Configuration

Configuring Okta Endpoint to Work with SCIM Connector

The following steps are required to configure Okta for use as a SCIM Endpoint for the Secret Server SCIM Connector application. They are in addition to making a SCIM Endpoint connection within the SCIM Connector application.

By default, there are two fields in Okta (the First Name and Last Name fields) that are marked as mandatory and used to identify users.

However, the Secret Server SCIM Connector application uses the primary email value to identify users. If the SCIM connector uses the SCIM standard to request user values, it passes blank values for these two fields resulting in data request or importation failure.

To allow Okta and SCIM Connector to communicate successfully, map the Username and Last name fields with the Display Name field when importing data from Secret Server.

Secret Server does not support the First Name and Last Name defined attribute so the user needs to map the First Name and Last Name fields with the Display Name field or a default value for the two fields can be provided.

SCIM Connector is an API application that receives API requests in the sequence Okta sends them and cannot change the API sequence. By default, SCIM Connector does not work with disabled user accounts. You can manually modify the Secret Server report scripts. For details, see FAQ

Mapping the Fields to display in Okta

To map Firstname and Lastname fields with Display name in Okta:

  1. Open the application created in Okta and click the Provisioning tab.

  2. Select To Okta under Settings.

    alt

  3. Scroll down to Okta Attribute Mapping.

    alt

  4. Select the Edit icon for the First name field and the updated attribute value will display.

    alt

  5. Change the value to displayName instead of givenName and click Save.

    alt

  6. Follow the same instructions for the LastName field and change the value to displayName and click Save.

    alt

  7. Once completed, go to the Import menu, and click Import Now.

    alt

  8. When completed, assign the imported user on the left to the Okta user on the right.

    alt

  9. Select the check box to import users to Okta.

    alt

  10. Click Confirm Assignments.

    alt

  11. Click Confirm.

    alt

  12. To verify that the user has been added to Okta, click on People in the Directory. The user should have been added to the list.

    alt

When you update an existing username in Okta (e.g., from abc.xyz@gmail.com to Abc.Xyz@gmail.com) and push the change into SecretServer, Okta will send a POST request to create a new user if the original user is disabled in SecretServer. Since SecretServer is not case-sensitive regarding usernames, if the names differ only by case, it will treat both versions as the same name, causing a duplication error.