SCIM (system for cross-domain identity management) lets Okta communicate with Gumloop on a recurring basis: Okta tells Gumloop which users should have access — and which should not — along with useful user attributes. Gumloop uses this to provision, deprovision, and update users automatically (see SSO, SAML & SCIM). Connecting Okta to Gumloop requires sharing two pieces of information with Okta, both of which come from Gumloop:

1. A base URL that Okta will perform operations on (e.g. via HTTP PATCH)
2. A bearer token that Okta will include with its requests

​

Before you start: get your base URL and bearer token from Gumloop

SCIM is an Enterprise add-on — a Gumloop organization admin requests enablement via support@gumloop.com, then generates a setup link at gumloop.com/settings/organization/sso. The setup page shows your SCIM base URL and lets you generate the bearer token.

​

Configuring Okta

Start by navigating to the relevant application in Okta. If you are unsure how to create such an Application, please review the SAML with Okta guide for an in-depth explanation. Make sure you’re on the General tab and press Edit on the App Settings card. Make sure the Provisioning box shows a checkmark. By default, Okta leaves this box unchecked. Press Save in the lower right corner. Navigate to the Provisioning tab for the Application. On the Provisioning tab, click the Edit button toward the top right of the card. Look for a field marked SCIM connector base URL. This is the base URL from your Gumloop SCIM setup page. Paste it here. Next, look for a field marked Unique identifier field for users. We need this to say “email” exactly. Gumloop relies on users’ emails as a unique identifier. Look for a series of checkboxes labeled Supported provisioning actions. You will see five checkboxes. Set your configuration to match the following:

• Import New Users and Profile Updates
• Push New Users
• Push Profile Updates
• Push Groups
• Import Groups

Ensure that Import Groups remains unchecked. The SCIM Connection will fail otherwise. Now look for a dropdown menu labeled Authentication Mode. This must change from its default value to HTTP Header. Now paste the bearer token from Gumloop in the field marked Authorization. Then once more hit Save in the lower right. Now look in the sidebar to the left and find the item marked To App. Click this. You’ll see four checkboxes. Set them to match the following:

• Create Users
• Update User Attributes
• Deactivate Users
• Sync Password

Then press Save in the lower right. Now navigate to the Assignments tab. Using the Assign dropdown, choose to assign the relevant People (i.e. users) or Groups. This guide uses People. You’ll now see a list of People. For each that you wish to assign to the Application, press the Assign button to the right. You’ll have the opportunity to edit this person’s attributes, but it’s usually fine just to scroll down and press Save and Go Back. Unless you wish to add other People to the Application, you can now press Done. Okta is now pushing users to Gumloop.

​

Enabling synchronization in Gumloop

Pushed users only reach your organization once synchronization is enabled on the Gumloop side. A Gumloop organization admin returns to gumloop.com/settings/organization/sso, selects the SCIM directory, and enables synchronization — see Setting Up SCIM. Once enabled, configuration is complete: assigned users appear in your organization’s member list after the next sync (automatic every 15 minutes, or triggered manually by the admin).