This guide covers connecting Axero to your Okta organization for Single Sign-On (SSO) and automated user provisioning.
Okta is a platform that manages user logins and access to various applications.
There are two main ways to integrate Okta with Axero:
People sign in to Axero with their Okta credentials rather than a separate Axero password, and signing out of Axero ends the Okta session too. Access stays managed in one place.
With SAML you create and maintain Axero accounts yourself. With SCIM, Okta creates, updates, and deactivates Axero accounts for you as the matching change is made in Okta.
In the SAML integration, an Axero account is created the first time the person signs in. With SCIM, Okta creates the account in Axero as soon as the person is assigned to the Axero application, so they have access before they ever sign in.
Deprovisioning means ending someone's access. With SCIM, Okta deprovisions people in Axero automatically when their accounts are deactivated or unassigned in Okta, so access ends as soon as the change is made.
With SAML on its own, deprovisioning is manual. To end someone's access, remove their assignment to the Axero application in Okta. Deactivating the account in Axero is not enough by itself: as long as the person still has the Okta assignment, their next sign-in reactivates the account.
Both integrations map the profile fields that ship with Axero, with no extra configuration: First name, Last name, Email, Phone, Company, Department, Job title, and Reports to.
SCIM maps a few more fields than that list shows. It also connects the address fields (Address 1, City, State, Country, and Postal code) and the profile photo covered under Profile Images. Treat the list above as the fields most sites care about, not the complete set. To see what is actually configured, check the Data Mapping tab on your own site.
Custom attributes are the extra profile fields you add yourself. Both integrations support them. You can show them on profiles, or use them to set up Personas with more detailed assignment rules on your site.
Okta always sends these values as text, and you can map them to any field on the Axero profile. Axero converts the text to the kind of value that field expects. So a value going into a date field has to use your site's date format, and a value going into a dropdown has to match one of its options.
Both integrations sync the person's manager into the Reports to field, which is what builds the Organizational Chart in Axero.
Both integrations sync the person's start date with the organization. Hire Date can also be used in Personas to create New Hire cohorts.
Group membership reaches Axero through a group attribute statement: a setting you add to the Okta application so that Okta sends the person's groups each time they sign in. The Setup Guide: Okta SAML SSO covers how to add it.
Groups arrive this way whether or not you also use SCIM provisioning. Okta's Group Push feature has no effect here, because Axero's SCIM service handles user records only. Once groups are mapped, you can use them with Personas to manage space membership in Axero.
Axero accepts a profile picture over either integration: the default field mapping already connects the SAML ThumbnailPhoto attribute and the SCIM photos attribute to the Profile Photo field.
Whether an image actually arrives depends on what your Okta profile sends. If it does not send one, you can use our REST API: Add User Image to upload photos, or users can upload their own picture in Axero.
With SAML, a person's information is refreshed each time they sign in. With SCIM, Okta pushes each change as it happens, so Axero stays current in between.
If you get stuck, open a support case and include any error messages or screenshots from both Okta and Axero.
is requesting access to a wiki that you have locked: https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/105583/okta
Your session has expired. You are being logged out.