New article
Recently updated
Setting up SCIM for Okta SAML
Who is this article for?
Administrators responsible for managing organization security settings in Mazlan Home.
Admin Console access is required.
You can configure SCIM so Okta automatically creates, updates and deactivates users in Mazlan Home. SCIM is enabled per external identity provider, so Okta must first be set up in Mazlan Home as an external identity provider using SAML. Mazlan Home is a custom app, Okta supports SCIM provisioning only for SAML connections, not OIDC.
This article outlines how to enable SCIM in Mazlan Home and link it to an app in Okta.
Enabling SCIM in Mazlan Home
To enable SCIM in Mazlan Home:
- Sign in to Mazlan Home.
- Navigate to the Admin Console.
- Go to the Security Center.
- Select SCIM Configuration and Configure.
- In the Identity Providers list, find the Okta IdP and toggle to enable SCIM.
- Once SCIM is enabled, the Client ID and Client Secret are revealed.
- Copy the SCIM base URL, Token endpoint, Client ID and Client Secret for use in your Okta configuration.
Configuring SCIM in Okta
To configure SCIM in your Okta SAML app:
- Sign in to your Okta admin console.
- Navigate to Applications > Applications.
- Select the Mazlan Home SAML app you created for single-sign on (the one set up as your external identity provider).
- On the General tab, under App Settings, click Edit.
- Set Provisioning to SCIM.
- Click Save. A Provisioning tab appears.
- On the Provisioning tab, select Integration and click Edit.
- Enter the SCIM base URL copied from Mazlan Home.
- Set Unique identifier field for users to
userName. - Under Supported provisioning actions, tick Import New Users and Profile Updates, Push New Users and Push Profile Updates. Leave Push Groups and Import Groups unticked.
- Set Authentication Mode to OAuth2 and Grant type to Client Credentials.
- Enter the Token endpoint, Client ID, Client secret and Scope copied from Mazlan Home.
-
Click Save.
Attribute mapping
The following Okta user profile attributes are synced to Mazlan Home.
| Okta attribute | Mazlan Home field | Notes |
|---|---|---|
Username (login) |
Username | Required. Cannot be changed through SCIM after the user is created |
Given name (givenName) |
First name | Required. |
Family name (familyName) |
Last name | Required. |
Email (email) |
Required. | |
Display name (displayName) |
Display name | Optional. |
Title (title) |
Job title | Optional. |
Mobile phone (mobilePhone) |
Mobile number | Optional. Must be in international format (E.164), for example +15551234567. Values in any other format will be left blank in Mazlan Home. |
Time zone (timezone) |
Time zone | Optional. Defaults to Europe/London if not sent. Must be a supported time zone. |
Preferred language (preferredLanguage) |
Preferred language |
Optional. Supports the following values: as, bn, zh-cn, hr, cs, da, nl, en-gb, en-us, fi, fr, de, gu, hi, hu, id, it, ja, kn, ko, ms, ml, mr, nb, or, pl, pt, pt-br, pa, ro, ru, sr, sk, sl, es, es-ar, sv, ta, te, th, tr, uk, vi Defaults to en-gb if not sent |
For mobile phone:
- Go to Applications and Resources > Applications
- Select your SAML Application
- On the tab, Select Provisioning
Under to App, scroll down to Go to Profile Editor
Click on Add Attribute
-
Key in the following:
Data Type: string
Display Name: Mobile Phone
Variable name: mobilePhone
External Name: phoneNumbers.^[type=='mobile'].value
External namespace: <your-external-namespace>
Under Mappings, map the newly created Mobile Phone to the Okta User User Profile's mobilePhone
Attributes that are not synced: Middle name, Honorific prefix and suffix, Nickname, Profile URL, Secondary email, Primary phone, address fields (Street address, City, State, Zip code, Country code, Postal address), User type, Employee number, Cost center, Organization, Division, Department, Manager ID and Manager. Roles and passwords are also not synced.
Important notes
Groups are reserved for future use. Mazlan Home can receive groups and their membership from Okta, but no Ideagen application uses groups yet. Syncing them doesn’t affect user roles, permissions or access, and you don’t need to sync groups to provision users. Groups can only be created, renamed or deleted in Okta, which is the source of truth, so they can’t be changed in Mazlan Home. We’ll share more on how groups map to roles and permissions once applications start using them.
- Each new user gets the standard User role, and is assigned your organisation’s default product instances. Tenant Administrators can change roles and instance assignments in Mazlan Home.
- Email must be filled in. Mazlan Home uses email as the primary means of contacting the user. If the user does not have an email, please refer to Handling users without an email address for further guidance.
- Phone numbers must be in E.164 format. Okta does not enforce this, so check your users’ phone numbers before you enable provisioning. Otherwise, the phone number will be left blank.
- Using more than one identity provider. Each IdP has its own SCIM setup and credentials. Usernames must be unique within your organisation. If a second IdP tries to provision a username that is already linked to another IdP, Mazlan Home links that IdP to the existing user.
- Deleting an identity provider. If you delete an identity provider configuration in Mazlan Home, its SCIM credentials are revoked and syncing stops. Users and groups that were already provisioned are not removed.
Further reading
- Setting up OKTA for SAML-based Single Sign-On (SSO)
- Configuring Single Sign-On (SSO) for Mazlan Home
- Troubleshooting Single-Sign On (SSO) with an external identity provider (IdP)