SCIM provisioning with Okta

Beta: SCIM provisioning is in beta and is enabled per organization. Report any issues to help@nametag.co.

This guide configures a SCIM application in Okta that points at Nametag and authenticates with a Nametag API key. It picks up where SCIM provisioning leaves off.

Before you begin

• Complete the Nametag-side setup in SCIM provisioning: enable SCIM on your directory (Step 1) and gather your connection details (Step 2) — the SCIM endpoint URL, your Directory ID, and an Admin API key.
• You need administrator access to your Okta organization.
• In Okta you will use the SCIM 2.0 Test App (Basic Auth) integration from the Okta Application Catalog.

Step 1 — add the SCIM app in Okta

1. In the Okta Admin Console, go to Applications → Applications → Browse App Catalog.
2. Search for SCIM 2.0 Test App (Basic Auth) and select Add Integration.
3. Give the app a name you’ll recognize, such as Nametag, and complete the setup wizard using the default options.

Step 2 — Configure the API integration

1. Open the app you just created and go to the Provisioning tab.

2. Select Configure API Integration and check Enable API integration.

3. Enter the values you gathered from Nametag:

   • Base URL: https://nametag.co/scim/v2
   • Username: your Directory ID
   • Password: your Admin API key

4. Select Test API Credentials. When the test succeeds, select Save.

5. Still on the Provisioning tab, select To App and enable:

   • Create Users
   • Update User Attributes
   • Deactivate Users

6. Select Save.

Step 3 — Provision users and groups to Nametag

Okta sends two kinds of data to Nametag through two separate tabs:

• Assignments provisions accounts — each assigned user becomes a Nametag account (a directory entry).
• Push Groups provisions the group and its memberships — a pushed group appears in Nametag alongside the members that are already provisioned as accounts.

Nametag records group membership only for members that are also provisioned as accounts. If a pushed group appears in Nametag with no members, those members haven’t been assigned to the app yet.

For details about configuring assignments and Group Push in Okta — and how to structure your groups — refer to the Okta documentation:

• Assign a single app to groups — provision accounts by assigning users or groups to the app.
• Group Push and Enable Group Push — push a group and its membership to the app.
• App assignments and Group Push — how assignments and Group Push interact, and why Okta recommends separate groups for each.

Optional: Map a birthdate

If you want Nametag to match a user’s birthdate during identity verification, add the Nametag custom SCIM extension attribute to the Okta app profile and map one of your Okta user attributes to it.

Nametag expects the birthdate at this SCIM path:

urn:ietf:params:scim:schemas:extension:nametag:2.0:User:birthDate

The value can be a plain date in YYYY-MM-DD format, or one of the hashed formats supported by Nametag. See Birth date hashes for the accepted formats.

To configure this in Okta:

1. In the Okta Admin Console, go to Directory -> Profile Editor.

2. Find the SCIM app you created for Nametag, then select Profile.

3. Select Add Attribute.

4. Configure the attribute:

   • Data type: string
   • Display name: Birthdate
   • Variable name: birthDate
   • External name: birthDate
   • External namespace: urn:ietf:params:scim:schemas:extension:nametag:2.0:User

5. Save the attribute.

6. Return to the SCIM app profile and select Mappings.

7. Select the Okta User to [your Nametag SCIM app] mapping.

8. Find the birthDate target attribute and map it from the Okta user attribute that stores the user’s birthdate.

   For example, if your Okta user profile has a custom attribute named birthdate, map:

   user.birthdate
   

   to:

   urn:ietf:params:scim:schemas:extension:nametag:2.0:User:birthDate
   

9. Select Save Mappings.

10. When prompted, apply the mapping to existing assigned users.

After the mapping is saved, Okta includes the Nametag extension when it creates or updates assigned users. If a user was already assigned before you added the mapping, update that user or reapply the assignment in Okta so Okta sends the new attribute to Nametag.