Okta authorization for SCIM
Collibra supports only basic and bearer token authentication with JWT.
To set up basic authentication, you create a new SCIM application and authenticate with Collibra:
Sign in to your Okta Admin Console and go to Applications → Browse App Catalog.
Search for and select the SCIM 2.0 Test App (Basic Auth) application.
Click Add Integration.
Modify the application level.
Click Next to select the Sign-On options.
Select the required Sign-On method.
Click Done to create the application. Your newly created application appears in the list of Applications.
From the list of applications, select your new application → Provisioning → Integration.
Click Configure API Integration to enable the integration between Okta and Collibra SCIM.
Select the Enable API integration check box and enter the required information:
SCIM 2.0 Base Url: The endpoint of the Collibra SCIM API, for example https://<your_collibra_url>/rest/scim/v2.
Username: The user name of a dedicated Collibra user for this integration.
Password: The password of a dedicated Collibra user for this integration.
Click Test API Credentials. If your credentials are successfully verified, Okta displays a confirmation message.
Click Save to complete the process.
Obtain a client ID and secret
Sign in to your Okta Admin Console and go to Applications → Create App Integration.
In the Create a new app integration dialog box, select API Services.
Click Next.
In the New API Services App Integration section, enter the name of your integration.
Click Save. Your newly created application appears under Applications in Okta.
From the list of applications, open your new application.
Copy the Client ID and Client Secret for future use.
Obtain the sub and aud parameters
Sign in to your Okta Admin Console and go to Security → API.
Create a new scope:
In the Authorization servers section, select the default server → Scopes.
Click Add Scope.
In the Add Scope dialog box enter the required information.
Click Save and copy the scope name for future use.
Obtain the jwks_uri and issuer parameters:
In the Authorization servers section, select the default server → Settings.
Click the Metadata URI link.
From the JSON response, copy the jwks_uri and issuer values for future use.
Obtain an access token:
Send a POST request to the /v1/token endpoint of the issuer, using your client ID, secret, and scope name:
curl --request POST \ --url \<issuer\>/v1/token \ --header 'accept: application/json' \ --header 'authorization: Basic \<base64_encoded(client_id;client_secret)\>' \ --header 'cache-control: no-cache' \ --header 'content-type: application/x-www-form-urlencoded' \ --data 'grant_type=client_credentials&scope=\<scope_name\>'From the response, copy the access token.
Obtain the sub and aud parameters:
Decode the JWT with an application such as JWT.io.
Copy the sub and aud parameters for future use.
Register the JWKS endpoint with Collibra
Follow the instructions to Register the JWKS endpoint with Collibra and use the following values:
JSON Web Key Set URL
The jwks_uri from the JSON response of the Metadata URI link.
JWT Issuer
The issuer from the JSON response of the Metadata URI link.
JWT Audience
The aud parameter from the decoded JWT.
Create a user in Collibra
Follow the instructions to Create a user in Collibra for your client application account:
Username
The sub parameter from the decoded JWT.
User groups
Assign the user to a group that has elevated permissions such as Sysadmin or one that has similar permissions.
Create a SCIM application
Create a new SCIM application and authenticate with Collibra:
Sign in to your Okta Admin Console and go to Applications → Browse App Catalog.
Search for and select the SCIM 2.0 Test App (OAuth Bearer Token) application.
Click Add Integration.
Modify the application level.
Click Next to select the Sign-On options.
Select the required Sign-On method.
Click Done to create the application. Your newly created application appears under Applications in Okta.
From the list of applications, select your new application → Provisioning → Integration.
Click Configure API Integration to enable the integration between Okta and CollibraSCIM.
Select the Enable API integration check box and enter the required information:
SCIM 2.0 Base Url: The endpoint of the CollibraSCIM API, for example https://<your_collibra_url>/rest/scim/v2.
OAuth Bearer Token: Your JSON Web Token.
Click Test API Credentials. If your credentials are successfully verified, Okta displays a confirmation message.
Click Save to complete the process.
Map SCIM app attributes
Sign in to your Okta Admin Console and select your application from the Applications list.
Select Provisioning → To App.
In the Attribute Mappings section, click Go to Profile Editor.
Click Mappings to select the Sign-On options.
In the User Profile Mappings dialog box, edit or add your desired mappings.
Collibra supports a limited number of SCIM attributes.
Username
Personal
Configured in Sign On settings
Given name
Personal
user.firstName
Create and update
Family name
Personal
user.lastName
Create and update
Personal
user.email
Create and update
Primary email type
Personal
(user.email !=null && user.email !='') ? 'work':''
Create and update
Title
Personal
user.title
Create and update
Department
Personal
user.department
Create and update
Profile Url
Personal
user.profileUrl
Create
Primary phone
Personal
user.primaryPhone
Create and update
Primary phone type
Personal
(user.primaryPhone !=null && user.primaryPhone !='') ? 'work':''
Create and update
Address type
Personal
(user.addressType !=null && user.addressType !='') ? 'work':''
Create and update
Street address
Personal
user.streetAddress
Create and update
Locality
Personal
user.city
Create and update
Region
Personal
user.state
Create and update
Postal Code
Personal
user.zipCode
Create
Country
Personal
user.countryCode
Create and update
Locale Name
Group
user.locale
Create and update
Click Save Mappings.
You cannot assign roles to users via SCIM. However, you can manage groups and group membership in your IdP and disable the Groups DGC managed Console configuration option. Following the initial provisioning, your IdP groups are available in Collibra and you can start assigning roles to them.
Okta internally transmits an
externalIdattribute to Collibra, which maps it automatically.Collibra users have a single email address and an additional list of email addresses. In contrast, SCIM uses a list of email addresses. If the SCIM list contains only one email address or one of the email addresses is marked as primary, that email address becomes the Collibra user email address. If the SCIM list contains multiple email addresses and none is marked as primary, the operation returns an error.
Additional resources
Okta Users API
Okta Groups API
Last updated
Was this helpful?