SCIM Setup in Okta

Prerequisites

Before you start, do the following:

• Learn about the SCIM configuration process in Configuring SCIM.
• Configure single sign-on (SSO) with Okta as an identity provider (IdP). For instructions, see SSO with Okta.
• Obtain a long-lived access token through the MTM API. For instructions, see Obtaining a Long-Lived Access Token.

Configuring User Provisioning

Follow these steps:

1. In the Okta admin dashboard, in the Applications section, select the SSO application for SAP LeanIX.

2. On the General tab, in the App Settings section, click Edit, then select SCIM against Provisioning. Save the changes.

   

3. If you've previously created the role attribute, in the Profile Editor section, delete the attribute and then recreate it with the following External namespace value. Save the changes. The update might take some time. To verify that the property update has been completed, check a sample user assignment for their role inheritance.

   External namespace

   urn:ietf:params:scim:schemas:extension:workspacePermission:2.0:User
   

   

4. On the SSO application page, navigate to the Provisioning tab. In the Integration section, click Edit against SCIM Connection and specify the following details. Save the changes.

   Parameter	Value
   SCIM connector base URL	https://{SUBDOMAIN}.leanix.net/services/mtm/v1/scim/v2
   Unique identifier field for users	userName
   Supported provisioning actions	- Import New Users and Profile Updates - Push New Users - Push Profile Updates
   Authentication Mode	HTTP Header
   Authorization	Long-lived access token that you obtained

   

5. On the Provisioning tab, in the To App section, enable the following options:

   • Create Users
   • Update User Attributes
   • Deactivate Users

   Save the changes.

   

6. To configure attribute mappings, scroll down to the Attribute Mappings section. The following attributes are mandatory for SCIM:

   • Username
   • Given name
   • Family name
   • Email
   • Primary email type
   • role: This attribute is only relevant for customers using an external IdP for SSO.

   

SCIM with Okta is set up. User states should be synchronized between the systems.