User Provisioning in OKTA – Home

Overview

Prior to configuring and testing the app in OKTA, ensure that the SCIM feature is enabled for your company in RFPIO. If not, testing your connection fails with a 403 response code.

Troubleshooting and Tips

If the SCIM feature is not enabled for your company in RFPIO, testing your connection fails with a 403 response code.
Ensure a default role and business unit are selected at the application level in Organization Settings > Security before proceeding with the setup in the OKTA.
Email addresses are the primary/unique identifier, so ensure they get mapped.
The rfpio_user_role and costCenter (business unit in RFPIO) fields are non-editable. These are set during creation/app assignment.
The RFPIO username should be unique.
- userName and email address are the same in the RFPIO side.
- userName is a non-editable field.

Configuring User Provisioning in OKTA

Login to OKTA and click the Applications tab, then click Add Application.
Type RFPIO in the Search field and click Add. The Add RFPIO-General Settings tab displays.
Click Next to go to the Sign-On Options page.
Select Email from the Application username format drop-down list; then click Done.

Generating OAuth Bearer Token from RFPIO

To generate OAuth bearer token, you can follow the steps below:

From Organization Settings, select Security > SCIM and turn on the Auto User Provisioning toggle.
Click Generate SCIM API Token, select the appropriate options from the Default Business Unit (if enabled) and Default User Role drop-down lists, then click Submit. A warning message displays alerting you to copy your API token and store it.
Click Got It! on the warning message. The SCIM window displays.
Click the Copy icon to copy the token, then click Submit.
Go to OKTA > Provisioning > Integration and paste the copied API token in the OAuth Bearer Token field.
Sample API Token: s-8c7d34c30c17092bsdffdfdsergnghuy201e67-5c6426ce9b2ffe0ererer5b4
Type https://app.rfpio.com/rfpserver/scim/v2 in the SCIM 2.0 Base URL field, then click Test API Credentials.
Click Save once the credentials are tested successfully.
Click the To App tab and click Edit.

Select the checkbox associated with Enable for Create Users, Update User Attributes, and Deactivate Users.

Click Save.

Supporting Attributes

Attribute	Value
Given name	user.firstName
Family name	user.lastName
Title	user.title
Primaryphone	user.primaryPhone
Time zone	user.timezone
*Cost center(optional & custom)	user.costCenter ( This is applicable only if business unit is enabled in RFPIO)
*rfpio_user_role(optional & custom)	user.user_role ( RFPIO Internal value which specifies the role name. If not given while provisioning, default role would be set)

Note: Cost center and User role are optional attributes. The default value for both costCenter and user role can be set in the RFPIO application while generating bearer token.

Click To Okta tab. Scroll down and click Go to Profile Editor.
Click Add Attribute.

The Add Attribute pop-up will be displayed. Enter the values in the field provided and then click Save.

Display Name	rfpio_user_role
Variable Name	rfpio_user_role
Description	Internal value that indicates the Role name in RFPIO. This must match with the available role names in RFPIO account.