Configure SCIM provisioning in Okta
This procedure explains how to configure System for Cross-domain Identity Management (SCIM) provisioning between Okta and DigiCert® account.
SCIM provisioning allows Okta to automatically create, update, and deactivate users and groups in DigiCert® account. User access is managed through Okta groups and synchronized using the SCIM protocol.
SCIM provisioning and single sign-on (SSO) are configured using separate Okta applications. If you are also using SSO, you must configure the SSO and SCIM applications independently.
Before you begin
You need elevated privileges in DigiCert account and Okta:
Account admin user group required in DigiCert account.
Application Administrator or equivalent role required in Okta.
Step 1: Enable SCIM provisioning in DigiCert® account
Before configuring Okta, you must enable SCIM provisioning in DigiCert® account and generate the connection details required by Okta.
In DigiCert® account, select Accounts () > Identity and access.
In the User lifecycle section, select Automated user provisioning with SCIM.
In the Enable users and group sync section, switch to enable SCIM provisioning.
Under SCIM base URL, select Copy.
Select Generate token.
Select how long the token should remain valid.
Select Generate token.
Under Token, select Copy.
Select Done.
Tip
Keep the SCIM base URL and token available. You will use them when configuring SCIM in Okta.
Step 2: Create and configure a SCIM application in Okta
Your SSO application in Okta cannot be used to configure SCIM, you must create a separate application for SCIM:
Sign in to your Okta admin dashboard.
Go to Applications > Applications.
Select Create App Integration.
Select Create API Integration.
Select Next.
Open the Provisioning tab.
Select Configure API Integration.
Select the checkbox Enable API integration.
Complete the following fields:
SCIM 2.0 Base URL
Paste the SCIM base URL copied from DigiCert® account in Step 1.4.
OAuth Bearer Token
Paste the token generated in DigiCert® account in Step 1.5.c.
Select the checkbox Import Groups.
Select Test API Credentials.
A success message confirms that the credentials were verified.
Select Save.
Step 3: Enable provisioning actions
Once the SCIM application for DigiCert® account is saved, enable the following provisioning actions to allow Okta to manage the full user lifecycle in DigiCert® account.
In the Provisioning to App section, enable the following options:
Create Users
Update User Attributes
Deactivate Users
Select Save.
Step 4 : Assign groups to the SCIM application
User access in DigiCert® account is managed using Okta groups.
Select the Assignments tab.
Select Assign > Assign to Groups.
Select Assign next to the group you want to provision.
Select Save and Go Back.
Repeat the previous three steps for any additional groups.
Select Done.
Tip
If SSO is enabled for DigiCert® account, assign the same user groups to both the SSO application and the SCIM application in Okta to keep access consistent.
Step 5: Push groups to DigiCert® account
To synchronize group membership:
Select the Push Groups tab.
Select Push Groups > Find groups by name.
In the By name field, enter and select the name of the group you want to push.
Select Save if you are pushing one group, or Save and Add Another to push multiple groups.
Repeat the previous two steps for any additional groups.
Tip
The Push Status column should change from Pushing to Active within seconds.
Step 6: Verify provisioning in Okta
You can verify users and groups in Okta from the Assignments tab:
Select People to view assigned users.
Select Groups to view assigned groups.
Step 7: Verify provisioning in DigiCert® account
The people and groups you have identified in step 6 should also show in your DigiCert account, provided that the SCIM application in Okta has a Push Status of Active:
In DigiCert® account, select Access ().
Select Users to view a consolidated list of all your users, this includes manually created users and users provisioned through SCIM.
Select Groups to view a consolidated list of groups:
The Source column displays
Platformfor default DigiCert groups.The Source column displays
SCIMfor groups provided by your IdP.