Skip to main content

Use Okta SCIM in Ironclad

Ariana Kemp
  • Updated

The topic will walk you through how to use Okta SCIM with Ironclad. This includes how to create a bearer token, enable the integration, assign users to Ironclad, push groups, and troubleshoot.

Disclaimer: If you change your domain, your access to Ironclad is prohibited. Contact Support (support@ironcladhq.com) for assistance before migrating a domain. Also contact Support (support@ironcladhq.com) before deprovisioning any users as this may block your ability to continue your workflows.

Prerequisites

  • You must be able to create Ironclad API bearer tokens in your Ironclad company.
  • You must have a SAML SSO connector configured in your Ironclad company before provisioning users with SCIM. To learn how to do this, refer to Okta SSO/SAML Integration. If you've previously configured a custom SAML connector using an older version of our Okta SSO/SAML Integration documentation, please contact support@ironcladapp.com for help migrating your Ironclad users to the Ironclad OIN connector.

Supported Okta Features

  • Create Users
  • Update User Attributes
  • Deactivate Users
  • Push Groups


Skip To:

Follow each of the sections below in order:  

 

Create a Bearer Token

Required Role: Admin
BearerToken.jpeg
  1. In Ironclad, click on your name located in the top right corner of Ironclad. Click Company Settings > API.
  2. Create a new bearer token for use by Okta. Name it something descriptive and memorable such as "Okta SCIM Provisioning Token".
  3. Copy the generated token that displays.
 

 

Enable API Integration in Okta

EnableAPI.jpeg
  1. Log in to your Okta admin account and add the Ironclad application.
  2. From the application's configuration screen, navigate to the Provisioning tab.
  3. Click Enable API Integration.
  4. In the SCIM 2.0 Base URL field, enter the base URL for the Ironclad stack you're configuring. In a production Ironclad instance, this URL is https://ironcladapp.com/scim/v2.
  5. In the OAuth Bearer Token field, enter the token you created above.
  6. Click Test API Credentials to confirm the connection works.
 

 

Assign Users to the Ironclad Application

Pushing users into Ironclad with SCIM is only supported when a single SAML configuration is in place in your Ironclad company. Refer to Okta SSO/SAML Integration for instructions.
AssignUsers.jpeg
  1. In Okta, click the Assignments tab.
  2. Click the Assign button and either select Assign to People or Assign to Groups* to configure which users are pushed into Ironclad.
*Assigning users to groups does not create groups in Ironclad. For that functionality, use Push Groups.

 

Push Groups

PushGroups.jpeg
  1. In Okta, click the Push Groups tab.
  2. Click the Push Groups button and either select Find groups by name or Find groups by rule. Configure which groups are pushed into Ironclad.
 

Configure Group Permissions in Ironclad

You must manage group permissions in Ironclad after pushing groups via SCIM. Refer to the Group Permissions Overview for more information.
 

Map Custom Attributes in OKTA

Create Attribute Definition

  1. In Okta, click Directory > Profile Editor.
  2. Click Add Attribute. An example configuration for the “managerEmail” attribute is shown below. Note the specific values for the external name and external namespace.MapCusotmAttributes.jpeg
  3. Click Mappings to map the attribute.Mappings.jpeg

Mapping Examples

The "External name" and "External namespace" settings must match exactly and are recorded below for each custom attribute:
  • User’s Title
    • External name: “title”
    • External namespace: “urn:ietf:params:scim:schemas:extension:core:2.0:User”
  • User's Department
    • ​​​​​​​External name: “department”
    • External namespace: “urn:ietf:params:scim:schemas:extension:enterprise:2.0:User”
  • User’s Management Level
    • ​​​​​​​External name: “managementLevel”
    • External namespace: “urn:ietf:params:scim:schemas:extension:ironclad:2.0:User”
 

 

Troubleshooting and Tips

Known Limitations

  • Ironclad does not support changing a user's email or userName fields via SCIM.
  • Ironclad does not support "deactivated" or "suspended" users. Users deactivated in Okta are soft-deleted in Ironclad.
  • The use of SCIM to manage users who are members of multiple companies is not supported.
  • The use of SCIM in a company with multiple SAML connectors is not supported.

Import Groups

When configuring provisioning in Okta, you may find that preexisting groups from your Ironclad account appear in Okta in a read-only state. If you do not want this, you may disable group import.
To disable group import, refer to Remove Groups Imported from Provisioning-Enabled Apps in Okta's Help Center.
  • If you do not remove any imported groups, you must remove them via Okta's API with a remove group call.
  • If the Import Groups checkbox isn't present, you must contact Okta support and request that SELECTIVE_APP_IMPORT_PLATFORM be enabled.
If you encounter issues configuring SCIM with Okta in your Ironclad company, contact support@ironcladapp.com.
​​​​​​​


 

Related articles