Okta SCIM (Beta)
Configure SCIM provisioning to Panther using Okta
Okta SCIM provisioning is in open beta starting with Panther version 1.75, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
Panther supports managing users via System for Cross-domain Identity Management (SCIM) provisioning with Okta. SCIM is a standard designed to manage user identity between multiple systems (such as Panther and Okta) from a single location. This allows you to manage Panther roles, update profiles, and activate or deactivate users through Okta.
- Update user profiles
- Given name, family name, email, custom Panther role
- Activate and deactivate users
Note the following limitations:
- Panther SCIM only supports the
- If a user is a member of multiple Groups, the attributes from the group assigned first will be used.
/GroupsSCIM endpoint is not supported.
- Create / Import
Usersis not supported, as
Userprofiles are created through SAML SSO the first time a
Userlogs in to the Panther Console. If you change a user's profile before they have logged in for the first time, you may see an error in Okta.
- When SCIM is enabled, any changes you make to users via the Panther Console will be overwritten the next time your Okta SCIM setup syncs to Panther.
- 1.In the upper right corner of your Panther Console, click the gear icon. In the dropdown menu, click API Tokens.
- 2.On the API Tokens page, click Create New Token.
- Provide a Name, such as
- Grant the token the ability to Manage Users (or
UserModifyif creating the token via API).
- Note: Read User Info is an inherent permission from Manage Users.
- 3.Click Create API Token.
- 4.Copy the API token value and store it in a secure location. You will need it in the next steps.
- You will not be shown this token again after closing this page.
- 1.In your Okta account, navigate to the Panther application you created to enable SAML SSO.
- 2.Under General Settings, enable the SCIM Provisioning app setting:
- 3.Click the Provisioning tab, then on the left side, click Integration. In the upper right side of the page, click Edit.
- 4.Edit the configuration settings with the following values:
- Authentication Mode: In the drop-down, select
HTTP Header. After you select this, an "HTTP Header" section appears below.
- Authorization: Paste the API Token value you generated in Step 1.
- SCIM connector base URL: Enter the Tenant URL from your Panther Console.
- To get this value: In the Panther Console, navigate to the General Settings page and select the Identity & Access tab.The Tenant URL is in the SCIM Provisioning Setup section.
- Unique identifier field for users: Enter the field that you use as a unique identifier for your users, such as
- Supported provisioning actions: Select
Push Profile Updates.
- 3.Click Save. Okta will verify the SCIM connection to Panther.
- If an error occurs, verify the SCIM connection URL value is the Tenant URL from your Panther Console, then try again a minute later. When using a new API token, it may take up to a minute for the token to become active.
After verifying the SCIM connection in the previous step, a new page will appear in Okta to configure the settings to sync from Okta to Panther.
- 1.Click the Provisioning tab. On the left side, click To App and then click Edit.
- 2.Enable the options Update User Attributes and Deactivate Users:
To automatically assign a Panther role (e.g., Admin, ReadOnlyAnalyst, or one of your custom roles) to a user, create a new attribute in the Panther User Profile in Okta with the name
PantherRole. This attribute can also be used as an Attribute Statement for SAML assertion when configuring SSO (see step 5 below).
Any values assigned to this role will sync to Panther. If you do not provide a valid role name, an error will occur and no user update will occur until a valid role name is provided.
- 1.On the To App settings page, scroll down to the Panther Attribute Mappings section. Click Go to Profile Editor.
- 2.On the Profile Editor page, click Add Attribute
- 3.Use the following values for the new attribute. Any unlisted fields may remain unchanged.
- Data type:
- Display name:
- Variable name:
- External name:
- External namespace:
- 4.Click Save.
- 5.While it is not required, we recommend you configure an additional attribute statement for
PantherRole(in addition to the three you already configured during Okta SSO setup). This will ensure that when a user logs into Panther via Okta SSO, the user's
PantherRolewill sync as a SAML assertion.
- 1.In Okta, navigate to the General tab.
- 2.In the SAML Settings section, click Edit.
- 3.Under Attribute Statements, add a fourth attribute:
- 4.Click Continue, then Save.
- When assigning a new group or user, a prompt will appear to define which Panther role to assign to the group.
- To modify an existing entity's Panther role, click the Assignments tab, edit the user or group, and modify the
Panther Rolefield. If no
Panther Roleattribute is assigned, Panther will use the default SAML role you have selected in the Panther console.
If you do not see changes sync to Panther, please wait a few minutes then try again.