Resource Access Management:Provision Okta users to RAM with SCIM

Prerequisites

• You have a RAM administrator or a RAM user with permissions to manage OAuth applications.

• You have an Okta administrator (Super Administrator) account.

Background information

• User creation: When you assign a user to the application in Okta, RAM automatically creates a RAM user with the same username. The domain suffix of the Okta username is replaced with the RAM user domain.

• User attribute updates: When you change user attributes in Okta, the changes are automatically synchronized to the corresponding RAM user. This depends on whether automatic attribute updates are enabled in Okta. Only UserName and DisplayName are supported.

• User deactivation: When you delete or unassign a user from the application in Okta, Okta sets the user status to active=false. RAM does not support enabling or disabling users, so the RAM user remains unchanged.

• Group provisioning: Okta group synchronization is not supported.

Step 1: Create and authorize an OAuth application

1. Create an OAuth application.

   1. Log on to the RAM console.

   2. In the left-side navigation pane, choose Integrations > OAuth (Preview).

   3. On the Enterprise Applications tab, click Create Application.

   4. On the Create Application page, set the application parameters.

      1. Enter an Application Name and a Display Name.

      2. For Application Type, select Native Application.

      3. Set the Access Token Validity Period.

      4. Set the Refresh Token Validity Period.

   5. Click Create Application.

2. Authorize the application scope.

   1. On the Enterprise Applications tab, click the name of the target application.

   2. On the OAuth Scope tab, click Add OAuth Scopes.

   3. In the Add OAuth Scopes panel, select /acs/scim.

   4. Click OK.

3. Create an application secret.

   1. Click the App Secrets tab and then click Create Secret.

   2. In the Create Secret dialog box, view and copy the application secret, and then click close.

      Important

      The application secret (AppSecretValue) is displayed only once. Copy and store it securely, because it cannot be retrieved later.

Step 2: Create an application in Okta

1. Log on to the Okta portal.

2. In the left-side navigation pane of the Okta Admin Console, choose Applications > Applications.

3. On the Applications page, click Create App Integration.

4. In the Create a new app integration dialog box, select SAML 2.0 and click Next.

5. On the General Settings page, enter an App name, such as AliyunSSODemo, and click Next.

6. On the Configure SAML page, set the following in the SAML Settings section, then click Next.

   • Single sign-on URL: Enter the Location value that you recorded in the previous step.

   • Audience URI (SP Entity ID): Enter the entityID value that you recorded in the previous step.

   • Default RelayState: URL to redirect users to after SSO logon. If left empty, users land on the Alibaba Cloud Management Console homepage.

     Note

     For security reasons, the Default RelayState value must be a URL under an Alibaba-owned domain, such as *.aliyun.com, *.hichina.com, *.yunos.com, *.taobao.com, *.tmall.com, *.alibabacloud.com, or *.alipay.com. Otherwise, the setting is ignored.

   • Name ID format: Select Persistent.

   • Application username: Select Email.

7. On the Feedback page, select an application type and click Finish.

Step 3: Configure SCIM provisioning in Okta

1. Enable SCIM provisioning.

   1. In the application you created in Step 2: Create an application in Okta, click the General tab.

   2. In the App Settings section, click Edit.

   3. Select Enable SCIM provisioning and click Save.

2. Configure SCIM connection parameters.

   1. Click the Provisioning tab.

   2. In the left-side navigation pane, click Integration.

   3. In the SCIM Connection section, click Edit and set the following parameters.

      • SCIM connector base URL: Enter https://scim.alibabacloud.com.

      • Unique identifier field for users: Enter userName.

      • Supported provisioning actions: Select Import New Users and Profile Updates and Push New Users.

        Note

        Push Profile Updates is optional. It controls whether attribute updates are automatically pushed.

      • Authentication Mode: Select OAuth 2.0.

   4. Configure OAuth 2.0 parameters.

      • Access token endpoint URI: Enter https://oauth.alibabacloud.com/v1/token.

      • Authorization endpoint URI: Enter https://signin.alibabacloud.com/oauth2/v1/auth.

      • Client ID: Enter the ID of the Alibaba Cloud OAuth application from Step 1: Create and authorize an OAuth application in the RAM console.

      • Client Secret: Enter the application secret from Step 1: Create and authorize an OAuth application in the RAM console.

   5. Click Save.

3. Obtain the redirect URL.

   1. On the Provisioning tab, click Integration in the left-side navigation pane.

   2. At the bottom of the page, click Authenticate with <App Name>.

   3. In the pop-up window, copy the redirect URL.

   4. Log on to the RAM console and add the redirect URL to the application from Step 1: Create and authorize an OAuth application in the RAM console.

   5. Return to the configuration page in Okta, click Authenticate with <App Name>, and then log on to the Alibaba Cloud console to complete the verification.

4. Configure user provisioning parameters.

   1. On the Provisioning tab, click To App in the left-side navigation pane.

   2. In the Provisioning to App section, click Edit.

   3. In the Create Users section, select Enable and then click Save.

      Note

      If you selected Push Profile Updates in the SCIM Connection settings, you must also select Update User Attributes and set it to Enable.

   4. In the <App Name> Attribute Mappings section, configure the attribute mappings. Remove unnecessary attributes and retain only the following attribute mappings.

      • Username (userName): Value is Configured in Sign On settings

      • Given name (givenName): Not mapped

      • Family name (familyName): Not mapped

      • Display name (displayName): Value is user.login, Apply on is Create and update

   5. On the Sign On tab, click Edit.

   6. Set Application username format to Okta username prefix and click Save.

5. Assign users to the application.

   1. On the Assignments tab, click Assign.

   2. Click Assign to People to assign users to the application.

Verify the result

After you complete these steps, Okta users are automatically provisioned to RAM. Log on to the RAM console and check the RAM user list. For provisioned users, Synchronization Type is set to SCIM User Synchronization.