WorkOSDocs
Search
Menu
Search
/
Sign in

Configuring Okta SCIM v1.1

Learn about syncing your user list with Okta SCIM v1.1

IntroductionLink

This guide outlines how to synchronize your application's Okta directories using SCIM v1.1.

To synchronize an Enterprise's users and groups provisioned for your application, you'll need to provide the Enterprise with two pieces of information:

  • An Endpoint that Okta will make requests to.
  • A Bearer token for Okta to authenticate its endpoint requests.

Both of these are available in your Endpoint's Settings in the Developer Dashboard.

1
Set up your directory sync endpointLink

Login to your WorkOS Dashboard and select "Organizations" from the left hand navigation bar.

Select the organization you'll be configuring a new Directory Sync with.

Click "Add Directory".

Input the Organization's Company Name, Company Domain, and select "Okta SCIM v1.1" from the dropdown. Then, click "Create Connection".

You'll see WorkOS has created the Endpoint and Bearer Token which you will provide to Okta in the steps below.

We have support for whitelabeled URLs for Directory Sync endpoints. Contact us for more info!

2
Configure your Okta provisioning API integrationLink

Log in to the Okta admin dashboard and select "Applications" in the navigation bar.

Select your application from the application portal. Important Note: Okta will default new apps to SCIM 2.0, so for a SCIM 1.1 connection, make sure you've selected an application type that supports SCIM 1.1.

Also, make sure the app is using OAuth Bearer Token as the authentication method.

In your application's Enterprise Okta admin panel, click the "Provisioning" tab.

Then, click "Configure API Integration" and check "Enable API Integration".

After that, copy and paste the Endpoint from your Developer Dashboard in the SCIM 1.1 Base URL field.

Then, copy and paste the Bearer Token from your Developer Dashboard into the OAuth Bearer Token field.

Click "Test API Credentials", you should receive a success message.

Click "Save"

The provisioning tab will now show a new suite of options which we'll utilize in the next GuideSection to continue provisioning your application.

3
Select options to provision to your applicationLink

In the "To App" navigation section, check to enable:

  • Create Users
  • Update User Attributes
  • Deactivate Users

Click "Save".

4
Assign users and groups to your applicationLink

In the "Assignments" tab, from the "Assign" dropdown, select "Assign to People".

Select users you'd like to provision. When you click 'assign' a lengthy form will open where you can populate all of the user's metadata:

Confirm the metadata fields, scroll down to the bottom, and press "Save and go back". Repeat this for all users and select 'Done'

Witness realtime changes in your WorkOS Developer Dashboard.

The following steps will outline pushing Groups from Okta:

In the "Push Groups" tab, from the "Push Groups" dropdown, select: "Find Groups by Name"

Search for the group you'd like to push and select it. Make sure the box is checked for "Push Immediately" and click "Save".

Witness realtime changes in your WorkOS Developer Dashboard.