SCIM Provisioning with OKTA

Prerequisites

To set up SCIM provisioning with OKTA, you'll need:

  • A TeamRetro ENTERPRISE subscription
  • The Organization Owner role in TeamRetro (to create an SCIM-scope API key)
  • An Administrator role in OKTA (to configure SCIM)
  • OKTA SSO set up on your TeamRetro application
    See our OKTA SSO configuration guide

Configuring SCIM

Step 0 - Set up OKTA Single Sign On (SSO) with TeamRetro

Step 1 - Get your TeamRetro SCIM API key

  • In TeamRetro, browse to [ORGANIZATION] > SETTINGS > SINGLE SIGN ON
  • Click CREATE API KEY
  • Toggle SCIM to enabled (you may wish to disable Read and Write API access also)
  • Click CREATE
  • Copy the unique SCIM API key to use later in OneLogin
  • Click SAVE CHANGES

Step 2 - Enable SCIM Provisioning in OKTA

  • In OKTA, navigate to the Applications > Applications page
  • Click on the TeamRetro application you've created earlier for SSO
  • Navigate to the General Tab
  • Click Edit under App Settings
  • Check Enable SCIM provisioning
  • Click Save

Step 2 - Configure SCIM Provisioning In OKTA

  • Navigate to the Provisioning > Integration Tab
  • Click Edit under SCIM Connection
  • Update the fields:
    • SCIM connector base URL:
    • Unique identifier field for users: userName
    • Supported provisioning actions: Select
      • Push New Users
      • Push Profile Updates
      • Push Groups
    • Authentication Mode: HTTP Header
    • Authorization: <Your SCIM API Key created earlier>
  • Click Save

  • Under the Provisioning > To App tab
  • Click Edit under Provisioning to App
  • Enable:
    • Create Users
    • Update User Attributes
    • Deactivate Users
  • Click Save

  • Under the Assignments tab

How to Provision a Team via OKTA

In OKTA, under the TeamRetro Assignments tab you can manage the users and groups in OKTA that will be provisioned for in TeamRetro.
Note:
Users/Groups not assigned to the application will not be provisioned for in TeamRetro.
Note: If after a few minutes the groups created in OKTA don't show in TeamRetro, go to the Push Groups tab and manually push the groups that you want.

Still need help? Contact Us Contact Us