Prerequisites

• You must subscribe to the Okta IAM service license for Lifecycle Management (LCM).
• You need permissions in the Okta Admin Console to create an app and assign users/groups to the app.
  • Minimum required permissions
    • User
      • Edit users’ application assignments
    • Group
      • Edit groups’ application assignments
    • Application
      • Manage applications
• From https://help.okta.com/en-us/content/topics/security/ip-address-allow-listing.htm , refer to the Okta IP range allowlist at https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json , identify the ranges for your tenant, and allow inbound traffic exceptions in advance.
• QueryPie must be installed with a valid license.
• You need an account with the Owner/Application Admin Role in QueryPie.
• Complete Activating Provisioning first: activating-provisioning

Integration Steps

Once the prerequisites are completed, perform the SCIM integration in the following order.

Create an Okta custom SCIM app

1. Sign in to the Okta service at https://login.okta.com/  with an admin account.
2. Click the Admin button in the top right to enter the Admin Console.
3. In the left panel, go to Applications > Applications.
4. Click Create App Integration.
5. To prepare for custom SCIM integration, select SAML 2.0 as the Sign-in method and click Next.
6. In the General Settings step, define values appropriately and click Next.
   1. App name: Enter an identifiable application name.
   2. App logo: Upload a logo that users can recognize.
7. In the Configure SAML step, define values and click Next.
   1. Single sign-on URL: https://{{querypie.domain}}/saml/sp/acs
   2. Audience URI (SP Entity ID): https://{{querypie.domain}}/saml/sp/metadata
   3. Attribute Statements (optional): Enter the required QueryPie URL attributes as follows:
      1. Name: firstName
         Name format: Unspecified
         Value: user.firstName
      2. Name: lastName
         Name format: Unspecified
         Value: user.lastName
      3. Name: email
         Name format: Unspecified
         Value: user.email
      4. Name: loginId
         Name format: Unspecified
         Value: user.login
8. In the Feedback step, select “I’m an Okta customer adding an internal app” and click Finish.
9. After the Application is created, go to the General tab and click Edit in App Settings.
10. Set Provisioning to SCIM and click Save.
11. After completing SSO integration by following Integrating with Okta | Setting integration information in Okta Admin Console (../authentication/integrating-with-okta#okta%EC%97%90%EC%84%9C-querypie-%EC%95%A0%ED%94%8C%EB%A6%AC%EC%BC%80%EC%9D%B4%EC%85%98-%EC%97%B0%EB%8F%99-%EC%A0%95%EB%B3%B4-%EC%84%A4%EC%A0%95) and Integrating with Okta | Configuring integration and synchronization in QueryPie (../authentication/integrating-with-okta#querypie%EC%97%90%EC%84%9C-okta-%EC%97%B0%EB%8F%99-%EB%B0%8F-%EB%8F%99%EA%B8%B0%ED%99%94-%EC%84%A4%EC%A0%95), proceed to the next steps.

Okta-QueryPie Provisioning integration

1. Open the Provisioning tab of the SCIM App you created in Okta.
2. Click Edit on SCIM Connection and fill in the fields below:
   1. SCIM connector base URL: Insert the SCIM Endpoint value retrieved from QueryPie.
   2. Unique identifier field for users: “userName”
   3. Support provisioning action:
   4. Authentication Mode: “HTTP Header”
   5. HTTP Header > Authorization: Insert the SCIM-specific access token generated in QueryPie.
3. Click Test Connector Configuration to test the connection.
4. When the popup shows “Connector configured successfully”, click Close.
5. Click Save at the bottom to store the connection settings.

Enable and verify SCIM API

1. In the Provisioning tab of the SCIM App created in Okta, go to the To App screen.
2. Click Edit to the right of Provisioning to App.
3. Enable the following checkboxes and click Save:
   1. Create Users: Add users to the app when assigned.
   2. Update User Attributes: Apply user profile updates to the app.
   3. Deactivate Users: Deactivate users in the app when they are deactivated.
4. Click Go to Profile Editor under QueryPie SCIM App Attribute Mappings.
5. Click Mappings under Attributes.
6. Of the two tabs at the top of the popup, select the one labeled “Okta User to {Your App Name}”.
7. Map fields according to your settings and click Save Mappings.
8. Click Apply updates now at the bottom.

Verify user provisioning

1. Return to the SCIM app and in the Assignments tab use the Assign button options to assign users:
   1. Assign to People: Assign by individual users.
   2. Assign to Groups: Assign by user group.
2. Return to the QueryPie app and go to Administrator > General > User Management > Users to confirm users are pushed successfully.

Verify group provisioning

1. Return to the SCIM app and in the Push Groups tab use the Push Groups button options to push groups.
   1. Find groups by name: Search by group name to push.
   2. Find groups by rule: Define rules to push groups that match conditions.
2. Return to the QueryPie app and go to Administrator > General > User Management > Groups to confirm groups are pushed successfully.