Okta - SCIM - Configuration

Important Note

The instructions in this article cover a third-party app and may not reflect the latest version. Please use these instructions as a guide to complete the task, but be aware that some screens, field names, and steps may have changed.

Overview

This article provides details on configuring an Okta identity provider to use Flosum's SCIM API. For more information about SCIM, see the following article.

• Configuring SCIM for Flosum

Customer-Hosted

Customers who host Flosum Apps on their own infrastructure will have a custom URL for logging into their apps. When using this documentation, replace any Flosum Hosted URLs with your own URLs.

Prerequisites

Before setting up automated provisioning, ensure SAML-based SSO is properly configured and fully functional in your Flosum tenant.

View your SAML 2.0(Header Auth) on the Sign On tab and ensure your SAML 2.0 Attributes are correctly set. See the screenshot and table below.

Name	Value
uniqueUserId	user.id
firstName	user.firstName
lastName	user.lastName
email	user.email

For instructions for adding and configuring an Okta identity provider, see the following articles.

• Adding an Identity Provider (SSO)

• Okta - SAML - Configuration

Configure Okta

1

Configure API Integration

1. Click Applications under the Applications on the left sidebar menu.

2. Click the Provisioning tab.

3. Click Configure API Integration.

   
4. Check the API Integration checkbox.

5. In the Base URL textbox, enter the SCIM API URL for your region from the table below.

Region	SCIM API URL
United States	https://global-us.flosum.app/api/v1/scim
Germany	https://global-de.flosum.app/api/v1/scim
Japan	https://global-jp.flosum.app/api/v1/scim
Australia	https://global-au.flosum.app/api/v1/scim

1. In the API Token textbox, enter your Global Settings API Token. If you don't have an API Token, see the following article for instructions on creating one.

   1. Creating an API Token

2. Click Test API Credentials. If successful, you will receive a "{Your app name} was verified successfully!" message.

   

If you don't receive a connection confirmation, check the Base URL and ensure it isn't blocked by firewalls or other network traffic interceptors. Then verify that the API Token is correct.

1. Click Save.

2

Mappings

The Flosum SCIM API uses specific metadata values from Okta user profiles. This section explains the required mappings between the Flosum SCIM API and Okta attributes.

1. On the application settings page, navigate to Provisioning -> To App.

2. Click Edit.

3. Enable the following options:

   1. Create Users

   2. Update User Attributes

   3. Deactivate Users

Don't enable Sync Password; Flosum doesn't use the identity provider's password for user accounts.

1. Make sure the following attributes are enabled for provisioning:

   1. Username

   2. Given name

   3. Family name

   4. Primary email

   5. Time zone

      

3

Assignments

Assign users to the Flosum SCIM application.

1. Click the Assignments tab.

2. Click the Assign dropdown menu.

3. Click Assign to People.

   
4. Select the user to assign to this application.

5. Specify the user information to use for this application.

   1. For the Username field, enter the user's email address.

      

Flosum uses the email address as the username. Make sure the Username attribute is mapped to the user's email address.

If the Time Zone field is left blank, the timezone will default to Etc/UTC.

4

Importing Users

If you've already added users directly to your Flosum tenant rather than provisioning them through Okta, you can sync them with your identity provider by importing them from Flosum.

1. Click the Import tab.

2. Click Import Now.

   
3. Your Flosum users will be imported into your Okta identity provider.

4. Determine how to assign the imported SCIM users to Okta users.

   

This prevents mismatched users between systems and avoids login issues after enabling SSO.