# Okta SCIM (Beta)
{% hint style="info" %}
Okta SCIM provisioning is in open beta starting with Panther version 1.75 and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}
## Overview
Panther supports managing users via System for Cross-domain Identity Management (SCIM) provisioning with Okta. SCIM is a standard designed to manage user identity between multiple systems (such as Panther and Okta) from a single location. This allows you to manage Panther roles, update profiles, and activate or deactivate users through Okta.
### Supported SCIM Features
* Update user profiles
* Given name, family name, email, custom Panther role
* Activate and deactivate users
### Limitations
Note the following limitations:
* Panther SCIM only supports the `eq` filter operation.
* Users are only `deactivated`, never deleted.
* If a user is a member of multiple Groups, the attributes from the group assigned first will be used.
* The `/Groups` SCIM endpoint is not supported.
* Create / Import `Users` is not supported, as `User` profiles are created through SAML SSO the first time a `User` logs in to the Panther Console. If you change a user's profile before they have logged in for the first time, you may see an error in Okta.
* When SCIM is enabled, any changes you make to users via the Panther Console will be overwritten the next time your Okta SCIM setup syncs to Panther.
## How to configure SCIM to Panther with Okta
### Prerequisites
* [Okta SSO](https://docs.panther.com/~/changes/15ann7vKLltCCAGHtdQr/system-configuration/saml/okta) must be enabled.
* You must be logged in to Panther with admin privileges.
* You must be an administrator in your Okta account.
### Step 1: Create a new Panther API Token
1. In the upper right corner of your Panther Console, click the gear icon. In the dropdown menu, click **API Tokens.**
2. On the API Tokens page, click **Create New Token.**
* Provide a **Name**, such as `Panther-Okta-SCIM`.
* Grant the token the ability to **Manage Users** (or `UserModify` if creating the token via API).
* Note: **Read User Info** is an inherent permission from **Manage Users**.
3. Click **Create API Token**.
4. Copy the API token value and store it in a secure location. You will need it in the next steps.
* You will not be shown this token again after closing this page.
### Step 2: Set up SCIM Provisioning in your Panther Okta application
Note: [Okta SSO](https://docs.panther.com/~/changes/15ann7vKLltCCAGHtdQr/system-configuration/saml/okta) must already be configured and enabled.
1. In your Okta account, navigate to the Panther application you created to enable SAML SSO.
2. Under **General Settings**, enable the SCIM Provisioning app setting:
3. Click the **Provisioning** tab, then on the left side, click **Integration**. In the upper right side of the page, click **Edit.**
4. Edit the configuration settings with the following values:
* **Authentication Mode:** In the drop-down, select `HTTP Header`. After you select this, an "HTTP Header" section appears below.
* **Authorization**: Paste the API Token value you generated in Step 1.
* **SCIM connector base URL**: Enter the Tenant URL from your Panther Console.
* To get this value: In the Panther Console, navigate to the **General Settings** page and select the **Identity & Access** tab.The **Tenant URL** is in the SCIM Provisioning Setup section.
* **Unique identifier field for users**: Enter the field that you use as a unique identifier for your users, such as `email`.
* **Supported provisioning actions**: Select `Push Profile Updates`.
3. Click **Save**. Okta will verify the SCIM connection to Panther.
* If an error occurs, verify the **SCIM connection URL** value is the **Tenant URL** from your Panther Console, then try again a minute later. When using a new API token, it may take up to a minute for the token to become active.
## Step 3: Configure Okta to Panther Settings
After verifying the SCIM connection in the previous step, a new page will appear in Okta to configure the settings to sync from Okta to Panther.
1. Click the **Provisioning** tab. On the left side, click **To App** and then click **Edit**.
2. Enable the options **Update User Attributes** and **Deactivate Users**:
3. If you want to configure settings to automatically assign Panther roles, go to the next section. Otherwise, click **Save** and move on to [Step 4: Assign users to Panther](#step-4-assign-users-to-panther).
#### Optional: Automatically assign a Panther role
To automatically assign a Panther role (e.g., Admin, ReadOnlyAnalyst, or one of your custom roles) to a user, create a new attribute in the Panther User Profile in Okta with the name `PantherRole`. This attribute can also be used as an Attribute Statement for SAML assertion when configuring SSO (see step 5 below).
Any values assigned to this role will sync to Panther. If you do not provide a valid role name, an error will occur and no user update will occur until a valid role name is provided.
1. On the **To App** settings page, scroll down to the **Panther Attribute Mappings** section. Click **Go to Profile Editor**.\
2. On the **Profile Editor** page, click **Add Attribute**
3. Use the following values for the new attribute. Any unlisted fields may remain unchanged.
* **Data type**: `string`
* **Display name**: `Panther Role`
* **Variable name**: `pantherRole`
* **External name**: `pantherRole`
* **External namespace**: `urn:ietf:params:scim:schemas:core:2.0:User`
4. Click **Save**.
5. While it is not required, we recommend you configure an additional attribute statement for `PantherRole` (in addition to the [three you already configured during Okta SSO setup](https://docs.panther.com/~/changes/15ann7vKLltCCAGHtdQr/system-configuration/saml/okta/..#create-the-okta-app)). This will ensure that when a user logs into Panther via Okta SSO, the user's `PantherRole` will sync as a SAML assertion.
1. In Okta, navigate to the **General** tab.
2. In the **SAML Settings** section, click **Edit**.
3. Under **Attribute Statements**, add a fourth attribute:
* **Name**: `PantherRole`
* **Value**: `appuser.pantherRole`
4. Click **Continue**, then **Save**.
### Step 4: Assign users to Panther
1. In Okta, click the **Assignments** tab.
2. Assign the Panther application to users and groups.
* Users: Follow Okta's documentation for [instructions on assigning applications to users](https://help.okta.com/oie/en-us/Content/Topics/users-groups-profiles/usgp-assign-apps.htm).
* Groups: Follow Okta's documentation for [instructions on assigning applications to groups](https://help.okta.com/oie/en-us/Content/Topics/users-groups-profiles/usgp-assign-app-group.htm).
If you set up the optional `PantherRole` in [Step 3](#step-3-configure-okta-to-panther-settings), you may assign individuals or groups Panther roles:
* When assigning a new group or user, a prompt will appear to define which Panther role to assign to the group.
* To modify an existing entity's Panther role, click the **Assignments** tab, edit the user or group, and modify the `Panther Role` field. If no `Panther Role` attribute is assigned, Panther will use the default SAML role you have selected in the Panther console.
If you do not see changes sync to Panther, please wait a few minutes then try again.
