This guide covers steps to configure provisioning for Robin using Okta’s connector App.
Requirements
- Advanced Authentication + User Management
- Administrator access in Robin
- Active Okta account
Features
Robin supports the following provisioning features:
- Push New Users: New users created through Okta will also be created in Robin.
- Push Groups: Groups created through Okta will also be created in Robin.
- Push Profile Updates: Updates made to the user's profile through Okta will be pushed to Robin.
- Push User Deactivation: Deactivating the user or disabling the user's access to the application through Okta will deactivate the user in Robin.
- Import New Users: New users created in Robin will be downloaded and turned in to new AppUser objects, for matching against existing Okta users.
- Import Profile Updates: Updates made to a users profile in Robin will be downloaded and applied to the profile fields stored locally in Okta.
- Reactivate Users: User accounts can be reactivated in the application.
Robin has the following restrictions for provisioning:
- Syncing Passwords is not supported
Prerequisites
The following attributes are required as part of your Okta configuration:
- `userName`
- `familyName`
- `givenName`
- `email`
Optional attributes
- `department`
Already have SAML enabled?
If you're setting up a new instance of Robin in Okta, such as adding SCIM, make sure to select ‘email’ when mapping the email SAML attribute. This is necessary to avoid creating duplicate accounts for users already added to Robin through SAML. You can do this within Okta from Applications > General > App settings > Email attribute value. This should be selected by default.
Configuration Steps
To configure your provisioning settings, you'll need to have administrator permissions and access to the Robin web dashboard. You'll also need to have access to OKTA's OIN manager.
Generate a token in Robin
- 1
- From the web dashboard, navigate to Manage > Integrations > SCIM Provisioning, then click “Manage”.
- 2
- From the SCIM Integration page, generate a SCIM token. Copy this token and head over to Okta's management portal to complete the set up.
- 3
- In a new browser tab, open the Okta management portal and add the Robin application.
- 4
- Under Provisioning tab > Settings > API Integration, input the access token copied from Robin and click "Save".
- 5
- Select the provisioning features you want to enable. When finished, click "Save". You can now assign people to the app.
Optional: To sync the department attribute, create a new attribute mapping for department and set the External namespace to urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
Then, set the mapping for the new attribute:
Troubleshooting
In order to activate the Push Groups feature on the existing application instances in Okta, you need to re-enable provisioning.
Open the Provisioning application tab > select API integration > click Edit, then click the Save button.