Skip to content
English
  • There are no suggestions because the search field is empty.

SCIM Set-up Guide for Okta

Get your SCIM credentials from Nitro

  1. Sign in to the Nitro Admin App
  2. Go to Settings
  3. Navigate to the SSO & Provisioning tab
  4. Go to the Provisioning via SCIM sectiona0003887-8b82-4424-9f15-377630b58118
  5. Click the Edit SCIM Provisioning button
  6. Select Enable SCIM Provisioning
  7. Click Save
  8. Click Generate SCIM Token
  9. Copy and save the SCIM Base URL and the API Token
  10. Click Done9f94035e-76c3-4c16-adcd-c44fc3136bcb

Notes:

  • The token can only be viewed once. After you leave the SSO & Provisioning section, it won’t be accessible again.
  • If you lose the token, it can be revoked and a new one can be generated.
  • SCIM API tokens expire one year from the date they are generated, so make sure to update them regularly to avoid service interruptions.

To generate a new token:

  • Click Edit SCIM Provisioning
  • Then click Revoke Token19c0fd46-b64a-438f-87fe-6f7d38b94a4c
  • You can then generate a new token by clicking Generate SCIM Token as in the steps above.

​Configure SCIM in Okta Workforce for SAML Apps

  1. Open your Okta Workforce Identity SAML application
  2. Navigate to the General tab
  3. Click Edit in the upper-right corner of the App Settings section
  4. In the Provisioning section, select SCIM
  5. Click Save16c3369b-0f9f-44f9-9122-f608c7ea2565
  6. Still on the General tab, scroll down to the Federated Broker Mode section, and confirm that Federation Broker Mode is disablede51e3434-fecd-4791-b9d1-5938bff225fb
  7. Navigate to the Provisioning tab
  8. Go to the Integration tab
  9. Select Edit
  10. Paste the SCIM Endpoint URL value you copied earlier
  11. In the Unique identifier field for users, enter userName
  12. In Supported provisioning actions, select Push New Users and Push Profile Updates
  13. Choose HTTP Header as the Authentication Mode
  14. Paste the SCIM token into the Authorization field
  15. Click Test Connection Configuration to verify the connection before saving
  16. Click Save51d526b2-005d-46f3-a1b1-1e3a984abcc8
  17. Next, configure provisioning actions. Browse to Provisioning > Settings > To App and click Edit
  18. Click Enable for:
    1. Create Users
    2. Update User Attributes
    3. Deactivate Users
  19. Click Save58be4b5a-3d93-4938-986a-7e8bfa251ed9
  20. Under the Attribute Mappings section, use the X button to delete the following rows. These default mappings conflict with Nitro's SCIM implementation and must be removed:

Attribute

 

Value

 

Primary email type

(user.email != null && user.email != '') ? 'work' : ‘'

Primary phone type

(user.primaryPhone != null && user.primaryPhone != '') ? 'work' : ‘'

Address type

(user.streetAddress != null && user.streetAddress != '') ? 'work' : ‘'

 Testing

You can now test user provisioning in the Assignments tab, and verify update operations by editing user attributes in Directory > People.

Notes:

Provisioning existing users

If users already existed in Nitro before you set up SCIM, you will need to sync them. Assign them to the Nitro application in Okta and they will be provisioned immediately.

Automatic provisioning

Once SCIM is configured, provisioning is always active. Any user assigned to the Nitro application will be provisioned immediately.