Okta (SCIM)

SASE integrates with Okta using SCIM, ensuring automatic user synchronization, profile updates, and streamlined deactivation when users are removed from the Okta SCIM Application.

Prerequisites

To integrate Okta and SASE, you must have:

• Administrator access to both Okta and SASE Administrator Portal.

• Active SASE Okta application configured for Single Sign-On.

Note - SCIM based user provisioning is available to SASE Enterprise customers only.

Enabling SCIM on Okta Management Portal

1. Log in to your Okta Management Portal.

2. Go to Applications > Browse app Catalog.

3. Search and select your application and click Add.

   

4. Click Done.

   

5. Go to the Provisioning tab and click Configure API Integration.

   

6. Select the Enable API Integration checkbox.

7. In the API Token field, enter the generated token. To get the generated token:

   1. Access the SASE Administrator Portal and click Settings > Identity Providers.

      The Identity Providers page appears.

      

   2. Click Turn On in the SCIM Integration section.

      

   3. Click Settings in the SCIM Integration section.

      

   4. Click Generate Token.

      

   5. The secret token is generated.

   6. Click Copy Token.

      

   7. Click Close.

8. Click Test API Credentials.

   

9. Click Save.

10. Go to Settings > To App.

    

11. Click Edit.

12. Select the checkbox for:

    • Create Users

    • Update User Attributes

    • Deactivate Users

13. Click Save.

14. To provision users and groups:

    1. Go to Applications and select your SAML 2.0 application.

    2. Go to Assignments tab.

       

    3. Click Assign.

    4. Search and select the user name, email id, or group(s) name.

    5. To push groups, click the Push groups tab and select By name.

       

    6. In the Push groups by name field, enter the group name.

    7. Select the Push group memberships immediately checkbox.

    8. Click Save and Go Back.

    9. Click Done.

    These SAML attributes are supported:

    Application Attribute	Identity Bridge Attribute or Literal Value
    email	user.email
    given_name	user.firstName
    family_name	user.lastName
    groups	Configured in the app UI. See Group Support section.