78 lines
4.0 KiB
Plaintext
78 lines
4.0 KiB
Plaintext
---
|
|
title: "Setting up SCIM with Okta"
|
|
---
|
|
1. Set SAML_DATABASE_URL to a Postgres database. Please use a different database than the main Cal instance since the migrations are separate for this database. For example `postgresql://postgres:@localhost:5450/cal-saml`. If you are using a self-signed certificate for Postgres then use the `sslmode=no-verify` query param in the database URL. For example `postgresql://postgres:@localhost:5450/cal-saml?sslmode=no-verify`.
|
|
2. Set SAML_ADMINS to a comma separated list of admin emails who can configure the OIDC.
|
|
3. Create an application with your OIDC provider. For example, in Okta, once you create an account, you can click on Applications on the sidebar menu:
|
|
<Frame>
|
|
<img src="//images/i1600x900-oVjaQ0tU3AnO_wrzp85.png" />
|
|
</Frame>
|
|
4. Click on `Create App Integration`
|
|
<Frame>
|
|
<img src="//images/i1600x900-wrIlZkLdZ6kL_wf7mxn.png" />
|
|
</Frame>
|
|
5. Select SAML or OIDC in the modal form, along with Web App and click Next.
|
|
- Note you will have to fill in the appropriate fields for the SAML or OIDC setup to continue.
|
|
- [SAML Setup](/docs/introduction/quick-start/self-hosting/sso-setup#setting-up-saml-login)
|
|
- [OIDC Setup](/docs/how-to-guides/how-to-setup-oidc-with-okta)
|
|
<Frame>
|
|
<img src="//images/i1600x900-IfRWYg8XuCMI_tkwyft.png" />
|
|
</Frame>
|
|
6. Once the application is created, under General -> App Settings, click "Edit" and click the checkbox "Enable SCIM provisioning
|
|
"
|
|
<Frame>
|
|
<img src="/images/scim/app-settings-enable-scim.png" />
|
|
</Frame>
|
|
7. Next go to your instance of Cal.com and navigate to `{BASE_URL}/settings/organization/dsync` and click configure.
|
|
<Frame>
|
|
<img src="/images/scim/dsync-configure.png" />
|
|
</Frame>
|
|
8. In the "Configure Directory Sync" from choose a directory sync name and choose "Okta SCIM v2.0" as the "Directory Provider"
|
|
<Frame>
|
|
<img src="/images/scim/dsync-configure-provider.png" />
|
|
</Frame>
|
|
9. Take note of the "SCIM Base URL" and "SCIM Bearer Token"
|
|
<Frame>
|
|
<img src="/images/scim/dsync-configure-info.png" />
|
|
</Frame>
|
|
10. Okta go to your application. Navigate to the "Provisioning" tab and click "Integration" under "Settings".
|
|
<Frame>
|
|
<img src="/images/scim/okta-dsync-options.png" />
|
|
</Frame>
|
|
- Under "SCIM connector base URL" enter the "SCIM Base URL" from Cal.com
|
|
- Under "Unique identifier field for users" enter "email"
|
|
- Under "Supported provisioning actions" enable:
|
|
- "Import New Users and Profile Updates"
|
|
- "Push New Users"
|
|
- "Push Profile Updates"
|
|
- "Push Groups"
|
|
- Under "Authentication Mode" choose "HTTP Header"
|
|
- Under "Authentication" enter the "SCIM Bearer Token" from Cal.com
|
|
- When you hit save it will make a test call to the "SCIM Base URL"
|
|
11. When you hit save navigate to "To App" settings, still under the "Provisioning" tab
|
|
12. Under "Provisioning to App" click "Edit" and enable:
|
|
- "Create User"
|
|
- "Update User Attributes"
|
|
- "Deactivate User"
|
|
12. Under "`{Your application name}` Attribute Mapping", remove all fields except for:
|
|
- "username"
|
|
- "givenName"
|
|
- "familyName"
|
|
- "email"
|
|
- "displayName"
|
|
13. Set each of these of these properties to "Map from Okta Profile" and the related field. Under "Apply On" select "Create and Update"
|
|
<Frame>
|
|
<img src="/images/scim/okta-property-settings.png" />
|
|
</Frame>
|
|
14. You can now assign users and groups to the app.
|
|
|
|
## Mapping Okta Groups to Cal.com Teams
|
|
When provisioning groups to your organization, Okta groups can be mapped to teams within your organization and users will be auto assigned to these teams.
|
|
|
|
On `{BASE_URL}/settings/organization/dsync` there is a table with the teams under your organization. Click on "Add group name" to map the Okta group to the team. **Note:
|
|
The group name must be spelt exactly as it is shown on Okta.**. When you push the group to your organization then those users will automatically be added to the team.
|
|
|
|
<Frame>
|
|
<img src="/images/scim/group-team-mapping.png" />
|
|
</Frame>
|