Okta Automated User Provisioning into WordPress using SCIM | Okta SCIM for WordPress

Overview

Configure real-time Okta user provisioning using SCIM for WordPress. Our SCIM User Provisioning plugin for WordPress allows you to automate user creation, update and delete user information from the IDP (identity provider) in real-time to your WordPress site. This guide will enable you to configure SCIM user provisioning for your WordPress site using Okta as the Identity Provider, to achieve seamless automated real-time Okta SCIM user provisioning for WordPress. In addition to real-time provisioning, the plugin also provides advanced features like attribute mapping, de-provisioning, SCIM audit logs, default role assignment, content reassignment, and multisite subsite selection. For a detailed overview of the features, check out the SCIM User Provisioning plugin for WordPress. You can follow the below steps to setup Okta SCIM user provisioning for WordPress.

Features

The following provisioning features are supported:

• Push New Users: New users created through Okta will also be created in the third party application.
• Push Profile Updates (Premium Feature): Updates made to the user's profile through Okta will be pushed to the third party application.
• Push User Deactivation (Premium Feature): Deactivating the user or disabling the user's access to the application through Okta will deactivate/delete the user in the third party application.

  Note: For this application, deactivating/delete a user will depend on the miniOrange SCIM user provisioning add-on.

• Reactivate Users (Premium Feature): User accounts can be reactivated in the application.

  Note: For reactivating the user it is required to select the Deactivation mode in the SCIM user provisioning add-on.

• Import Users (Premium Feature): Users can import active users from WordPress to Okta.
• Enhanced group push

Future Enhancements in the Plugin:

• Import Groups
• Sync password

Pre-requisites : Download And Installation

• Log into your WordPress instance as an admin.
• Go to the WordPress Dashboard -> Plugins and click on Add New.
• Search for a SCIM User Provisioning plugin for WordPress and click on Install Now.
• Once installed click on Activate.
• To get the premium plugin, please contact us at samlsupport@xecurify.com.

Follow the steps below for configuring Okta SCIM user provisioning in WordPress.

Step 1: Configure SCIM user provisioning plugin for WordPress

• Install the premium plugin and login using your miniOrange credentials.
• You would require a license key to activate the plugin.

  Note: In case you already have the paid version of the miniOrange SAML 2.0 SSO plugin you won’t require a login or license key.

• Select the Identity Provider as Okta from the dropdown.
• You can find the SCIM Base URL and Bearer token in the SCIM configuration tab of the plugin.

Step 2: Configure Okta for SCIM provisioning

• Go to Okta portal and login to your account.
• Navigate to Admin Portal > Applications and click on Browse App Catalog.

• Search for SSO with SCIM Provisioning and select the application.

• Click on the Add Integration button.

• Click on Done to configure the application further.

• Navigate to the Provisioning menu of the application and Click on the Configure API Integration button.

• Check the Enable API Integration box and enter the SCIM base URL in Base URL field and SCIM Bearer Token in API token field from the SCIM Configuration tab of the SCIM user provisioning plugin.
• Click on Test API Credentials; if successful, a verification message appears at the top of the screen.
• Click on Save button.

• Select To App in the left panel, then select the Provisioning Features you want to enable by clicking on Edit.

• Click on Save.
• You can now assign people to the app and finish the application setup.



With this guide, we have successfully configured SCIM user provisioning between WordPress and Okta as the identity provider (IDP) using the SCIM plugin for WordPress. This solution ensures that you are ready to roll out seamless and real-time Okta SCIM user provisioning for WordPress within minutes.

Step 3: Import WordPress Users to Okta (optional)

• If you want to push the WordPress user to Okta then you can follow the steps below. Otherwise you can Skip this section.
• Navigate to the provisioning section of the Okta app.
• Select To Okta in the left panel, then select the Import feature.
  • Schedule import: Choose an interval from the dropdown. Okta will check the list users to import users from WordPress.
  • Okta username format: Select “Email address”.

• User Creation & Matching
  • You can refer to the screenshot below to check default options.

