1. Robin Help Center
  2. Users, settings & security
  3. SCIM provisioning

SCIM provisioning using Okta's connector app

Updated

Set up SCIM provisioning for Robin with Okta's connector app.

Requirements

  • Advanced Authentication + User Management
  • Administrator access in Robin
  • Active Okta account

Supported provisioning features

Robin supports these provisioning features:

  • Push New Users: When you create a user in Okta, Robin creates the user too.
  • Push Groups: When you create a group in Okta, Robin creates the group too.
  • Push Profile Updates: When you update a user's profile in Okta, Okta pushes the changes to Robin.
  • Push User Deactivation: When you deactivate a user in Okta, or turn off the user's access to the application, Robin deactivates the user.
  • Import New Users: Okta downloads new users created in Robin and turns them into new AppUser objects, to match them against existing Okta users.
  • Import Profile Updates: Okta downloads changes to a user's profile in Robin and applies them to the profile fields stored in Okta.
  • Reactivate Users: You can reactivate user accounts in the application.

Robin does not support password syncing.

Prerequisites

Robin requires only one attribute: a primary email. Okta maps these attributes by default. Robin recommends that you keep them:

  • userName
  • familyName
  • givenName
  • email

These attributes are Optional:

  • department
  • costCenter
  • division
  • employeeNumber
  • locale
  • title
  • manager
  • preferredLanguage

You set optional attributes with 2 different schemas, Core and Enterprise:

  • To sync the title, locale or preferredLanguage attributes, create a new attribute mapping and set the External namespace to urn:ietf:params:scim:schemas:core:2.0:User.
  • To sync the department, costCenter, division, employeeNumber or manager attributes, create a new attribute mapping and set the External namespace to urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.

For example, to sync the department field, add a new attribute and set the mapping as the user profile mapping example shows.

Already have SAML turned on?

If you set up a new instance of Robin in Okta, for example to add SCIM, select ‘email’ when you map the email SAML attribute. This avoids duplicate accounts for users that SAML already added to Robin. In Okta, go to Applications > General > App settings > Email attribute value. Choose Email, not Username. Email should be selected by default.

Set up SCIM provisioning in Okta

To set up provisioning, you need administrator permissions and access to the Robin web dashboard. You also need admin access to your Okta org.

Generate a SCIM token in Robin

Okta uses this token to connect to Robin.

  1. In the web dashboard, go to Manage > Integrations.
  2. Under Add Connectors, search for Okta and select Set up. If Okta is already in the Installed list, select Manage. The Okta page opens.
  3. In the Directory provisioning card, select Generate SCIM token. The SCIM Provisioning page opens. You can also open this page from the SCIM provisioning tile.
  4. Select Generate Token for SCIM.
  5. Copy the token. Robin shows the token only once.

Add the token in Okta

Add the Robin app in Okta and turn on provisioning with the token.

  1. In a new browser tab, open the Okta Admin Console.
  2. Go to Applications, search the app catalog for Robin, and select Add.
  3. In the Robin app, open the Provisioning tab and select API Integration.
  4. Select Enable API integration.
  5. Paste the token into API Token. To check the token first, select Test API Credentials.
  6. Select Save.
  7. Under Provisioning > To App, select Edit.
  8. Turn on the provisioning features you want, such as Create Users, Update User Attributes and Deactivate Users.
  9. Select Save.

You can then assign people to the app.

Sync the department attribute (optional)

To sync the department attribute, create a new attribute for department:

  1. In the Okta Admin Console, go to Directory > Profile Editor.
  2. Open the Robin User profile and select Add Attribute.
  3. Set the External namespace to urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.
  4. Map user.department to department, as the user profile mapping example shows.

User profile mapping fields

This example shows the mappings on the Okta User to Robin tab of the Robin user profile mappings. Each Okta value maps to a Robin attribute:

Okta value Robin attribute
user.firstName givenName
user.lastName familyName
user.email email
An expression that returns 'work' when user.email is not empty emailType
user.displayName displayName
user.department department

Robin sets userName.

Sync managers

To sync managers into Robin, add the manager attribute to the mappings. Its value must match the manager's externalId in Okta.

For example, User A has the Okta ID 00ux4tqjtye2qJJGq697, and User B has the Okta ID 00ux4u0o95rupibGT851. To make User A the manager of User B, set the manager field of User B to 00ux4tqjtye2qJJGq697. This value is User A’s Okta ID.

Okta must send each user’s Okta ID as externalId. The manager must also be provisioned to Robin through SCIM, in the same Robin organization.

Robin links managers every 3 hours. It links only people whose record changed since the previous evening. If you add the manager later, change any attribute on the employee so your identity provider sends an update. Robin then links the manager.

You find the Okta ID in the URL of the user’s profile in Okta.

If the Robin User profile has no manager attribute, add one in Profile Editor with data type string, display name and external name manager, and external namespace urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.

Troubleshooting

To turn on the Push Groups feature on existing application instances in Okta, turn on provisioning again:

  1. Open the Provisioning application tab.
  2. Select Integration, then select Edit.
  3. Make sure Enable API integration is selected, then select Save.

Articles in this section

Was this article helpful?
0 out of 6 found this helpful
Share