Setting up SCIM provisioning with Okta

Anh Phung

Updated November 22, 2024 14:36

Productboard Product Team

In this article, you’ll learn how to set up SCIM provisioning with Okta.

SCIM provisioning allows you to manage all your accounts in one central location – Okta, from creation until deactivation.

To learn more about SCIM provisioning in Okta, please take a look at this Okta documentation.

Prerequisites

To get started, you’ll need the following:

An Okta subscription. If you don't have a subscription, you can sign up for a one-month free trial.
A Productboard single sign-on (SSO) configured and working Productboard application from Okta’s catalog. You can follow this article.

Note: If you have SAML SSO set up with custom app integration, please switch to Productboard application from Okta’s catalog.

Features

The following provisioning features are supported:

Push New Users
- New users created through OKTA will also be created in Productboard.
Push Profile Updates
- Updates made to the user's profile through OKTA will be pushed to Productboard.
Push User Deactivation
- Deactivating the user or disabling the user's access to the application through OKTA will deactivate the user in Productboard.
Reactivate Users
- User accounts can be reactivated in the application.
Import Users.
- Users created in Productboard can be imported into Okta and either matched against existing Okta users or created as new Okta users.
Push groups and manage members
- Groups from Okta will be created as teams in Productboard. Adding and removing group members in Okta will add and remove members in Productboard.
Delete Groups
- Groups removed in Okta are removed in Productboard.

Configuring SCIM provisioning

Go to

https://<your_workspace>.productboard.com/

Click on Profile menu, click on Settings, and navigate to SSO and SCIM settings.
Enable SCIM Provisioning. If you want to also use Group provisioning enable also Manage teams with SCIM.
Go to your Okta, and in your Productboard custom app integration, select the Provisioning tab. Then, click Configure API Integration.
Check Enable API provisioning.
Click on Authenticate with Productboard. You’ll be redirected to Productboard.
Enter your workspace subdomain.
Log in to Productboard with Okta.
Authorize Okta to access SCIM API.
Click on Save.
On the Provisioning tab, click To App and click Edit and check Productboard’s provisioning actions: Create users, Update user attributes, and Deactivate users. Then hit Save.
Continue with the Sign On tab, click Edit and select Email as the Application username format, and hit Save.

Provisioning your users

Users assigned before SCIM provisioning was enabled

Once you’ve enabled SCIM provisioning, all your user assignments will show an error (see the screenshot below). Click on Provision User and those errors will disappear. It schedules a job that links Okta users with members in Productboard. If there’s no such member in Productboard it creates a new member.

In Productboard, the existing users are now SCIM provisioned and won’t be editable. For example, the last user in the screenshot below isn’t SCIM provisioned and is still editable.

Screenshot_2022-12-20_at_20.18.17.png

Note: The Role in Okta and in Productboard does not match. At this point, every user in Okta seemingly has the admin role assigned. It’s not actually assigned to them though, it’s just the first option you can choose.

Once you choose the option and click Save it gets actually set and updated in Productboard. To learn more about how to handle Productboard roles in Okta, read this article.

Screenshot_2022-12-30_at_15.57.30.png

Provisioning new users

In your Productboard application in Okta, assign a new user.
Select the Role attribute.

Screenshot_2022-12-20_at_22.25.24.png

You should see the new user right away in Productboard. You can play around and test that everything is working.

Reactivating old users

Reactivating old users is the same as provisioning new users. Please follow the steps for provisioning a new user.

Provisioning your groups

Pushing groups

To create new team in Productboard or link a group to an existing team, open Push Groups tab and click on the Push Groups button, select Find groups by name.
Now search for a group you want to create (or link) and click on Save. You should see a new team in Productboard.

Teams in Productboard are all SCIM provisioned right away, therefore not editable. If you need to delete team that you don’t have in Okta, you can either create it in Okta, push it to Productboard app and then delete it or you can disable Manage teams with SCIM, remove the team in Productboard and enable Manage teams with SCIM again.

Adding and removing group members

To add members to the team, you need to add users to a group in Okta. Only users that are also assigned to the Productboard app will appear as team members.

Note: If the team and its members are not appearing in Productboard, please make sure that the group is pushed.

If you have a group (e.g. Productboard Contributors) that you want to have in Okta, but not in Productboard, assign it to Productboard app in Assignments, but do not push it in Push groups.
To remove members from a team, you should remove members from a group in Okta. If you unassign the whole group, all team members are going to be removed in Productboard, but the team won’t be deleted. Users that are no longer assigned to Productboard app though group or directly (Assign to People) will be deactivated in Productboard.

Deleting groups

There are 2 options how to delete a group and therefore a team in Productboard:

Assuming you previously pushed the group you want to delete now, you can just delete the group in Okta and the team in Productboard will be deleted too.
Assuming you previously pushed the group you want to delete now, you can delete the team in Productboard by choosing Unlink pushed group and then Delete the group in target app.