Okta SCIM Integration
Last updated
Last updated
SCIM (System for Cross-domain Identity Management) is an open standard for automating the management of user and group membership.
This document walks you through setting up SCIM-based users and groups with Okta.
Find Okta's documentation for these steps at
DeltaStream's SCIM integration automates adding/removing from your and leveraging Okta groups to grant access to DeltaStream .
There are two types of groups within Okta:
Assignment groups manage . Users added to the assignment group are automatically added to DeltaStream but are not assigned any custom roles.
Push Groups enable Okta to to DeltaStream. These groups are mapped to within DeltaStream.
You cannot use Push groups to control access to built-in roles. Instead, use a custom user attribute and a dedicated Assignment group to achieve orgadmin role membership.
Custom roles created using Push groups are not automatically granted any privileges. Privileges must be granted to the roles with MANAGE_GRANTS privilege (by default,,orgadmin or securityadmin).
Set up Okta .
This section describes how to enable SCIM provisioning on an app integration. Additional configuration will be added in subsequent sections.
Click to activate the General tab, then click Edit for the App Settings.
Select Enable SCIM provisioning and then click Save.
This section describes how to create a new custom attribute you use to specify who should have access to the OrgAdmin built-in role.
In the lefthand navigation, go to Directory -> Profile Editor.
Click DeltaStream Users.
Click Add Attribute.
Create a new boolean attribute with the following values:
Data type
boolean
Display name
DeltaStream OrgAdmin
Variable name
deltastreamOrgadmin
External name
deltastreamOrgadmin
External namespace
urn:ietf:params:scim:schemas:core:2.0:User
This section describes how to create a new assignment group for OrgAdmins. Any users assigned to this group are granted the OrgAdmin role in DeltaStream.
In the lefthand navigation go to Directory -> Groups and then click Add group.
Name the group DeltaStream OrgAdmins and then click Save.
Click the newly-created group to configure it.
Click the Applications tab to activate it and then click Assign applications.
Assign the DeltaStream application.
Verify the DeltaStream OrgAdmin attribute is set to true. Then click Save and Go Back.
This section describes how to create a new assignment group for non-privileged users.
In the lefthand navigation, go to Directory -> Groups and then click Add group.
Name the group DeltaStream Users and click Save.
Click the newly-created group to co nfigure it.
Click the Applications tab to activate it, and then click Assign applications.
Assign the DeltaStream application and then click Save.
In the lefthand navigation, go to Application -> Applications -> Deltastream.
Click to activate the Assignments tab.
Filter by Groups.
Click the DeltaStream OrgAdmins group.
Click Assign people and then select the individuals you wish to assign as OrgAdmins.
From the lefthand navigation to Application -> Applications -> Deltastream.
Click to activate the Assignments tab.
Filter by Groups.
Click the DeltaStream Users group.
Click Assign people and select the individuals you wish to have access to DeltaStream.
This section describes how to configure the SCIM integration URI and token so that Okta can push information to DeltaStream.
Log into DeltaStream and create a new SCIM security integration using the CREATE SECURITY INTEGRATION command:
From the lefthand navigation go to the Applications menu and click the DeltaStream application:
Click the Provisioning tab to activate it, then click edit:
Copy the URI from the security integration setup in step 1 to the SCIM connector base URL.
Enter email for Unique identifier field for users.
Check the following checkboxes:
Import New Users and Profile Updates
Push New Users
Push Profile Updates
Push Groups.
Finally, for Authentication Mode click HTTP Header. Then copy the token from the security integration setup in step (1) into the Authorization Bearer box. Click Save to complete the initial setup.
Click the Provisioning tab to activate it, and in the Provisioning to App settings, click Edit.
Check the corresponding checkboxes for Enable Create Users Update User Attributes and Deactivate Users.
Click Save.
Before you begin, ensure that everyone who needs access to DeltaStream has been added either to the DeltaStream Users or the DeltaStream OrgAdmins assignment groups.
From the lefthand navigation, go to Application -> Applications -> Deltastream.
Click the Push Groups tab to activate it.
Click + Push Groups to search for and select a group to push.
2. Click Find groups by name.
Enter the name of the group you wish to push -- for example, development.
Click Push group memberships immediately.
Click Save.
This creates a role with the same name as the group in DeltaStream. Anyone who is part of the group is also assigned this role.
