Skip to main content

Set up SCIM with Okta EnterpriseEnterprise +

SCIM available for Okta

System for Cross-Domain Identity Management (SCIM) license mapping is currently only supported for Okta. For other providers, license types must be managed within the dbt platform user interface.

Prerequisites​

Set up Okta​

  1. Log in to your Okta account and select Applications from the sidebar. Open the application you configured for SSO.

  2. Click on the app and navigate to the General tab.

  3. In App Settings, click Edit and make sure you check the SCIM checkbox on the Provisioning row to enable SCIM provisioning.

  4. Click Save and the Provisioning tab will now be visible.

    Enable SCIM provisioning in Okta.Enable SCIM provisioning in Okta.

  5. Open the Provisioning tab and select Integration.

  6. Click Edit and enter the SCIM base URL from Set up SCIM in the first field. For Unique identifier field for users, we recommend userName.

  7. Under Supported provisioning actions, select:

    • Push New Users
    • Push Profile Updates
    • Push Groups
    • Import New Users and Profile Updates (Optional for users created before SSO/SCIM setup)
    • Import Groups (Optional)

  8. For Authentication mode dropdown, select HTTP Header.

  9. In the Authorization section, enter the token from dbt into the Bearer field.

    The completed SCIM configuration in the Okta app.The completed SCIM configuration in the Okta app.

  10. Click Save to test the connection and you will be taken to the Provisioning tab.

  11. Click Edit and ensure the following provisioning actions are selected:

    • Create Users
    • Update User Attributes
    • Deactivate Users
    Ensure the users are properly provisioned with these settings.Ensure the users are properly provisioned with these settings.

  12. Click Save to complete the provisioning configuration.

  13. To complete your group setup, go to Push Groups and push your Okta groups to dbt platform. This makes the groups available in dbt platform. Then, an admin must assign the required permissions to each group.

You've now configured SCIM for the Okta SSO integration in dbt platform. You can manage user licenses with SCIM to set license type for users as they are provisioned.

SCIM username format​

For dbt platform SCIM with Okta, userName must be the email address format. dbt platform uses userName to look up existing users during SCIM sync. If Okta sends another format (such as an Okta internal ID like 00u... or an employee ID), dbt platform cannot match the existing user, and provisioning will fail.

If your Okta configurations map the Username field to a different attribute, set your Okta app config to Email:

  1. Open the SAML app created for the dbt integration.
  2. In the Sign on tab, click Edit in the Settings pane.
  3. Set the Application username format field to Email.
  4. Click Save.
SSO and SCIM username

When you use both SSO and SCIM with Okta, the SAML Application username format must be Email. SCIM requires userName in email address format, and it must be the same value as the email attribute so users match between SSO and provisioning.

SCIM license mapping​

To automate seat assignments in Okta for users as they are provisioned, see Manage user licenses with SCIM.

Existing Okta integrations​

If you are adding SCIM to an existing Okta integration in dbt (as opposed to setting up SCIM and SSO concurrently for the first time), be aware of the following behavior:

  • Users and groups already synced to dbt will become SCIM-managed once you complete the SCIM configuration.
  • (Recommended) Import and manage existing dbt groups and users with Okta's Import Groups and Import Users features. Update the groups in your IdP with the same naming convention used for dbt groups. New users, groups, and changes to existing profiles will be automatically imported into dbt.
    • Ensure the Import users and profile updates and Import Groups boxes are selected under the Provisioning settings tab in the Okta SCIM configuration.
    • Use Import Users to sync all users from dbt, including previously deleted users, if you need to re-provision those users.
    • Read more about this feature in the Okta documentation.

To set license type for users as they are provisioned, see Manage user licenses with SCIM.

Was this page helpful?

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

0
Loading