Skip to content

Instantly share code, notes, and snippets.

@aaronhipple

aaronhipple/config-guide.md Secret

Last active June 23, 2020 19:11
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save aaronhipple/f20552edc8c7180f0ea282ac7fd6861d to your computer and use it in GitHub Desktop.
Save aaronhipple/f20552edc8c7180f0ea282ac7fd6861d to your computer and use it in GitHub Desktop.
Download ZIP
Ironclad + Okta + SCIM Configuration Guide
Raw
config-guide.md

Our SCIM configuration guide will be available at this URL after customer testing: https://ironcladapp.zendesk.com/hc/en-us/articles/360044695591

The content of that article is shown below:

Prerequisites

  • You must be able to create Ironclad API bearer tokens in your Ironclad company.
  • You must have a SAML SSO connector configured in your Ironclad company before provisioning users with SCIM_. See Okta SSO/SAML Integration for instructions._

Supported Okta Features

  • Create Users
  • Update User Attributes
  • Deactivate Users
  • Push Groups

Configuration Steps

Create a Bearer Token

  1. Login to Ironclad with a company adminstrator account and navigate to the Company Settings page by clicking your name in the top-right corner of the application and choosing Company Settings.
  2. Navigate to the API tab.
  3. Create a new bearer token for use by Okta. Name it something descriptive and memorable (e.g. "Okta SCIM provisioning token").
  4. Copy the generated token that appears.

Enable API Integration in Okta

  1. Login to your Okta admin account and add the Ironclad application.
  2. From the application's configuration screen, navigate to the Provisioning tab.
  3. Click Enable API Integration.
  4. Enter the base SCIM URL for the Ironclad stack you're configuring in the SCIM 2.0 Base URL field. In a production Ironclad instance this URL is https://ironcladapp.com/scim/v2.
  5. Enter the token you created above into the OAuth Bearer Token field.
  6. Click Test API Credentials to confirm the connection works.

Set "Email" Username Format in Okta

  1. From the application's configuration screen, navigate to the Sign On tab.
  2. Under Credentials Details set Application username format to Email.

Screen_Shot_2020-06-15_at_14.29.07.png

Assign Users to the Ironclad Application

Pushing users into Ironclad with SCIM is only supported when a single SAML configuration is in place in your Ironclad company. See Okta SSO/SAML Integration for instructions.

  1. In Okta, select the Assignments tab.
  2. Click the Assign button and select either Assign to People or Assign to Groups**[1]** to configure which users are pushed into Ironclad according to your needs.

[1]Assign to Groups does not cause groups to be created in Ironclad. For that functionality, use Push Groups.

Push Groups

  1. In Okta, select the Push Groups tab.
  2. Click the Push Groups button and select either Find groups by name or Find groups by rule and configure which groups are pushed into Ironclad according to your needs.

Next Steps: Configure Group Permissions in Ironclad

Group permissions must be managed in Ironclad after pushing groups via SCIM. See Managing Permissions for more details about these settings.

Troubleshooting & Tips

Known Limitations

  • Ironclad does not support changing a user's email or userName fields via SCIM.
  • Ironclad does not support "deactivated" or "suspended" users. Users deactivated in Okta will be removed from your Ironclad company.
  • The use of SCIM to manage users who are members of multiple companies is not supported.
  • The use of SCIM in a company with multiple SAML connectors is not supported.

If you encounter issues configuring SCIM with Okta in your Ironclad company, contact support@ironcladapp.com.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment