Okta authorization for SCIM
Collibra supports only basic and bearer token authentication with JWT.
- Basic authentication
- JWT authentication
To set up basic authentication, you create a new SCIM application and authenticate with Collibra:
- Sign in to your Okta Admin Console and go to Applications → Browse App Catalog.
- Search for and select the SCIM 2.0 Test App (Basic Auth) application.
- Click Add Integration.
- Modify the application level.
- Click Next to select the Sign-On options.
- Select the required Sign-On method.
- Click Done to create the application.
Your newly created application appears in the list of Applications.
- From the list of applications, select your new application → Provisioning → Integration.
- Click Configure API Integration to enable the integration between Okta and Collibra SCIM.
- Select the Enable API integration check box and enter the required information:
- SCIM 2.0 Base Url: The endpoint of the Collibra SCIM API, for example https://<your_collibra_url>/rest/scim/v2.
- Username: The user name of a dedicated Collibra user for this integration.
- Password: The password of a dedicated Collibra user for this integration.
- Click Test API Credentials.
If your credentials are successfully verified, Okta displays a confirmation message.
- Click Save to complete the process.
The following table summarizes acquiring and using JWT in Collibra REST API requests.
Process |
Steps |
---|---|
Initial setup |
|
When your application starts |
|
When your application calls the Collibra REST APIs |
|
Obtain a client ID and secret
- Sign in to your Okta Admin Console and go to Applications → Create App Integration.
- In the Create a new app integration dialog box, select API Services.
- Click Next.
- In the New API Services App Integration section, enter the name of your integration.
- Click Save.
Your newly created application appears under Applications in Okta.
- From the list of applications, open your new application.
- Copy the Client ID and Client Secret for future use.
Obtain the sub and aud parameters
- Sign in to your Okta Admin Console and go to Security → API.
- Create a new scope:
- In the Authorization servers section, select the default server → Scopes.
- Click Add Scope.
- In the Add Scope dialog box enter the required information.
- Click Save and copy the scope name for future use.
- Obtain the jwks_uri and issuer parameters:
- In the Authorization servers section, select the default server → Settings.
- Click the Metadata URI link.
- From the JSON response, copy the jwks_uri and issuer values for future use.
- Obtain an access token:
- Send a POST request to the /v1/token endpoint of the issuer, using your client ID, secret, and scope name:
curl --request POST \ --url <issuer>/v1/token \ --header 'accept: application/json' \ --header 'authorization: Basic <base64_encoded(client_id;client_secret)>' \ --header 'cache-control: no-cache' \ --header 'content-type: application/x-www-form-urlencoded' \ --data 'grant_type=client_credentials&scope=<scope_name>'
- From the response, copy the access token.
- Send a POST request to the /v1/token endpoint of the issuer, using your client ID, secret, and scope name:
- Obtain the sub and aud parameters:
- Decode the JWT with an application such as JWT.io.
- Copy the sub and aud parameters for future use.
Register the JWKS endpoint with Collibra
Follow the instructions to Register the JWKS endpoint with Collibra and use the following values:
Collibra Console field | Value |
---|---|
JSON Web Key Set URL | The jwks_uri from the JSON response of the Metadata URI link. |
JWT Issuer | The issuer from the JSON response of the Metadata URI link. |
JWT Audience | The aud parameter from the decoded JWT. |
Create a user in Collibra
Follow the instructions to Create a user in Collibra for your client application account:
User details | Value |
---|---|
Username | The sub parameter from the decoded JWT. |
User groups | Assign the user to a group that has elevated permissions such as Sysadmin or one that has similar permissions. |
Create a SCIM application
Create a new SCIM application and authenticate with Collibra:
- Sign in to your Okta Admin Console and go to Applications → Browse App Catalog.
- Search for and select the SCIM 2.0 Test App (OAuth Bearer Token) application.
- Click Add Integration.
- Modify the application level.
- Click Next to select the Sign-On options.
- Select the required Sign-On method.
- Click Done to create the application.
Your newly created application appears under Applications in Okta.
- From the list of applications, select your new application → Provisioning → Integration.
- Click Configure API Integration to enable the integration between Okta and CollibraSCIM.
- Select the Enable API integration check box and enter the required information:
- SCIM 2.0 Base Url: The endpoint of the CollibraSCIM API, for example https://<your_collibra_url>/rest/scim/v2.
- OAuth Bearer Token: Your JSON Web Token.
- Click Test API Credentials.
If your credentials are successfully verified, Okta displays a confirmation message.
- Click Save to complete the process.
Map SCIM app attributes
- Sign in to your Okta Admin Console and select your application from the Applications list.
- Select Provisioning → To App.
- In the Attribute Mappings section, click Go to Profile Editor.
- Click Mappings to select the Sign-On options.
- In the User Profile Mappings dialog box, edit or add your desired mappings.
Collibra supports a limited number of SCIM attributes.
Attribute Attribute Type Value Apply on Username Personal Configured in Sign On settings Given name Personal user.firstName
Create and update Family name Personal user.lastName
Create and update Email Personal user.email
Create and update Primary email type Personal (user.email !=null && user.email !='') ? 'work':''
Create and update Display name Personal user.displayname
Create and update Profile Url Personal user.profileUrl
Create Primary phone Personal user.primaryPhone
Create and update Primary phone type Personal (user.primaryPhone !=null && user.primaryPhone !='') ? 'work':''
Create and update Address type Personal (user.addressType !=null && user.addressType !='') ? 'work':''
Create and update Street address Personal user.streetAddress
Create and update Locality Personal user.city
Create and update Region Personal user.state
Create and update Postal Code Personal user.zipCode
Create Country Personal user.countryCode
Create and update Locale Name Group user.locale
Create and update - Click Save Mappings.
You cannot assign roles to users via SCIM. However, you can manage groups and group membership in your IdP and disable the Groups DGC managed Console configuration option. Following the initial provisioning, your IdP groups are available in Collibra and you can start assigning roles to them.