Okta SCIM Integration
Last updated
Last updated
SCIM (System for Cross-domain Identity Management) is an open standard for automating the management of user and group membership.
This document walks you through setting up SCIM-based users and groups with Okta.
Find Okta's documentation for these steps at
DeltaStream's SCIM integration automates adding/removing from your and leveraging Okta groups to grant access to DeltaStream .
There are two types of groups within Okta:
Assignment groups manage . Users added to the assignment group are automatically added to DeltaStream but are not assigned any custom roles.
Push Groups enable Okta to to DeltaStream. These groups are mapped to within DeltaStream.
You cannot use Push groups to control access to built-in roles. Instead, use a custom user attribute and a dedicated Assignment group to achieve orgadmin role membership.
Custom roles created using Push groups are not automatically granted any privileges. You must grant privileges to the roles with MANAGE_GRANTS privilege (by default, orgadmin or securityadmin).
Set up Okta .
This section describes how to enable SCIM provisioning on an app integration. Additional configuration is added in subsequent sections.
Click to activate the General tab, and in the App Settings box click Edit.
Check Enable SCIM provisioning and then click Save.
This section describes how to create a new custom attribute you use to specify who should have access to the OrgAdmin built-in role.
In the lefthand navigation, go to Directory > Profile Editor.
Click DeltaStream Users.
Click Add Attribute.
Create a new boolean attribute with the following values:
Data type
boolean
Display name
DeltaStream OrgAdmin
Variable name
deltastreamOrgadmin
External name
deltastreamOrgadmin
External namespace
urn:ietf:params:scim:schemas:core:2.0:User
Verify that the Attribute Type is set to Group.
This section describes how to create a new assignment group for OrgAdmins. Any users assigned to this group are granted the OrgAdmin role in DeltaStream.
In the lefthand navigation go to Directory -> Groups and then click Add group.
Name the group DeltaStream OrgAdmins and then click Save.
Click the newly-created group to configure it.
Click the Applications tab to activate it and then click Assign applications.
Assign the DeltaStream application.
Verify the DeltaStream OrgAdmin attribute is set to true. Then click Save and Go Back.
This section describes how to create a new assignment group for non-privileged users.
In the lefthand navigation, go to Directory > Groups and then click Add group.
Name the group DeltaStream Users and click Save.
Click the newly-created group to configure it.
Click the Applications tab to activate it, and then click Assign applications.
Assign the DeltaStream application and then click Save.
In the lefthand navigation, go to Application > Applications > Deltastream.
Click to activate the Assignments tab.
Filter by Groups.
Click the DeltaStream OrgAdmins group.
Click Assign people and then select the individuals you wish to assign as OrgAdmins.
From the lefthand navigation to Application > Applications > Deltastream.
Click to activate the Assignments tab.
Filter by Groups.
Click the DeltaStream Users group.
Click Assign people and select the individuals you wish to have access to DeltaStream.
This section describes how to configure the SCIM integration URI and token so that Okta can push information to DeltaStream.
In the top toolbar, change the role to orgadmin.
Save the URI and token for later use. This security integration expires after 1 year.
In your Okta dashboard, in the lefthand navigation click Applications and then click the DeltaStream application:
Click the Provisioning tab to activate it, then click edit:
Copy the URI from the security integration setup in step 1 to the SCIM connector base URL.
Enter email for unique identifier field for users.
Check the following:
Import New Users and Profile Updates
Push New Users
Push Profile Updates
Push Groups
For Authentication Mode, click HTTP Header. Then copy the token from the security integration setup in step (1) and paste it into the Authorization Bearer box. Then click Save.
Click the Provisioning tab to activate it, and in the Provisioning to App settings, click Edit.
Check the following:
Create Users
Update User Attributes
Deactivate Users
Click Save.
Before you begin, ensure that everyone who needs access to DeltaStream has been added either to the DeltaStream Users or the DeltaStream OrgAdmins assignment groups.
From the lefthand navigation, go to Application > Applications > Deltastream.
Click the Push Groups tab to activate it.
Click + Push Groups to search for and select a group to push.
2. Click Find groups by name.
Enter the name of the group you wish to push -- for example, development.
Click Push group memberships immediately.
Click Save.
This creates a role with the same name as the group in DeltaStream. Anyone who is part of the group is also assigned this role.
In the lefthand navigation click Integration ( ). Then click Security Integration.
