Skip to main content

Configure SCIM 2.0 with Okta

Support
Updated

Topics included in this article:

Prerequisites

  • Provisioning may not be possible unless you've purchased it with/on your Okta plan.
  • The Single Sign-On setup must be completed prior to this SCIM setup.
  • A Rhombus API token. 

 

Rhombus API Token

1. Navigate to "Settings" in the Rhombus Console, and select "Single Sign-On."

 

2. Select the "SCIM" dropdown, and click "Setup."

 

3. Copy the token, and save it for the Okta Configuration section. This token will only be shown once, so ensure you copy and save it.

 

Okta Configuration

1. Navigate to "Applications," and select the "Provisioning" tab at the top of the Rhombus Systems application you created in the Setting up SSO with Okta article.

 

2. Click "Configure API Integration." 

 

3. Click the checkbox labeled "Enable API," and the "API Token" field will appear. Paste the API token generated from the Rhombus Console and click "Test API Credentials." Click "Save."

 

4. Within the provisioning window of the Rhombus Systems app, select "To App" on the left side. Click "Edit," and enable "Create Users," "Update User Attributes," and "Deactivate Users." Click "Save."

 

5. Scroll down and click "Force Sync."

 

6. The Rhombus Systems app should now show "Active."

 

Add a User

1. To add a user, navigate to the "Assignments" tab in Okta and select "Assign." Click "Assign to People."  

 

2. From the list, select "Assign" beside the individual you want to add. Ensure their details are accurate, and click "Add Another" next to "roles."

 

3. Type in the role exactly how it appears in the Rhombus Console. Only add roles that are currently in the Rhombus Console. 

 

Role Requirements

The “roles” group attribute should be present unless "Add Users on Role Mismatch" is enabled on the Rhombus Console. 

 

Provisioning Features

The Okta / Rhombus SCIM integration currently supports the following provisioning features:

  • Create Users: Users created in Okta will automatically be provisioned in Rhombus.
  • Update User Attributes: Changes to the user profile in Okta will be pushed to Rhombus.
  • Deactivate Users: Users deactivated in Okta will be deleted from Rhombus.
  • Reactivate Users: Users reactivated in Okta will be provisioned in Rhombus.
  • Import users: Users in Rhombus can be imported into Okta.

 

User Attributes

The following Okta user attributes will be synchronized to Rhombus:

  • First Name
  • Last Name
  • Roles

 

Creating a Group

1. With Okta, we can also create group-based provisioning based on roles created within the Rhombus Console. If you don't have groups, create a group by clicking "Add Group."

Create

 

2. Click a group, select "Applications," and assign the Rhombus Systems application.

assign

 

3. Click the pencil icon to edit this group's role. 

Screenshot

 

4. The role must match the role this group's users have within the Rhombus Console. Users can currently only have one role within the Rhombus Console. Once this is done, click "Save." 

Note: The role will not be assigned if there is a typo or a missing character. 

assign

 

5. Once the group is created with an assigned role, people can be assigned to it. Within a group, select "People," "Assign People," and hit the "+" sign next to the users you wish to add.

assign

 

6. You can also automatically assign the same role to groups whenever they are created or assigned to the Rhombus application. 

Inside the Rhombus app in Okta, select "Provisioning," and "To App." Scroll to the bottom, and you will see the "roles" mapping field. Click the pencil icon and type in the role you wish new groups to default to. If left blank, no role will be automatically assigned.

standard

 

Troubleshooting

  • When users are deactivated in Okta they will be deleted from Rhombus for security measures. As Okta does not support delete requests, Rhombus will delete user accounts when Okta reports a user status update changing active=false.
  • Primary Email is only used for importing users from Rhombus and is not used for pushing user updates.
  • Updating Usernames for Users is not supported by Rhombus.
  • Even though Okta allows multiple Roles to be assigned to a user, Rhombus will only use a single role. We will use the first matching role when new users are pushed.
  • Users with empty First/Last names cannot be imported into Okta as Okta requires both parameters to be present.

 

Helpful Links

Contact Support or Sales

Have more questions? Contact Rhombus Support at +1 (877) 746-6797 option 2 or support@rhombus.com.

Interested in learning more? Contact Rhombus Sales at +1 (877) 746-6797 option 1 or sales@rhombus.com.

Related articles

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk