You can configure SCIM provisioning between Okta and Haiilo to import your users and groups from Okta. 

These instructions are for reference only. When implementing SCIM, it's important to consider your organization's specific policies and best practices. These instructions focus on configuring SCIM on Okta's side and include Okta-specific details that are current at the time of writing. We suggest reviewing Okta's documentation on SCIM provisioning for more information.

Prerequisites

Before you begin, make sure you have:

• A reachable SCIM base URL, for example, https://example.haiilo.app/api/scim/v2.
• "Manage user directories" permission in your Haiilo platform.
• Administrative permissions in Okta to create and configure applications.

1. Start setting up a SCIM user directory on Haiilo

You need the "Manage user directories" permission on Haiilo to set up a user directory.

1. Go to Administration > User directories.
2. Select Create user directory to add a new user directory.
3. Enter a name.
4. Choose SCIM as the directory type.
5. Activate the directory.
6. In the API Clients tab, select Create to create an API client pair.
7. Copy and save the Client ID and Client Secret for later use. The client secret is generated only after saving and is only visible once.
8. Select Save to save the user directory. 

2. Create an application on Okta

You need administrative permissions in Okta to set up SCIM.

1. Log in to your Okta platform.
2. Go to Applications > Applications.
3. Select Create App Integration.
4. Select SAML 2.0 > Next.
5. Enter a name and, optionally, upload a logo for the app.
6. Enter placeholder values for Single sign-on URL and Audience URI (SP Entity ID). These values aren't used for SCIM provisioning. Leave everything else untouched.
7. Select Next.
8. Keep the default settings and select Finish to create the app.
9. Open the General tab.
10. Select Edit under App Settings.
11. Change the provisioning setting to SCIM.
12. Select Save.

3. Configure a provisioning connection on Okta

1. In your Okta app, go to Provisioning > Integration.
2. In SCIM connector base URL, enter your SCIM base URL. The URL ends with /api/scim/v2. For example, https://example.haiilo.app/api/scim/v2.
3. In Unique identifier field for users, enter userName.
4. Under Supported provisioning actions, select:
   • Push New Users: Creates users in Haiilo.
   • Push Profile Updates: Updates user information in Haiilo.
   • Push Groups: Sends selected groups and their membership information to Haiilo.
5. Under Authentication Mode, select OAuth 2.
6. Under Grant Type, select Client Credentials.
7. In Access token endpoint URI, enter your OAuth token endpoint. The URL ends with /api/oauth/token. For example, https://example.haiilo.app/api/oauth/token.
8. Enter the Client ID you copied from Haiilo.
9. Enter the Client Secret you copied from Haiilo.
10. Select Save.
11. Stay on the Provisioning tab and open To App.
12. Enable:
    • Create Users: Creates assigned users in Haiilo.
    • Update User Attributes: Updates the attributes of provisioned users in Haiilo.
    • Deactivate Users: Deactivates users in Haiilo when they are deprovisioned in Okta.
13. Select Save.

4. Assign users and groups on Okta

1. In your Okta app, go to Assignments.
2. Select Assign.
3. Choose whether to assign people or groups.
4. Select the people or groups you want Okta to provision into Haiilo.
5. Select Assign next to each person or group.

5. Configure group provisioning on Okta

1. Go to the Push Groups tab.
2. Select Push Groups.
3. Choose an option:
   • Find groups by name: Search for an existing Okta group by its name.
   • Find groups by rule: Define which groups to push using a rule.
4. Enter a group name.
5. Select the group you want to synchronize.
6. Select Save or Save & Add another.

After saving, Okta automatically starts synchronizing the group to Haiilo.

Troubleshooting

If a user or group isn't synchronized as expected:

• Check the provisioning logs in Okta for errors.
• Confirm that the user or group is assigned to the application.
• Confirm that the group is configured on the Push Groups tab.

Please contact our Support team for assistance only after reviewing the above tips.