Okta user provisioning with SCIM

Okta and Showpad work together to make user provisioning a breeze for your organization. System for Cross-domain Identity Management (SCIM) is designed to make managing user identities in cloud-based applications and services easier. SCIM has a set of default contracts for users and groups that can be extended to work seamlessly with Okta. 

See how it looks

Key features

• Users in Okta can be automatically added as members of your organization in Showpad
• User attributes updated in Okta will be pushed automatically to Showpad
• Deactivate and reactivate users via Okta and see those changes in Showpad
• Groups created in Okta will be pushed automatically to your Showpad instance

You need this to succeed

The quick way

• Enable the integration in Showpad
• Configure Okta
• Provisioning modifications in Okta
  • Configure user roles
  • Configure Direct Managers

Do this step by step

Enable the SCIM API in Showpad

1. Ensure that SCIM provisioning is enabled in the sign-on settings. To do this, click the gear icon to open Settings, select Sign-On from the side menu. Then toggle on the SCIM setting.
2. Next, select API in the Integrations section of the side menu. Select API Tokens to create your token. 

3. Enter a name for your new API token. You can choose to set an expiration date. Click Add. This is also where you can revoke access to other tokens you've created.

   Tip: API Tokens are linked to the permissions of the user creating them. For best results, create tokens under a long-term user account with an Owner or Manager role.

Configure Okta from your Okta admin portal

Note: If you haven't set up Single Sign-On (SSO) with Okta before, make sure to do so before continuing these steps. Learn how to set up SSO for Showpad via Okta here.

1. Click on the Provisioning tab and then select Configure API Integration. 
2. Provide the following information:
   • Base URL (in this format): https://[your_organization_name].showpad.biz/api/users/scim/v2
   • API Token: Paste the API Token you previously obtained from Showpad.
   • Import Groups: Check the box to sync all existing groups from Okta into Showpad.
3. Test API Credentials and click Save when ready.

4. To enable the different provisioning options of Okta to Showpad, check the corresponding boxes:

   • Create Users: This option allows you to create or link users in Showpad when assigning the app to a user in Okta.
   • Update User Attributes: This option will allow Okta to update a user's attributes in Showpad when the app is assigned to them. Future attribute changes made to the Okta user profile will automatically overwrite the corresponding attribute value in Showpad. This must be enabled for auto-provisioning sync to work for user updates.
   • Deactivate Users: When enabled, this option will deactivate a user's Showpad account when they are unassigned to the app in Okta, or when their Okta account is deactivated. They can be reactivated if the Showpad app is reassigned to them in Okta.

   Click Save after enabling your selections.

5. After enabling the provisioning options, scroll down to adjust the Showpad Attribute Mapping. Click the pencil icon to edit attributes and choose whether they apply on create, update, or both.
6. Open the Assignments tab, then click Assign. Choose to assign the Showpad app to People or Groups. These users will be automatically created in your Showpad instance and will receive an invitation email. Groups and their user membership will also be pushed to Showpad automatically.
7. To push groups from Okta to Showpad, open the Push Groups tab. Search for the group, then click Create Group, and then click Save. 

8. You will see the group's Last Push date and Push Status as Active. Click the Push Status to update it.

   • Deactivate group push: This option will stop pushing group memberships. Existing members will be unaffected by this change. 
   • Unlink pushed group: This option will stop pushing group members and optionally delete the pushed group from Showpad.
   • Push now: This option will push this group's memberships to Showpad.

   

Provisioning modifications in Okta

This section outlines how to configure custom attributes in Okta to handle specific provisioning tasks for Showpad that are not supported by default.

Unsupported provisioning activities from Showpad to Okta

Currently, the following activities are not supported for provisioning from Showpad to Okta: 
 

• User deletion
• Reactivating deactivated users
• Directly provisioning user roles and direct managers

While user roles and direct managers cannot be provisioned directly from Showpad to Okta, you can add custom attributes in Okta's Profile Editor as an Okta to Showpad alternative. You can find out more about Okta's custom attributes here.

Configure user roles

Follow these steps to create and map a custom attribute for user roles.

1. To add a custom attribute to the Showpad User profile, in the Okta Admin Console, navigate to the Directory menu, select Profile Editor.
2. Find and select the Showpad User profile. Be sure All is selected in the Filters.
3. Click the Add Attribute button.

4. Define the role attribute details.

   Enter the following information:

   • Data type: Select the "string" data type.
   • Display name: Enter role.
   • Variable name: Enter role.
   • External name: Enter this expression: roles.^[primary=='true'].value
   • External namespace: Enter this expression: urn:ietf:params:scim:schemas:core:2.0:User
   • Attribute type: Select "Personal".

   This is how it should appear: 
   

   Click Save. The role attribute is added to the Showpad User profile.

5. Map the Attribute from Okta to Showpad by clicking the Mappings button.
6. On the Okta User to Showpad tab, map your preferred Okta field to the Showpad role field. For example, enter the expression user.userType in the Okta field to the left of the Showpad attribute "role".   
7. Click Save Mappings.

You can now use this to attribute mapping to provision your Showpad admins and users.

Configure Direct Managers

This process involves creating attributes in both the main Okta User profile and the Showpad User profile.

Before you begin to configure Direct Managers, check if you are already capturing the Direct Manager value in your Okta User (default) profile:

• If Yes: You'll only need to create an attribute for Direct Managers in the Showpad User profiles.
• If No: You'll need to create an attribute for Direct Managers in both the Okta User (default) and Showpad User profiles.

Add a "direct_manager" attribute to the Okta User (default) profile

1. Open the Directory menu in the Admin Console, select Profile Editor, and click on User (default). If you use a custom profile for your users, select that one.
2. Click the Add Attribute button.

3. Enter the following information:

   • Data type: Select the "linked object" data type.
   • Display name: Enter direct_manager.
   • Variable name: Enter direct_manager.
   • User permission: Select "Read Only".

   This is how it should appear:

4. Click Save. The role attribute is added to the Okta profile.

Add a "manager" attribute to the Showpad User profile

1. After you've created the "direct_manager" attribute for the Okta User (default) profile, click on Showpad User profile. Be sure All is selected in the Filters.
2. Click the Add Attribute button.

3. Enter the following information:

   • Data type: Select the "string" data type.
   • Display name: Enter manager.
   • Variable name: Enter showpad_manager.
   • External name: Enter this expression: manager.value
   • External namespace: Enter this expression: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
   • Attribute type: Select "Personal".

   This is how it should appear:

4. Click Save. The role attribute is added to the Showpad User profile.

Map the Attribute from Okta to Showpad

1. Click the Mappings button.

2. On the Okta User to Showpad tab, map your preferred Okta field to the Showpad attribute. 
   For example, enter the expression user.getLinkedObject("direct_manager").email in the Okta field to the left of the Showpad attribute "showpad_manager".

   Note: The direct manager attribute only accepts an email address as input.

   

   Note: Be sure to use the object name you created in the Okta User (default) profile.

3. Click Save Mappings.