Setup Guide: Okta SCIM Provisioning | Axero Documentation

This guide explains how to configure automated user provisioning between Okta and Axero using SCIM (System for Cross-domain Identity Management). This setup automates creating, updating, and deactivating user accounts for your intranet.

Overview

• Preparation
• Step 1: Set Up SCIM Integration
• Step 2: Configure Provisioning Features
• Step 3: Configure Attribute Mappings
• Step 4: Test the Integration
• Step 5: Assign Users and Groups
• Optional: Add Custom Attributes
• Additional Considerations

Preparation

Before you start, ensure you have:

• Super Administrator access to your Okta organization
• Site Administrator access to your Axero site
• Completed the initial SAML SSO setup for Okta within Axero

This process will take approximately 30-60 minutes to complete.

Step 1: Set Up SCIM Integration

1. Within the newly added Axero application in Okta, select the Provisioning tab.
2. Click Configure API Integration.
   
3. Enable Enable API Integration.
4. Open a new browser tab and sign in to your Axero site.
5. Navigate to Control Panel > System > Single Sign-On.
6. Reveal the SCIM User Provisioning section and copy the Bearer token.
   
7. Paste the value into Okta's API Token field.
8. Click Test API Credentials to verify the connection.
   
9. If successful, click Save to apply the settings.

Step 2: Configure Provisioning Features

1. In the Provisioning tab, under To App, click Edit.
2. Enable the following provisioning features:
   • Create Users
   • Update User Attributes
   • Deactivate Users
3. Click Save to apply the provisioning settings.
   

Step 3: Configure Attribute Mappings

1. In the Provisioning tab, go to To App and click Edit.
2. Review the default attribute mappings. Modify them as necessary to align with Axero's user attributes.
   
3. Click Save to apply the attribute mappings.

Step 4: Test the Integration

1. Test user creation
   • In Okta, assign a new user to the Axero application.
   • Verify that a new user account with the correct attributes is created in Axero.
2. Test attribute updates
   • In Okta, update some attributes for a user (e.g., job title, department).
   • Verify that the user's attributes in Axero are updated accordingly.
3. Test user deactivation
   Note: Only users provisioned via SCIM can be deactivated via SCIM.
   • In Okta, deactivate a user or remove their assignment to the Axero application.
   • Verify that the user is deactivated in Axero.

Step 5: Assign Users and Groups

1. Navigate to the Assignments tab within the Axero application in Okta.
2. Click Assign and choose either Assign to People or Assign to Groups.
   
3. Select the specific users or groups you wish to provision to Axero.
4. Click Assign for each selection, then Done.
5. Okta will initiate the provisioning process based on the assignments.

Optional: Add Custom Attributes

In Okta:

1. Navigate to your Axero application.
2. Click the Provisioning tab and select To App.
3. In the Attribute Mappings section, click Go to Profile Editor.
4. Click + Add Attribute.
   
5. For the new attribute:
   • Display name: Enter a user-friendly name for the attribute (e.g., "Hire Date").
   • Variable name: Enter a unique identifier for the attribute (e.g., "hireDate"). This is used internally by Okta.
   • External name: Enter the name of the custom attribute to be mapped in Axero (e.g., "hireDate").
   • External namespace:
     • For standard attributes (employeeNumber, costCenter, organization, division, and department), enter urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
     • For custom attributes, use urn:scim:your-axero-site.com:custom:schema and replace your-axero-site.com with your intranet domain.
   
6. Click Save to add the new attribute.
7. Return to the Profile Editor main page.
8. Click Mappings to open the attribute mappings interface.
   
9. In the Okta User to App tab, locate the newly created attribute.
10. In the Okta User Profile dropdown, select the appropriate Okta attribute to map to this custom attribute.
11. Click Save Mappings to apply the changes.

In Axero:

1. Navigate to Control Panel > System > System Properties.
2. Search for SCIMCustomAttributesEnabled and set its value to "true".
   
3. Clear the filter and search for SCIMCustomAttributesURNSchema.
4. Click Edit and enter the namespace you created in Okta (for example, urn:scim:your-axero-site.com:custom:schema).
5. Go to System > Single Sign-On > Data Mapping and select the SCIM tab.
6. Click Add to create a new mapping.
7. Enter the custom attribute name (matching the App Attribute in Okta) and map it to the corresponding Axero user field.
   
8. Click Update to save the mapping.
9. Restart your Axero site so the changes take effect.
10. Test the provisioning process to verify that the new attributes are syncing correctly.

Additional Considerations

• Sync Schedule: SCIM updates occur in near real-time when changes are made in Okta.
• Profile Images: Okta SCIM integration does not support syncing profile images. Consider using Axero's REST API to update images.
• User Deprovisioning: To enable automatic deprovisioning, user accounts created before SCIM integration must be properly linked and synced with Okta.