SCIM provisioning with Okta

With SCIM (System for Cross-domain Identity Management) enabled, you can automate user provisioning in Cube Cloud and keep user groups synchronized with Okta.

Prerequisites

Before proceeding, ensure you have the following:

• Okta SAML authentication already configured. If not, complete the SAML setup first.
• Admin permissions in Cube Cloud.
• Admin permissions in Okta to manage application integrations.

Enable SCIM provisioning in Cube Cloud

Before configuring SCIM in Okta, you need to enable SCIM provisioning in Cube Cloud:

1. In Cube, navigate to Admin → Settings.
2. In the SAML section, enable SCIM Provisioning.

Generate an API key in Cube Cloud

To allow Okta to communicate with Cube Cloud via SCIM, you’ll need to create a dedicated API key:

1. In Cube Cloud, navigate to Settings → API Keys.
2. Create a new API key. Give it a descriptive name such as Okta SCIM.
3. Copy the generated key and store it securely — you’ll need it in the next step.

Enable SCIM provisioning in Okta

This section assumes you already have a Cube Cloud SAML app integration in Okta. If you haven’t created one yet, follow the SAML setup guide first.

1. In the Okta Admin Console, go to Applications → Applications and open your Cube Cloud application.
2. On the General tab, click Edit in the App Settings section.
3. Set the Provisioning field to SCIM and click Save.

Configure SCIM connection in Okta

1. Navigate to the Provisioning tab of your Cube Cloud application.
2. In the Settings → Integration section, click Edit.
3. Fill in the following fields:
   • SCIM connector base URL — Your Cube Cloud deployment URL with /api/scim/v2 appended. For example: https://your-deployment.cubecloud.dev/api/scim/v2
   • Unique identifier field for users — userName
   • Supported provisioning actions — Select Push New Users, Push Profile Updates, and Push Groups.
   • Authentication Mode — Select HTTP Header.
4. In the HTTP Header section, paste the API key you generated earlier into the Authorization field.
5. Click Test Connector Configuration to verify that Okta can reach Cube Cloud. Proceed once the test is successful.
6. Click Save.

Configure provisioning actions

After saving the SCIM connection, configure which provisioning actions are enabled for your application:

1. On the Provisioning tab, go to Settings → To App.
2. Click Edit and enable the actions you want:
   • Create Users — Automatically create users in Cube Cloud when they are assigned in Okta.
   • Update User Attributes — Synchronize profile changes from Okta to Cube Cloud.
   • Deactivate Users — Deactivate users in Cube Cloud when they are unassigned or deactivated in Okta.
3. Click Save.

Assign users and groups

For users and groups to be provisioned in Cube Cloud, you need to assign them to your Cube Cloud application in Okta. This is also required for group memberships to be correctly synchronized — pushing a group alone does not assign its members to the application.

1. In your Cube Cloud application, navigate to the Assignments tab.
2. Click Assign and choose Assign to Groups (or Assign to People for individual users).
3. Select the groups or users you want to provision and click Assign, then click Done.

Push groups to Cube Cloud

To synchronize groups from Okta to Cube Cloud, you need to select which groups to push:

1. In your Cube Cloud application, navigate to the Push Groups tab.
2. Click Push Groups and choose how to find your groups — you can search by name or rule.
3. Select the groups you want to push to Cube Cloud and click Save.