Skip to main content

How to Configure SAT SCIM in Okta

Melissa
  • Updated

Team: Huntress Managed Security Awareness Training (SAT)
Product: Okta - SCIM Integration
Summary: This article covers how to configure System for Cross-domain Identity Management (SCIM) for your Huntress Security Awareness Training (SAT) instance within the Okta admin console.

 

In Huntress SAT

  1. Access your SAT platform as an admin user.
  2. Go to Settings > Integrations > SCIM.
  3. Create a SCIM Token by clicking + Connect a group and choosing the desired SAT target group.
    • All new learners will be added to this group.
    • Any existing users will be associated with your Identity Provider (IDP) via SCIM but will remain in their currently assigned group.
    • If you want to have multiple SAT groups with SCIM sync, you will need multiple connections on the SAT side and multiple apps in the IDP.
      • Note: If you go this route, ensure you don't have learners in both apps, as their user data may be overridden.

 

In Okta

  1. Follow the SAT SAML SSO steps to create a SAML Application in the Okta admin console following instructions from Okta.
    • Note: Single Sign-On (SSO) does not need to be enabled, but provisioning must happen on a SAML or SWA Application within Okta.
  2. Go to Applications and access the previously created Application.
  3. Under General > App Settings, click Edit.
  4. Check Enable SCIM provisioning and click Save.
  5. Under the Provisioning > SCIM Connection, click Edit.
  6. Configure SCIM as follows:
    • SCIM connector base URL: https://mycurricula.com/api/learner-scim/v2
    • Unique identifier field for users: email
    • Enable Push New Users
    • Enable Push Profile Updates
    • Authentication Mode: HTTP Header

    • Authorization: <<paste in scim token from sat platform>>

       

  7. Use the Test Connector Configuration button to verify settings are correct.
  8. Click Save.

  9. Under Provisioning > To App, update settings as desired.
     

  10. Under Provisioning > To App, edit the User Mappings to only include supported attributes below. 

    Note: Adding additional attributes may cause unexpected behavior.
     
    • SCIM User Schema
      • userName (must be the user’s email address)
      • active
      • name.givenName
      • name.familyName
      • locale
      • preferredLanguage
      • timezone
    • Enterprise User Schema
      • department
      • employeeNumber

      • manager.value (either the email address or ID of the manager)
         

  11. Once configured, new users added to the application should automatically be provisioned via SCIM. Existing users will need to be provisioned by being removed and re-added or by using the Provision User button.

Related articles