> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chamelio.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta – SCIM Provisioning Setup

> Step-by-step guide to configure SCIM user and group provisioning from your Okta tenant to Chamelio

This guide walks you through setting up SCIM provisioning from Okta to Chamelio. SCIM provisioning keeps your Chamelio users and groups synchronized with your identity provider automatically.

<Info>
  SCIM provisioning is an additional step on top of SSO authentication. It is optional but recommended to keep users and groups continuously synchronized. This integration requires **two applications** registered in Okta: the existing OIDC integration and a new SCIM integration. The same users and groups must be assigned to both. Chamelio will provide you with a **SCIM Endpoint URL** and a **Bearer Token**.
</Info>

## Prerequisites

Before setting up SCIM, confirm the following:

1. Confirm that a Chamelio application for user authentication has already been created in
   your Okta tenant.
2. Your Chamelio OIDC application has **Federation Broker Mode** disabled.

<Steps>
  <Step title="Create a Provisioning Application">
    In the **Okta Admin Console**, navigate to **Applications > Applications**, then select **Create App Integration**.

    1. Select **SWA – Secure Web Authentication**, then choose **Next**.
    2. On the **General App Settings** page:
       * Set the **App name** to `Chamelio SCIM`
       * Set the **App's login page URL** to `https://chamelio.ai/` (this URL is not used by the SCIM integration)
       * Select **Do not display application icon to users**
    3. Select **Finish**.

    Enable SCIM provisioning on the app:

    4. Navigate to the **General** tab and under **App Settings**, choose **Edit**.
    5. In the **Provisioning** section, select **SCIM**.
    6. Choose **Save**.
  </Step>

  <Step title="Configure SCIM Connection">
    Navigate to the **Provisioning** tab, then the **Integration** sub-tab, and select **Edit**.

    Fill in the following:

    * **SCIM connector base URL** — enter the SCIM Endpoint URL Chamelio provided
    * **Unique identifier field for users** — enter `userName`
    * **Supported provisioning actions** — select **Push New Users**, **Push Profile Updates** and **Push Groups**
    * **Authentication Mode** — select **HTTP Header**
    * **Authorization** — paste the Bearer Token Chamelio provided

    Click **Test Connector Configuration** to verify the connection is working, then choose **Save**.
  </Step>

  <Step title="Configure Provisioning to App">
    Navigate to **Provisioning > Settings > To App** and choose **Edit**.

    Enable the following options:

    * **Create Users**
    * **Update User Attributes**
    * **Deactivate Users**

    Choose **Save**.

    **Remove unsupported attribute mappings**

    Under the **Attribute Mappings** section, use the **X** button to delete the following three attributes, which are not needed and may cause provisioning issues:

    * Primary email type (`emailType`)
    * Primary phone type (`primaryPhoneType`)
    * Address type (`addressType`)
  </Step>

  <Step title="Assign Users">
    Navigate to the **Assignments** tab.

    Assign the same users and groups that you configured in the OIDC application.

    You can test provisioning by editing user attributes in **Directory > People** in your Okta admin portal and verifying they sync to Chamelio.
  </Step>
</Steps>