Configure SCIM for Okta

This topic describes how to configure SCIM (System for Cross-domain Identity Management) provisioning on HashiCorp Cloud Platform (HCP) for Okta. Refer to the SCIM overview to learn about SCIM in HCP.

Prerequisites

You must configure SAML SSO in your organization for Okta. Refer to Set up SAML SSO for instructions.
Your current Okta product must support SCIM provisioning.
A custom application with SAML SSO enabled for your HCP organization.

Enable SCIM provisioning in HCP

First, enable SCIM provisioning on HCP to obtain the credentials needed for configuration with your identity provider. SSO default roles assignments will be disabled once this is done.

Log in to HCP and go to your organization.
Click Organization settings and then SCIM provisioning.
Click Enable SCIM provisioning.
Click Generate SCIM token.
Copy and save the token value. You need this token to configure your identity provider.
Copy the Base URL. You need this URL to configure your identity provider.

Keep the HCP page open so that you can return to it after configuring Okta.

Configure Okta

After you enable SCIM on HCP, configure your identity provider to sync users and groups to HCP.

Sign in to Okta.
In the Application tab, select Browse App Catalog.
Navigate to your custom application for HCP.
Click on the Provisioning tab, then click on Configure API integration.
Enable the Enable API Integration option and configure the following fields:
- In the Base URL field, enter the value from the Base URL field you copied from HCP.
- In the API Token field, type Bearer <value of the SCIM token you copied from HCP>.
To verify the configuration, click Test API Credentials.
Click Save.

Configure Okta provisioning settings

After verifying the connection, new settings appear under the Provisioning tab of your custom application for HCP.

Click Edit, then enable the following options:
- Create users
- Update User Attributes
- Deactivate Users
To assign users and groups, click on the Assignments tab and select Assign. After enabling assignments, Okta creates and updates users in HCP.

Map Okta attributes to users in HCP

The following attributes are supported for users in Okta. Refer to the Okta documentation for information about mapping Okta attributes.

Okta attribute	SCIM attribute	Required
`userName`	`userName`	Yes
`name.givenName`	`name.givenName`	Yes
`name.familyName`	`name.familyName`	Yes
`email`	`email`	Yes

Map Okta attributes to groups in HCP

Okta attribute	SCIM attribute	Required
`displayName`	`displayName`	Yes
`members`	`members`	No
`externalId`	`externalId`	No

Assign roles

It is optional, but after configuring Okta, return to the SCIM provisioning page as described in Enable SCIM provisioning on HCP. Click View role assignments to view and manage roles in your account. The role-based access control (RBAC) system in HCP define which actions members of your organizations and projects can perform. Refer to Access Management for more information about RBAC in HCP and instructions on how to manage and assign roles.

Disable SCIM provisioning

You can disable SCIM provisioning at any time. When you disable SCIM provisioning, users and groups remain in HCP, but their lifecycle management transfers from your identity provider to HCP:

Log in to HCP and go to your organization.
Click Organization settings and then SCIM provisioning.
Click Manage and then Disable SCIM provisioning.
Type DISABLE to confirm the action.
Click Disable.

After you disable SCIM provisioning, you can manage users and groups directly in HCP or through your SSO provider.