Set up SCIM with Okta

Prerequisites

• An Okta instance exists and manages your users.
• An existing Okta application is set up with Unity SSO.

1. Configure a service account

2. Fetch the SCIM connector URL for your organization

1. On a new tab, go to the Unity Dashboard.
2. Switch to the organization for which you want to set up SCIM.
3. Go to Administration > SSO & SCIM.
4. On the SCIM Provisioning & Enforcement tab, under step 2, Configure SCIM Provisioning, copy the SCIM base connector URL from the Unity card.
   Your IdP service requires this information.

3. In Okta, turn on SCIM for the provisioning of users

1. On a new tab, sign in to your Okta admin instance with an admin account.
2. Go to Applications > Applications, and then select your Unity SSO application.
3. On the General tab, select Edit next to App Settings.
4. Turn on SCIM for the provisioning of users, and then select Save.
5. In Okta, go to the Provisioning tab.
6. In the Integration section, select Edit next to SCIM Connection.
7. Set this configuration:
   • SCIM base connector URL: the value that you have copied from Unity Cloud
   • Unique identifier field for users:

     email

   • Supported provisioning actions:

     Push New Users

     and

     Push Profile Updates

   • Authentication mode:

     Basic Auth

   • Username: the ID of the key that you have generated for the service account
   • Password: the secret of the key that you have generated for the service account
8. Select Save.
   Okta verifies the setup and informs you of any errors.

4. In Okta, set up the provisioning of users through SCIM

1. In Okta, go to the To App settings page.
2. On the Provisioning tab, select Edit next to Provisioning to App.
3. Turn on these provisioning actions:
   • Create users
   • Update user attributes
   • Deactivate users
4. Select Save.
5. In the Attribute Mappings section, set these attributes:
   • userName: set this attribute to the user's primary email address that is set in the sign-on settings.
   • givenName: enter

     user.firstName

     . You'll include this variable in the displayName expression.
   • familyName: enter

     user.lastName

     . You'll include this variable in the displayName expression.
   • displayName: enter this expression:

     user.firstName \+ " " \+ user.lastName

     Okta doesn't accept smart quotes. If you can't paste the quotes, enter them.
   • locale: enter

     user.locale

     .
   • email: enter

     user.email

     . The userName attribute uses the email attribute.
   Set all these attributes so that Okta applies their mapping for the creation or update of a user profile in Unity.
   注

   Unity syncs only these attributes. If you add other attributes, Unity doesn't sync them.
6. On the Sign On tab, in the Credentials Details section, verify that Update application username on is set to

   Create and update

   .

5. Select Okta users for automated provisioning

1. In Okta, go to the Assignments tab.
2. Select the users for whom you want to automate provisioning in Unity. Select the users individually or select a user group.
   When you select users, Unity automatically provisions them.
3. To provision these users, select Provision User.
   注

   If you've added users to this Unity application in your Okta setup before configuring SCIM, Okta doesn't provision them and shows a notification.
4. To provision these non-provisioned users, use one of these methods:
   • To provision users individually, select Provision User next to a user.
   • To provision all non-provisioned users, select Sync All in the Okta notification.

6. Enable SCIM in Unity

Next steps