Okta

Overview

Set up provisioning

Step 1: Create an API key

Step 2: Enable API integration

Step 3: Configure integration

Provision users and groups

Overview

Blameless supports SCIM integration with Okta to easily create and manage user groups directly from the Okta environment.

Key features of this integration include:

• User activation
• User deactivation
• Group pushing
• Group linking
• User to group bi-directional updating (when groups are linked)

This article explains how to set up and configure the integration between Blameless and Okta.

After setting up the integration, please see User Management with Okta to learn about the provisioning and onboarding processes.

Set up provisioning

In order to create groups and add Blameless users, you must first create an API key in Blameless and then set up the integration in the Okta admin console.

Step 1: Create an API key

1. In the sidebar of the Blameless UI, select Identity Management, and then select the Key Management tab.

2. Select + Generate New Key.

3. In the Enter a Name for the Key field, enter a memorable name for the new API key and then select Create.

4. A new API key will be generated. Select Copy to copy the key to your clipboard, and then save the key in a secure location. When done, select Close.
   1. Note: This key will not be displayed again.

5. Your new key appears in the key list table. You can have up to 10 active keys at a time.

Step 2: Enable API integration

1. Log on to the Okta console ⏤ https://<yourSubdomain>.okta.com/login/default ⏤ ensuring that you are authenticated as an Administrator.
2. On the left sidebar, expand Applications and then select Applications.

3. In the Applications section, select Browse App Catalog.

4. In the Search field, search for SCIM 2.0 Test App (Header Auth) and, in the results section, select SCIM 2.0 Test App (Header Auth).*
   1. Note: Ensure that you have not exceeded your applications limit.

5. Select + Add Integration and then configure the application based on your organization's requirements. When finished, select Done.
6. With the application still selected, click the Provisioning tab and, under the Settings panel, select Integration.

*: We are awaiting approval for our own catalog entry to be accepted in the Okta Integration Network catalog. The SCIM 2.0 Test App is simply an interim measure to support teams with immediate needs.

Step 3: Configure integration

1. Select the Enable API integration checkbox.
2. In the Base URL field, enter your full Blameless URL in the following format: https://<yourSubdomain>.blameless.io/api/scim/v2.
3. In the API Token field, paste the API key you created in Step 1.
4. Select Test API Credentials to ensure that the connection is functional.
5. Click Save.

6. Under the Settings panel, ensure that To App is selected.
7. Select the Enable checkbox for the following entries:
   • Create Users
   • Update User Attributes
   • Deactivate Users
8. Click Save.

9. Select the Sign On tab.

10. In the top Settings section, select Edit.

11. Scroll down to the Credentials Details section and, in the Application username format field, ensure that Email is selected.

12. Click Save.

Provision users and groups

At this stage, all prerequisites are complete and you can proceed to provisioning groups and adding Blameless users in the Okta admin console.

Please see User Management with Okta to learn about this process.