> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/global-settings/security/identity-providers-sso/scim-configurations/okta-scim-configuration.md).

# Okta - SCIM - Configuration

{% hint style="success" %}

#### Important Note

The instructions in this article cover a third-party app and may not reflect the latest version. Please use these instructions as a guide to complete the task, but be aware that some screens, field names, and steps may have changed.
{% endhint %}

## ![](https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FSxcnKlaJKPzDqONWoDNv%2FSummary2-Small-Icon.svg?alt=media\&token=5e3253d0-a069-4ba5-9c06-83c70bd0b21d) Overview

This article provides details on configuring an Okta identity provider to use Flosum's SCIM API. For more information about SCIM, see the following article.

* [Configuring SCIM for Flosum](/global-settings/security/identity-providers-sso/configuring-scim-for-flosum.md)

{% hint style="warning" %}

#### Customer-Hosted

Customers who host Flosum Apps on their own infrastructure will have a custom URL for logging into their apps. When using this documentation, replace any **Flosum Hosted URLs** with your own URLs.
{% endhint %}

## Prerequisites

Before setting up automated provisioning, ensure SAML-based SSO is properly configured and fully functional in your Flosum tenant.

View your **SAML 2.0(Header Auth)** on the **Sign On** tab and ensure your **SAML 2.0 Attributes** are correctly set. See the screenshot and table below.

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FpWzobeI27BeakNnatBRo%2FUsingJitProvisioning-Okta-01.png?alt=media&amp;token=9e347210-0c34-418e-be95-2b60bf854af2" alt="" width="524"><figcaption></figcaption></figure></div>

| Name         | Value          |
| ------------ | -------------- |
| uniqueUserId | user.id        |
| firstName    | user.firstName |
| lastName     | user.lastName  |
| email        | user.email     |

For instructions for adding and configuring an Okta identity provider, see the following articles.

* [Adding an Identity Provider (SSO)](/global-settings/security/identity-providers-sso/adding-an-identity-provider-sso.md)
* [Okta - SAML - Configuration](/global-settings/security/identity-providers-sso/saml-identity-providers/okta-saml-configuration.md)

## Configure Okta

{% stepper %}
{% step %}

### Configure API Integration

1. Click **Applications** under the **Applications** on the left sidebar menu.
2. Click the **Provisioning** tab.
3. Click **Configure API Integration**.&#x20;

   <figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2Fa53VbTX6dvjvlKlbv2wk%2FOktaScimConfig-S01-01.png?alt=media&amp;token=4eca1e03-37af-4741-8e5f-a0dac779e65e" alt=""><figcaption></figcaption></figure>
4. Check the **API Integration** checkbox.
5. In the **Base URL** textbox, enter the SCIM API URL for your region from the table below.

<table><thead><tr><th width="159.6666259765625">Region</th><th>SCIM API URL</th></tr></thead><tbody><tr><td>United States</td><td>https://global-us.flosum.app/api/v1/scim</td></tr><tr><td>Germany</td><td>https://global-de.flosum.app/api/v1/scim</td></tr><tr><td>Japan</td><td>https://global-jp.flosum.app/api/v1/scim</td></tr><tr><td>Australia</td><td>https://global-au.flosum.app/api/v1/scim</td></tr></tbody></table>

6. In the **API Token** textbox, enter your Global Settings **API Token**. If you don't have an API Token, see the following article for instructions on creating one.
   1. [Creating an API Token](/global-settings/security/api-tokens/creating-an-api-token.md)
7. Click **Test API Credentials**. If successful, you will receive a "**{Your app name} was verified successfully!**" message.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FeO30krs1pP6ybEt9biJ8%2FOktaScimConfig-S01-02.png?alt=media&amp;token=de7b866b-0ab1-4e18-aeb3-ec591845e9c6" alt="" width="563"><figcaption></figcaption></figure></div>

{% hint style="info" %}
If you don't receive a connection confirmation, check the **Base URL** and ensure it isn't blocked by firewalls or other network traffic interceptors. Then verify that the **API Token** is correct.
{% endhint %}

8. Click **Save**.
   {% endstep %}

{% step %}

### Mappings

The Flosum SCIM API uses specific metadata values from Okta user profiles. This section explains the required mappings between the Flosum SCIM API and Okta attributes.

1. On the application settings page, navigate to **Provisioning -> To App**.
2. Click **Edit**.
3. Enable the following options:
   1. **Create Users**
   2. **Update User Attributes**
   3. **Deactivate Users**

{% hint style="info" %}
Don't enable **Sync Password**; Flosum doesn't use the identity provider's password for user accounts.
{% endhint %}

4. Make sure the following attributes are enabled for provisioning:
   1. **Username**
   2. **Given name**
   3. **Family name**
   4. **Primary email**
   5. **Time zone**&#x20;

      <figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2Fm1PWQPSGRWVio8sC74wy%2FOktaScimConfig-S02-01.png?alt=media&amp;token=39abcdc4-8a4f-4175-925e-0b2f4e1d1872" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Assignments

Assign users to the Flosum SCIM application.

1. Click the **Assignments** tab.
2. Click the **Assign** dropdown menu.
3. Click **Assign to People**.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FkX4dWVggoRphnM0hG2Cs%2FOktaScimConfig-S03-01.png?alt=media&amp;token=c53f45db-764c-4779-a471-33ae3a7fce36" alt="" width="563"><figcaption></figcaption></figure></div>
4. Select the user to assign to this application.
5. Specify the user information to use for this application.
   1. For the **Username** field, enter the user's email address.&#x20;

      <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2F5mGOqbWP4Ahk255u7Zgp%2FOktaScimConfig-S03-02.png?alt=media&amp;token=db540502-4d4d-47f9-b6c2-95d307b22d76" alt="" width="563"><figcaption></figcaption></figure></div>

{% hint style="warning" %}
Flosum uses the email address as the username. Make sure the `Username` attribute is mapped to the user's email address.
{% endhint %}

{% hint style="info" %}
If the **Time Zone** field is left blank, the timezone will default to Etc/UTC.
{% endhint %}
{% endstep %}

{% step %}

### Importing Users

If you've already added users directly to your Flosum tenant rather than provisioning them through Okta, you can sync them with your identity provider by importing them from Flosum.

1. Click the **Import** tab.
2. Click **Import Now**.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FTGMBM9n47js0XZfCYXr6%2FOktaScimConfig-S04-01.png?alt=media&amp;token=415a232e-1b07-4a3b-a06d-8bb021f9801a" alt="" width="563"><figcaption></figcaption></figure></div>
3. Your Flosum users will be imported into your Okta identity provider.
4. Determine how to assign the imported **SCIM** users to **Okta** users.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FQghTBBcPGeig84GJisHM%2FOktaScimConfig-S04-02.png?alt=media&amp;token=36c29c27-0cef-4f19-a4e7-ae0c24a39b6e" alt="" width="563"><figcaption></figcaption></figure></div>

{% hint style="info" %}
This prevents mismatched users between systems and avoids login issues after enabling SSO.
{% endhint %}
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flosum.com/global-settings/security/identity-providers-sso/scim-configurations/okta-scim-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.