SCIM provisioning with Okta

Connect Okta to Conduit with SCIM 2.0 so Okta automatically creates, updates, and deactivates Conduit users — and, optionally, materializes your Okta groups as Conduit teams. You configure this once: generate a token in Conduit, paste it into an Okta app, then assign users and groups.

This page is self-contained, but if you want the shared concepts — what SCIM provisions, how the shadow-user model works, and the other supported IdPs — see the SCIM provisioning overview.

Prerequisites:

• Owner or Admin on the Conduit organization (needed to generate the SCIM token).
• An Okta admin who can add applications and manage assignments.

---

Step 1 — Generate a SCIM token in Conduit

This first step is identical for every IdP and always happens in Conduit first.

1. In Conduit, go to Provisioning (/org/scim).
2. Click Connect IdP.
3. Choose Okta.
4. Pick the default role new SCIM-provisioned users will receive — member is the safe default.
5. Click Generate token.
6. Copy the Tenant URL and Secret token. They are shown only once — keep the tab open while you configure Okta.

Those two values — the Tenant URL and the secret token — are everything Okta needs.

---

Step 2 — Create the Okta app

1. In the Okta admin console, go to Applications → Browse App Catalog.
2. Search for and select SCIM 2.0 Test App (OAuth Bearer Token), then click Add Integration.
3. Give it a name (e.g. “Conduit”), then click Done.

Note

Use the OAuth Bearer Token variant specifically — Conduit authenticates SCIM requests with an HTTP header bearer token, which is what this catalog app sends.

Step 3 — Configure provisioning

1. Open the app and select the Provisioning tab, then click Configure API Integration.
2. Check Enable API integration.
3. Set Base URL to the Conduit Tenant URL, and API Token to the Secret token — both from Step 1.
4. Click Test API Credentials. Expect “the credentials provided were verified successfully”, then click Save.
5. Under Provisioning → To App, click Edit and enable:
   • Create Users
   • Update User Attributes
   • Deactivate Users
6. Click Save.

Step 4 — Assign users and push groups

1. Go to the Assignments tab → Assign → Assign to People (or Assign to Groups), pick who to provision, then Save and Go Back. Okta pushes assigned users immediately.
2. Optional — to materialize Okta groups as Conduit teams, open the Push Groups tab → + Push Groups → Find groups by name, select the group, choose Create Group under Match Result, then Save.

Note

Group membership only pushes for members who are also individually assigned to the app. Assign the group (or its people) under Assignments — pushing a group alone does not provision its members.

Okta dedupes users by userName, which is mapped to their email — the same email Conduit keys its shadow user records on.

---

How Conduit handles Okta

Okta is the best-behaved of the four IdPs Conduit supports. It speaks spec-compliant SCIM 2.0 (lowercase PATCH operations), so there are no Conduit-side quirks or workarounds to configure — the defaults in the steps above are all you need.

What gets provisioned

Okta action	Result in Conduit
User assignment (direct or via group)	users row + org_members row at the connection’s default role
Group push	org_teams row + org_team_members for each member
User deactivated / unassigned	org_members row removed; user marked inactive (re-activatable)

Note

SCIM creates a “shadow” user record keyed by email. A provisioned user still signs in through Conduit’s existing SSO — on first sign-in the shadow record binds to their identity.

Verify

After the first push, confirm the results in Conduit:

• /org/members — assigned users appear at the connection’s default role.
• /org/teams — any groups you pushed appear as teams, with their members.

Troubleshooting

• “Test API Credentials” returns 401 — the token is wrong or was revoked. In Conduit, generate a fresh token (Provisioning → Connect IdP) and paste the new Tenant URL and secret token into Okta.
• “User does not match a single SCIM user” — Okta dedupes by userName, mapped to email. Confirm the user’s Okta username is the exact email Conduit uses for them.
• Group push has no members — only group members who are also individually assigned to the app get pushed. Assign the group (or its people) under Assignments, then re-push.

Revoking access

To disconnect Okta, go to Conduit Provisioning (/org/scim) and click Revoke on the connection. The token is invalidated immediately, so Okta receives a 401 on its next sync. Teams and users the connection created remain in place until you remove them manually. See the overview for details.