Skip to content
FluxGate

Enterprise · FluxGate with Okta

Set up provisioning

Okta's provisioning app reaches FluxGate's SCIM endpoint with a bearer token, and FluxGate knows how to link each provisioned person to their first sign-in.

4:39 videoBuilds on:Set up sign-in

Before you start

  • The FluxGate provider okta exists (Set up sign-in). It can stay disabled.
  • Sign in to FluxGate as admin System admin and open /settings/sso. Keep the Okta Admin Console in a second tab.

SCIM in FluxGate

With SCIM 2.0, Okta creates, updates and deactivates FluxGate users and sends group membership. Okta calls the SCIM base URL of FluxGate:

SCIM base URL
<public_base_url>/api/v1/scim/v2

Each call carries a bearer token that belongs to one FluxGate provider. Accounts that Okta creates are marked SCIM in the user list and sign in through Okta only. They have no password.

  1. On the row okta, click the Provisioning icon. The dialog SCIM provisioning for Okta opens.
  2. Next to SCIM base URL, click Copy base URL.
  3. Under Tokens, click Create token. Type Token name okta. Expires (optional) can stay empty. Click Create.
  4. Token created shows the token once. Click Copy token, keep it for the Okta step below, then click Done. The list keeps only the prefix and when the token was last used.
  5. Under Link first sign-in to a provisioned user, type Login claim sub and choose SCIM attribute externalId.
  6. Click Save link. The toast "Link settings saved" appears.

Why sub and externalId

When a provisioned person signs in for the first time, FluxGate looks for the account Okta created. It compares a claim of the sign-in with an attribute that Okta sent over SCIM. Okta sends its user ID (00u…) as externalId, and the same ID is the sub claim of every sign-in. It never changes, even when the email address does.

The default pair, email to email, also works with Okta, because Okta sends email_verified. It stops matching when a person's email address changes.

Create the Okta provisioning app

  1. In Okta, open Applications and Resources, Applications, Create App Integration. Choose the tab Classic experience, then SWA - Secure Web Authentication. Click Next.
  2. In Create SWA Integration, type App name FluxGate provisioning and App's login page URL https://fluxgate.example.com/login.
  3. Tick Do not display application icon to users and This is an internal application that we created. Without the second box Okta offers no SCIM option. Click Finish.
  4. On General, in App Settings, click Edit, set Provisioning to SCIM, and click Save. A Provisioning tab appears. Reload the page if it is empty.
  5. On Provisioning, Integration, click Edit. Set SCIM version to 2.0 and paste the base URL into SCIM connector base URL.
  6. Set Unique identifier field for users to userName.
  7. Under Supported provisioning actions, tick Push New Users, Push Profile Updates and Push Groups. Leave the import actions off.
  8. Set Authentication Mode to HTTP Header. Okta adds the Bearer prefix itself: paste only the token.
  9. Click Test Connector Configuration. Every action passes. Close the result and click Save.
  10. On To App, click Edit. Enable Create Users, Update User Attributes and Deactivate Users. Leave Sync Password off. Click Save. The default attribute mappings are right.

Back in FluxGate, reopen the provisioning dialog. Last request shows the connector test, Last error shows None, and the token shows when it was last used. Users stays 0 until you assign groups.

Good to know

  • FluxGate shows a token once. If you lose it, create a new one and revoke the old one.
  • With an expiry date, rotate the token before it runs out. FluxGate warns on tokens older than a year and on tokens close to expiry.
  • Leave Sync Password off. FluxGate answers a password change with an error, and accounts from Okta sign in through Okta only.
  • Okta never deletes users. It deactivates them. FluxGate disables the account and keeps its history.
  • FluxGate accepts the token with or without the Bearer scheme. Never type Bearer into Okta's token field.

Troubleshooting

Test Connector Configuration fails with 401

The token is wrong, revoked or expired, or Okta sends Bearer twice. Create a new token, paste only the token, and test again.

The Provisioning tab has no SCIM option

Tick This is an internal application that we created in the app's settings. Okta offers SCIM only for internal classic apps.

Next

Create the Okta groups, assign them, push them, and map them to roles and teams: Groups, roles and teams.