Configure SCIM provisioning in Okta
This procedure explains how to configure system for cross-domain identity management (SCIM) provisioning between Okta and DigiCert® account.
SCIM provisioning allows Okta to automatically create, update, and deactivate users and groups in DigiCert® account. User access is managed through Okta groups and synced using the SCIM protocol.
SCIM provisioning and single sign-on (SSO) are configured using separate Okta applications. If you’re also using SSO, you must configure the SSO and SCIM applications independently.
Before you begin
You need elevated privileges in DigiCert account and Okta:
Account admin user group required in DigiCert account.
Application Administrator or equivalent role required in Okta.
Step 1: Enable SCIM provisioning in DigiCert® account
Before configuring Okta, you must enable SCIM provisioning in DigiCert® account and generate the connection details required by Okta.
In DigiCert® account, select Accounts () > Identity and access.
In the User lifecycle section, select Automated user provisioning with SCIM.
In the Enable users and group sync section, switch to enable SCIM provisioning.
Under SCIM base URL, select Copy.
Select Generate token.
Select how long the token should remain valid.
Select Generate token.
Under Token, select Copy.
Select Done.
Suggerimento
Keep the SCIM base URL and token available. You use them when configuring SCIM in Okta.
Step 2: Create and configure a SCIM application in Okta
Your SSO application in Okta can’t be used to configure SCIM, you must create a separate application for SCIM:
Sign in to your Okta admin dashboard.
Go to Applications > Applications.
Select Create App Integration.
Select Create API Integration.
Select Next.
Open the Provisioning tab.
Select Configure API Integration.
Select the checkbox Enable API integration.
Finish the following fields:
SCIM 2.0 Base URL
Enter the SCIM base URL copied from DigiCert® account in Step 1.4.
OAuth Bearer Token
Enter the token generated in DigiCert® account in Step 1.5.c.
Select the checkbox Import Groups.
Select Test API Credentials.
A success message confirms that the credentials were verified.
Select Save.
Step 3: Enable provisioning actions
When the SCIM application for DigiCert® account is saved, enable the following provisioning actions to allow Okta to manage the full user lifecycle in DigiCert® account.
In the Provisioning to App section, enable the following options:
Create Users
Update User Attributes
Deactivate Users
Select Save.
Step 4 : Assign groups to the SCIM application
User access in DigiCert® account is managed using Okta groups.
Select the Assignments tab.
Select Assign > Assign to Groups.
Select Assign next to the group you want to provision.
Select Save and Go Back.
Repeat the previous three steps for any additional groups.
Select Done.
Suggerimento
If SSO is enabled for DigiCert® account, assign the same user groups to both the SSO application and the SCIM application in Entra for consistency.
Step 5: Push groups to DigiCert® account
To sync group membership:
Select the Push Groups tab.
Select Push Groups > Find groups by name.
In the By name field, enter and select the name of the group you want to push.
Select Save if you’re pushing one group, or Save and Add Another to push multiple groups.
Repeat the previous two steps for any additional groups.
Suggerimento
The Push Status column should change from Pushing to Active within seconds.
Step 6: Verify provisioning in Okta
You can verify users and groups in Okta from the Assignments tab:
Select People to view assigned users.
Select Groups to view assigned groups.
Step 7: Verify provisioning in DigiCert® account
Users and groups you’ve assigned in step 6 should also show in your DigiCert account, if the SCIM application in Okta has a Push Status of Active:
In DigiCert® account, select Access ().
Select Users to view a consolidated list of all your users, this includes manually created users and users provisioned through SCIM.
Select Groups to view a consolidated list of groups:
The Managed by column displays
DigiCertfor default DigiCert groups.The Managed by column displays
Identity providerfor groups provided by your IdP.
Step 8: Assign roles to groups in DigiCert® account
Users in the IdP group are assigned the roles that you define in DigiCert account.
Attenzione
If a user was manually assigned user roles before SCIM, to prevent breaking existing workflows, these roles remain, in addition to the roles assigned to the SCIM group. To solely rely on SCIM groups for user role management, manually remove user roles.
In DigiCert® account, select Access ().
Select Groups to assign user roles:
Select the name of a SCIM group.
The Managed by column shows
Identity providerfor groups provided by your IdP.Select Group access.
Select Update group access.
In the Services field, select the checkbox next to all the DigiCert Service this user group should have access to.
In the User roles section of each service, select the check box of the user roles that this user group should have.
Select Assign access.