Thingworx platform with OKTA.  I've seen other posts on the community about this, but nothing really provides any clear direction on what to do to make this work.  Creating something custom for this is not a problem, but what I'm not clear on is where the customization would go.  Is a custom Authenticator needed, or a custom Directory Service entity?  Also, can anyone shed some light on where these two Entity types exist in the Thingworx authentication flow and architecture, i.e. does a custom Authenticator check against Thingworx users, or is a custom Authenticator a place where custom authentication against other softwares (such as OKTA) take place?

Any help/guidance is appreciated.