Setup Guide: Okta SCIM Provisioning | Axero Documentation

Have accounts on your site created, updated, and deactivated automatically from Okta, so you do not maintain them by hand in two places. The connection uses SCIM (System for Cross-domain Identity Management), the standard that carries those changes between the two.

Overview

• Preparation
• Step 1: Set Up SCIM Integration
• Step 2: Configure Provisioning Features
• Step 3: Configure Attribute Mappings
• Step 4: Test the Integration
• Step 5: Assign Users and Groups
• Optional: Add Custom Attributes
• Additional Considerations

Preparation

Before you start, you need:

• Super administrator access to your Okta organization
• Site Administrator access to your Axero site
• Completed the initial SAML SSO setup for Okta within Axero

Allow 30 to 60 minutes for this setup.

Step 1: Set Up SCIM Integration

1. In the Axero application you just added in Okta, select the Provisioning tab.
2. Click Configure API Integration.
   
3. Select the Enable API integration checkbox.
4. Open a new browser tab and sign in to your Axero site.
5. Navigate to Control Panel > System > Single Sign On.
6. Expand the SCIM User Provisioning section and copy the Bearer token.
   
7. Paste the value into Okta's API Token field.
8. Click Test API Credentials to verify the connection.
   
9. If the test succeeds, click Save to apply the settings.

Step 2: Configure Provisioning Features

1. In the Provisioning tab, under To App, click Edit.
2. Enable the following provisioning features:
   • Create Users
   • Update User Attributes
   • Deactivate Users
   Deactivate Users does not always mean deactivate. Axero deactivates the account when the provisioning request marks the person inactive, and that is the usual outcome. But if the request that arrives is a SCIM delete rather than a deactivation, Axero deletes the account outright. What happens to everything that person authored is then set by the SCIMDeleteUserAssignUserID system property. Until someone changes it, that property is set to delete the content along with the account. There is no undo, and the account cannot be reactivated afterward because it no longer exists.
   
   Before you turn this on, choose who receives that content: open Control Panel > System > Single Sign On, expand SCIM User Provisioning, and set Reassign content from deleted users to. That control writes the SCIMDeleteUserAssignUserID property, so that if a delete does arrive, the departed person's content lands where you want it. Then test with one account you are willing to lose, and check afterward whether it appears under deactivated people or has gone entirely.
3. Click Save to apply the provisioning settings.
   

Step 3: Configure Attribute Mappings

1. In the Provisioning tab, go to To App and click Edit.
2. Review the default attribute mappings and change any that do not point at the Axero field you want them in.
   
3. Click Save to apply the attribute mappings.

Step 4: Test the Integration

1. Test user creation
   • In Okta, assign a new user to the Axero application.
   • Verify that a new user account with the correct attributes is created in Axero.
2. Test attribute updates
   • In Okta, update some attributes for a user (e.g., job title, department).
   • Verify that the user's attributes in Axero are updated accordingly.
3. Test user deactivation
   Note: A person has to be linked to Okta before SCIM can deactivate them. Accounts that already existed in Axero before you set up SCIM get linked the first time Okta matches and pushes them, which normally happens when you assign them to the Axero application.
   • In Okta, deactivate a user or remove their assignment to the Axero application.
   • Verify that the user is deactivated in Axero.

Step 5: Assign Users and Groups

1. Navigate to the Assignments tab within the Axero application in Okta.
2. Click Assign and choose either Assign to People or Assign to Groups.
   
3. Select the specific users or groups you wish to provision to Axero.
4. Click Assign for each selection, then Done.
5. Okta then starts provisioning the people and groups you assigned.

Optional: Add Custom Attributes

In Okta:

1. Navigate to your Axero application.
2. Click the Provisioning tab and select To App.
3. In the Attribute Mappings section, click Go to Profile Editor.
4. Click + Add Attribute.
   
5. For the new attribute:
   • Display name: Enter a user-friendly name for the attribute (e.g., "Hire Date").
   • Variable name: Enter a unique identifier for the attribute (e.g., "hireDate"). Okta uses this name internally.
   • External name: Enter the name of the custom attribute to be mapped in Axero (e.g., "hireDate").
   • External namespace:
     • For standard attributes (employeeNumber, costCenter, organization, division, department, and manager), enter urn:ietf:params:scim:schemas:extension:enterprise:2.0:User. The enterprise schema carries exactly those six and discards anything else, so a custom attribute placed here is silently dropped. The manager attribute matters most: Axero reads the manager only from this schema, so a manager sent under any other namespace does not arrive at all.
     • For custom attributes, use urn:scim:your-axero-site.com:custom:schema and replace your-axero-site.com with your site's domain.
   
6. Click Save to add the new attribute.
7. Return to the Profile Editor main page.
8. Click Mappings to open the attribute mappings interface.
   
9. In the Okta User to App tab, locate the newly created attribute.
10. In the Okta User Profile dropdown, select the Okta attribute you want mapped to this custom attribute.
11. Click Save Mappings to apply the changes.

In Axero:

1. Navigate to Control Panel > System > System Properties.
2. Search for SCIMCustomAttributesEnabled and set its value to "true".
   
3. Clear the filter and search for SCIMCustomAttributesURNSchema.
4. Click Edit and enter the namespace you created in Okta (for example, urn:scim:your-axero-site.com:custom:schema).
5. Go to System > Single Sign On > Data Mapping and select SCIM in the Type dropdown.
6. Click Add to create a new mapping.
7. Enter the custom attribute name (matching the App Attribute in Okta) and map it to the corresponding Axero user field.
   
8. Click Update to save the mapping.
9. Test provisioning to confirm that the new attributes sync correctly.

Additional Considerations

• Sync Schedule: Okta sends a change to Axero when the user's profile changes in Okta.
• Profile Images: Axero maps the SCIM photos attribute to the Profile Photo field by default, so an image will sync if your Okta profile sends one. If it does not, use Axero's REST API: Add User Image to update images instead.
• Group Membership: SCIM provisioning covers user records only, so Okta's Group Push has no effect. Groups reach Axero through the group attribute statement described in the Setup Guide: Okta SAML SSO.

Related pages

• Okta (what the two Okta paths cover)
• Setup Guide: Okta SAML SSO (the sign-in setup this builds on)
• Single Sign On (the Axero screen every Axero-side step on this page opens)
• System Properties (the SCIM properties named above)
• Single Sign-On (SSO) (the other identity providers)