Okta SCIM

In this guide, we'll look at how to configure Okta SCIM in Cortex through Cortex's app in the Okta Integration Network.

When Okta SCIM is configured, you can create, import, edit, and deactivate users.

Limitations

Note the following limitations when using Okta SCIM:

• A user's email cannot be changed.

• Only given and family names can be updated.

• Users can only be reactivated via a PUT operation.

If you're looking to configure Okta SSO, see the Okta SSO documentation.

Configuring Okta SCIM with the Cortex OIN app

Prerequisites

Before getting started:

• Generate an API key in Cortex.

  • The API key should have the Admin role, or a custom role that contains the Configure Open ID Connector & SCIMpermission.

• In Okta, navigate to Applications > Sign on > Credential details and set the "Application username format" to Email. SCIM requires this format.

• If your organization requires you to allowlist domains, follow these steps before getting started:

  • Ensure that Okta's IP addresses can access your Cortex instance:

    1. In your Cortex instance, click your user avatar in the lower left corner, then click Settings.

    2. On the left side, under Authentication and Access, click IP allowlist.

       • If you do not have any IP addresses listed here, then access is allowed from any IP address.

    3. Click Add IP addresses in the upper right.

    4. In the modal that appears, enter an individual IP address or an IP range in CIDR notation, then click Save.

Step 1: Add the Cortex OIN app

• Add Cortex's OIN app for Okta from Okta's Cortex integration docs. This is also available in your Okta instance under Applications > App integration catalog.

Step 2: Configure user provisioning in Cortex

1. Navigate to the SCIM settings in Cortex.
2. Click the toggles to enable the following settings:

   • Enable automatic deprovisioning of users: Cortex will automatically deprovision any user it detects has been removed from your Okta instance.

   • Enable automatic provisioning of users: Cortex will automatically provision any user it detects has been added to your Okta instance.

You can track which users are provisioned or deprovisioned in the Audit logs.

Enabling automatic provisioning of users may impact seat counts.

Step 3: Configure the API integration

1. In your Okta admin dashboard, navigate to Applications then click the Cortex app.

2. Click the Provisioning tab.

3. Under the Settings panel, click Integration. Configure the settings:

   • Enable API integration: Check the box.

   • API token: Enter your generated Cortex API key.
4. Click Test API Credentials to verify that your configuration works.

5. Click Save.

Step 4: Set provisioning in Okta

Once the integration is configured, Okta will give you the option to enable provisioning settings.

1. Enable the following settings in Okta:

   • Create users: This creates a user in Cortex when the app is assigned to a user in Okta.

     • The default username used to create accounts is set to the Okta username.

   • Update user attributes: This setting allows Okta to update a user's attributes in Cortex when the app is assigned.

     • Cortex only supports updating the user's name (i.e. birth and family names).

   • Deactivate users: This deactivates or deletes a user's Cortex account when the app is unassigned to that user or when their Okta account is deactivated.

     • Accounts can be reactivated if the app is reassigned to the user in Okta.

2. Click Save.

Synchronizing user data between Okta and Cortex

To force a data sync between Okta and Cortex:

1. In your Okta admin dashboard, open the Cortex app then click the Provisioning tab.

2. Under the Settings panel, click To App.

3. Under Cortex Attribute Mappings, click Force sync.

Troubleshooting and FAQ

Why might I see a "Forbidden from remote server" error in Okta when testing authentication?

This can happen if you did not configure user provisioning in your SCIM settings in Cortex before testing the integration in Okta. Follow the steps to configure user provisioning, then try again.