Set up SCIM with Okta

This topic walks you through the process of setting up SCIM in Okta.

Before you begin, you must complete the following prerequisite tasks:

• Set up SSO with Okta. You must configure SSO before you start setting up SCIM.
• Define the groups in Alida to map to your Okta groups.
• Set the default user auto-provisioning group. A default group is required before you generate a token.
• Generate an authentication token. Ensure that you have access to the following settings from the Alida User Auto-Provisioning page:
  • Base URL: The Alida SCIM API endpoint URL.
  • Token: The API token for authentication with the Alida SCIM API endpoints.

Note: You can reuse an Okta group that you already use for SSO app assignment as the SCIM assignment group. Do not use that same group as a Push Group. Okta does not support using the same group for both app assignment and as a Push Group.

Important: SCIM synchronization starts in a paused state. Complete Okta provisioning, assignments, and Push Groups while SCIM sync remains paused in Alida. Do not click Resume Sync until setup is complete. If you resume sync before users and groups are correctly configured, Alida may remove existing user accounts. For more information, see Pause or resume SCIM sync.

1. Sign in to Okta as an administrator.
   Verify that you are in the Admin Console.
2. Select Applications > Applications.
3. Click the SSO app you created for Alida.
4. Enable SCIM in Okta:
   1. Click the Provisioning tab.
   2. In the left settings pane, select Integration.
   3. Select the Enable API integration checkbox.
   4. In the SCIM 2.0 Base Url field, paste the Alida Base URL value.
      This is the Base URL value displayed on the User Auto-Provisioning page in Alida.
   5. In the OAuth Bearer Token field, paste the Alida token value.
      This is the token you previously generated on the User Auto-Provisioning page in Alida.
   6. Leave the Import Groups checkbox cleared.
   7. Click Test API Credentials.
      Okta verifies the connection and shows a success message.
   8. Click Save.
   
5. Configure provisioning to the Alida app:
   1. In the left settings pane under Provisioning, select To App.
   2. Click Edit next to the Provisioning to App section.
   3. Click the Enable checkbox next to the provisioning features you want to enable:
      • Create Users: Automatically creates a user in the app when they are assigned in Okta.
      • Update User Attributes: Pushes profile updates from Okta to the app.

      • Deactivate Users: Deactivates or deprovisions the user in the app when they are unassigned from the app in Okta or their Okta account is deactivated.

      
   4. Click Save.
6. Configure attribute mappings:
   1. On the To App page, scroll down to the Attribute Mappings section.
   2. Confirm that the default mappings include Username, Email, Primary email type, and Display name.
      
7. Confirm user matching:
   1. In the left settings pane under Provisioning, select To Okta.
   2. Confirm that emails are used to match users between Okta and Alida.
      
8. Create and assign an assignment group:
   1. In Okta, go to Directory > Groups and create an assignment group (for example, Alida_All_Users), or reuse the group you already use for SSO app assignment.
      Important: Use separate Okta groups for app assignment and Group Push. Using one group for both can cause role or membership changes to be lost when users move between groups. See Okta documentation on app assignments and Group Push.
   2. Add all users who should have access to Alida to the assignment group.
      Assigning the app through this group provisions and enables the user in Alida and shows the Alida tile in Okta. It does not set the user's Alida role.
   3. On the Alida application Assignments tab, assign the assignment group to the application.
      
9. Create and push role groups:
   1. In Okta Directory > Groups, create Push Groups whose names match the user auto-provisioning groups you created in Alida.
   2. Add each user to the Push Group that corresponds to their Alida role.
      Note: Assign each user to a single Push Group. A user in more than one Push Group receives the default group's role.
   3. On the Alida application Push Groups tab, click Push Groups, then select Find groups by name.
   4. Enter a group name that exists in Okta and Alida, then click Save.
      Okta recognizes matching groups automatically.
   5. Confirm that Push Status is Active for each Push Group.
      
10. In Alida, resume SCIM sync to complete setup.
    Follow the steps in Pause or resume SCIM sync. Do not resume sync until assignments and Push Groups are configured correctly.

After you resume sync, Alida applies provisioning changes from Okta.

To provision a user, complete these actions in Okta Directory in this order:

1. Add the user to the assignment group (for example, Alida_All_Users).
2. Add the user to their Push Group (for example, Alida_Analyst or Alida_PowerUser).

To deprovision a user, complete these actions in this order:

1. Remove the user from their Push Groups.
2. Remove the user from the assignment group.

For more information, see Okta documentation on app assignments and Group Push.

Related information

• Set up SSO with Okta
• Quick start: SSO setup
• Pause or resume SCIM sync