Skip to content
FluxGate

Enterprise · FluxGate with Okta

Groups, roles and teams

Three Okta groups decide who is an admin, an Approver or a Requester in team Routing, and FluxGate applies them as soon as Okta pushes them.

4:36 videoBuilds on:Set up provisioning

Before you start

  • Both Okta apps exist and the FluxGate provider okta has a SCIM token and the link pair (Set up provisioning).
  • The people exist in Okta. In the example: maya@brightwater.example, ravi@brightwater.example and lena@brightwater.example.
  • Sign in to FluxGate as admin System admin.

The plan

Okta groupMembersFluxGate result
FluxGate AdminsmayaSystem administrator
FluxGate Routing ApproversraviRole Approver, team Routing
FluxGate Routing DeveloperslenaRole Requester, team Routing

With role sync mode SCIM, FluxGate takes roles, teams and admin access from the groups Okta pushes. A sign-in does not change them.

Create and assign the groups in Okta

  1. Open Directory, Groups, click Add group. Type Name FluxGate Admins and a Description, and click Save. Repeat for FluxGate Routing Approvers and FluxGate Routing Developers.
  2. Open each group, click Assign people, and add its members.
  3. Open the app FluxGate provisioning, tab Assignments, Assign, Assign to Groups. Click Assign next to each of the three groups. Okta asks for app attributes: click Save and Go Back. Click Done.
  4. Do the same on the app FluxGate sign-in. Everyone who is provisioned can now also sign in.

In FluxGate, /settings/users now lists the three people with the SCIM badge. Okta created them when the groups were assigned. Nobody has a role yet.

Push the groups

  1. On FluxGate provisioning, open the tab Push Groups and click Push Groups.
  2. In Find groups by name, find FluxGate Admins and save. Okta creates the group in FluxGate with its members. Keep Push group memberships immediately ticked.
  3. Repeat for the other two groups.

In FluxGate, the Provisioning dialog of okta shows Groups 3 and the note "Pushed groups are not used. Set role sync to SCIM to apply them."

Map the groups

  1. On the row okta, click the Group mappings icon.
  2. Click Add mapping. In IdP group value, pick FluxGate Admins from the suggestions. Choose Admin and System administrator.
  3. Add four more rows: FluxGate Routing Approvers Role Approver; FluxGate Routing Approvers Team Routing; FluxGate Routing Developers Role Requester; FluxGate Routing Developers Team Routing.
  4. Click Save mappings. The toast "Group mappings saved" appears.
  5. Click Edit provider. Set Role sync mode to SCIM (groups pushed by the IdP) and switch Enabled on. Click Save changes. The toast "SSO provider updated" appears.

The row shows Role sync SCIM and Status Enabled. On /settings/users, maya has Admin Yes. Open lena: on Assign Roles, Requester is ticked with an SSO chip, and on Assign Teams, Routing is ticked with an SSO chip.

Good to know

  • Each mapping row maps one group value to one role, one team, or administrator access. A group can have several rows.
  • Group values match the group's name or Okta group ID exactly and case-sensitive. Pick the suggestions: they are the groups Okta pushed.
  • Save mappings replaces all mappings of the provider.
  • The SSO chip marks an assignment that comes from the identity provider. Change it in Okta: FluxGate refuses to change it by hand.
  • Roles are applied when you switch to SCIM, before anyone signs in.
  • FluxGate never creates roles or teams from groups. Create them in FluxGate first.

Troubleshooting

Nobody gets a role

Check that role sync mode is SCIM, that the groups are pushed (Groups in the provisioning dialog), and that each mapping value equals the pushed group name exactly.

SCIM is greyed out in Role sync mode

The provider has no active SCIM token. Create one in the provisioning dialog.

Next

Three people sign in with Okta: People sign in.