Step 4: De-provisioning of Users [Available in premium plan]

• You can select the deprovisioning mode in the SCIM configuration tab of the SCIM User Provisioning plugin.
• By default, De-provisioning will delete the users from the WordPress site.

Step 5: Attribute Mapping for SCIM Users [Available in premium plan]

Attribute Mapping for SCIM Users in Okta

• This feature allows you to map any attribute sent by the IDP to the usermeta table of WordPress. You can follow the steps mentioned below to add the custom attributes in Okta.
• Navigate to the Provisioning tab in the SCIM app in Okta.

• Click on the Go to Profile Editor button.

• Click on the Add Attribute button to add the attribute(s).

• Fill details about the attribute and make sure to use the External namespace as urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User

• Click on Save button.
• Once you have added the attribute, navigate to the Mappings section.

• Select SSO with SCIM Provisioning app and choose the attributes to be mapped.
• Map the chosen attributes against the attribute you have created and save the mappings done by clicking Save Mappings button.

• You can repeat these steps for various attributes. To test if attributes are being sent by Okta assign a user to the Okta app which is not present in WordPress.
• Follow the steps given in the next section to map WordPress attributes to Okta.

Attribute Mapping for SCIM Users in WordPress

• Attribute Mapping feature allows you to map the user attributes sent by the IDP during SCIM Provisioning to the user attributes at WordPress. These attributes can be seen on right hand corner.
• Click on Add Attribute button to add custom attribute field.
• Under the Custom Attribute Name field, enter the attribute name you want to map.
• Under the Attribute Name from IDP field, select the IDP attribute from the dropdown that you want to map.
• Enable Show Attribute toggle for an attribute if you want to display it in the WordPress Users table. Click on Save button.

Step 6: SCIM Audit [Available in premium plan]

• SCIM Audit allows you to keep the track of all the provisioning activity taking place. It shows you the detailed information about each user being provisioned. This information includes the User Action, Status, Created Date etc.
• In the miniOrange SCIM User Provisioner plugin, navigate to the SCIM Audit tab.
• Here you can see all the User provision information.

• Click on the Show Advanced Search button, to search the provisioned user details by using the search filters like WordPress Username, IP Address etc.

• On clicking the Clear Reports button, you can clear all the user provisioned details.

Step 7: Additional Feature Configurations [Available in premium plan]

Set Default Role for New Users

When new users are created via SCIM provisioning, you can automatically assign roles:

• Go to Advanced Settings >> Default Role Provisioning
• Choose the role you want the new users to have (e.g. Manager)
• Turn on Update Existing User Role if you want already existing users’ roles to be updated during provisioning.

User Activation Status

You can easily check whether users are active or inactive.

• When enabled, a new column appears in the Users List in the WordPress dashboard.
• It shows whether each user is:
  • Activated (active in your IdP)
  • Deactivated (inactive in your IdP)
• This status updates automatically whenever users are added or removed via SCIM provisioning and deprovisioning.

Content Reassignment on User Deprovisioning

When a user is deleted via SCIM provisioning, you can decide what happens to their content.

• Choose a Default Content Owner to automatically take ownership of the content.
• Or select Do Not Reassign to permanently delete all the content.

Select Subsites for SCIM User Provisioning

• Select the subsites where users should be assigned after SCIM provisioning.
• Users will only get access to the selected subsites in the network.
• This helps to control access, restrict user assignment to specific subsites only, and keep user permissions organized.

Schema Discovery

• miniOrange SCIM user provisioning plugin doesn’t support Schema Discovery.

Troubleshooting Tips

• Note: WordPress doesn't allow to change userName of a user. You can change the email but not the username.

Related Articles

• What is SCIM User Provisioning?
• User Data Synchronization
• Azure AD SCIM User Provisioning for WordPress
• OneLogin SCIM User Provisioning for WordPress
• Frequently Asked Questions (FAQs)

If you are looking for anything which you cannot find, please drop us an email on samlsupport@xecurify.com

Why Our Customers choose SCIM User Provisioning Integration ?