Configure SCIM Provisioning with Okta

Okta is a cloud-based identity and access management platform that provides secure authentication and user management for applications. By integrating Okta with API7 Enterprise using SCIM (System for Cross-domain Identity Management), you can automatically synchronize user accounts from Okta to the API7 Dashboard, eliminating manual user management and ensuring consistent access control.

This guide walks you through configuring SCIM provisioning between Okta and API7 Enterprise.

Prerequisites

1. Install API7 Enterprise.
2. Have an Okta account with admin privileges.

Create a SCIM App in Okta

Search for SCIM Integration

1. Log in to the Okta Admin Console.
2. Navigate to Applications > Applications from the side navigation.
3. Click Browse App Catalog.
4. Search for SCIM in the search bar.
5. Select SCIM 2.0 Test App (Header Auth) from the search results.

Add the Integration

1. Click Add Integration to add the SCIM test app to your Okta organization.

Configure General Settings

1. In the General Settings tab, configure the application name and other settings as needed.

Configure Sign-On Options

1. In the Sign-On Options tab, select Secure Web Authentication (SWA) as the sign-on method. (You can also choose the appropriate sign-on methods based on your needs, such as SAML 2.0.)

2. Click Done to save the application.

Enable SCIM in API7 Dashboard

1. Log in to the API7 Dashboard with an admin account.
2. Select Organization from the top navigation bar, then choose Settings.

3. Enable SCIM Provisioning.

4. Copy the API7 SCIM Endpoint URL and SCIM Token. You will need these values to configure the Okta integration.

Configure SCIM Integration in Okta

Configure API Integration

1. Return to the Okta Admin Console and navigate to your SCIM application.
2. Select the Provisioning tab.

3. Click Configure API Integration.
4. Check Enable API Integration.
5. Enter the SCIM 2.0 Base URL copied from the API7 Dashboard.
6. In the API Token field, enter Bearer <your_token>. Replace <your_token> with the SCIM Token copied from the API7 Dashboard.

note

Make sure to include a space after Bearer.

7. Click Test API Credentials to verify the connection, then click Save.

Enable Provisioning Features

1. In the Provisioning tab, select To App from the left panel.
2. Click Edit to modify the provisioning settings.

3. Enable Create Users, Update User Attributes, and Deactivate Users as needed.
4. Click Save to apply the changes.

Assign Users to the Application

1. In the SCIM application, select the Assignments tab.
2. Click Assign and select Assign to People.

3. Select the users you want to provision to API7 Enterprise.

4. Click Assign for each selected user, then click Done.

5. Verify that the users are assigned to the application.

Verify User Provisioning

1. Return to the API7 Dashboard.
2. Select Organization from the top navigation bar, then choose Users.
3. Verify that the users assigned in Okta have been provisioned to the API7 Dashboard.

Additional Resources

• Key Concepts
  • Roles and Permission Policies
• Getting Started
  • Update User Roles
  • Create Custom Role
• Best Practices
  • Dashboard SSO using LDAP
  • Configure Dashboard SSO with Microsoft Entra ID