SCIM integration with Permit.io via Okta

Provision users from Okta into your Permit.io environment with System for Cross-domain Identity Management (SCIM), and push Okta groups to Permit as roles. This page is for Okta administrators who want users assigned in Okta to appear in Permit without sync code. To learn how SCIM maps users, groups, and tenants in Permit, see SCIM provisioning with Permit.

Prerequisites

• An Okta account with permission to add applications
• Your environment API key (Get your API key)
• Your Permit project ID and environment ID (Get the project ID and Get the environment ID)

Configure Okta

1. Add the SCIM 2.0 Test App.

   • In the Okta admin dashboard, go to Applications > Applications.
   • Click Browse App Catalog.
   • Search for SCIM 2.0 Test App (Header Auth) and click Add.

2. Complete the general settings. In the General Settings tab, click Next.

3. Set the sign-on option. Select Secure Web Authentication (SWA) and click Done.

4. Connect Okta to the Permit SCIM API.

   • Go to the Provisioning tab and click Configure API Integration.
   • Check Enable API integration.
   • In Base URL, enter https://scim.permit.io/scim/v2/{permit_project_id}/{permit_env_id}. For EU users, enter https://scim.eu-central-1.permit.io/scim/v2/{permit_project_id}/{permit_env_id}. Replace {permit_project_id} and {permit_env_id} with your Permit project ID or key and environment ID or key. To assign roles in a specific Permit tenant, use the tenant-aware base URL described in Permit SCIM base URLs.
   • In API Token, enter your environment API key.
   • Click Test API Credentials. Okta shows a success message when it can reach Permit with the API key.
   • Click Save.

   The integration settings look like this:

   

5. Choose what Okta provisions.

   • In the Provisioning tab, open To App and click Edit next to Provisioning to App.
   • Enable Create Users, Update User Attributes, and Deactivate Users.
   • Click Save.

   

6. Assign users and push groups.

   • In the Assignments tab, assign the users or groups to provision to Permit.
   • In the Push Groups tab, add the Okta groups to send to Permit. Each pushed group becomes a Permit role, and group members get that role. See How users, groups, and tenants relate.

Verify that users reach Permit

1. In the Permit dashboard, open the Directory screen. The users you assigned in Okta appear in the list of users.
2. Check that a user who is a member of a pushed group has the role named after that group.
3. If a user is missing, open the application in Okta and check the provisioning errors that Okta reports for the user.

Next steps

• SCIM provisioning with Permit
• SCIM integration with Entra ID
• Configure your first RBAC policy