Skip to main content
This guide walks you through setting up SCIM provisioning from Okta to Chamelio. SCIM provisioning keeps your Chamelio users and groups synchronized with your identity provider automatically.
SCIM provisioning is an additional step on top of SSO authentication. It is optional but recommended to keep users and groups continuously synchronized. This integration requires two applications registered in Okta: the existing OIDC integration and a new SCIM integration. The same users and groups must be assigned to both. Chamelio will provide you with a SCIM Endpoint URL and a Bearer Token.

​
Prerequisites

Before setting up SCIM, confirm the following:
  1. Confirm that a Chamelio application for user authentication has already been created in your Okta tenant.
  2. Your Chamelio OIDC application has Federation Broker Mode disabled.
1

Create a Provisioning Application

In the Okta Admin Console, navigate to Applications > Applications, then select Create App Integration.
  1. Select SWA – Secure Web Authentication, then choose Next.
  2. On the General App Settings page:
    • Set the App name to Chamelio SCIM
    • Set the App’s login page URL to https://chamelio.ai/ (this URL is not used by the SCIM integration)
    • Select Do not display application icon to users
  3. Select Finish.
Enable SCIM provisioning on the app:
  1. Navigate to the General tab and under App Settings, choose Edit.
  2. In the Provisioning section, select SCIM.
  3. Choose Save.
2

Configure SCIM Connection

Navigate to the Provisioning tab, then the Integration sub-tab, and select Edit.Fill in the following:
  • SCIM connector base URL — enter the SCIM Endpoint URL Chamelio provided
  • Unique identifier field for users — enter userName
  • Supported provisioning actions — select Push New Users, Push Profile Updates and Push Groups
  • Authentication Mode — select HTTP Header
  • Authorization — paste the Bearer Token Chamelio provided
Click Test Connector Configuration to verify the connection is working, then choose Save.
3

Configure Provisioning to App

Navigate to Provisioning > Settings > To App and choose Edit.Enable the following options:
  • Create Users
  • Update User Attributes
  • Deactivate Users
Choose Save.Remove unsupported attribute mappingsUnder the Attribute Mappings section, use the X button to delete the following three attributes, which are not needed and may cause provisioning issues:
  • Primary email type (emailType)
  • Primary phone type (primaryPhoneType)
  • Address type (addressType)
4

Assign Users

Navigate to the Assignments tab.Assign the same users and groups that you configured in the OIDC application.You can test provisioning by editing user attributes in Directory > People in your Okta admin portal and verifying they sync to Chamelio.