How to provision users to Code42 from Okta

Overview

Provisioning automatically adds and deactivates users in your Code42 environment as well as assigns users roles and permissions. This article explains how to connect Okta provisioning and Code42. Once configured, Code42 automatically adds, updates, and removes users based on syncs from Okta to Code42.

This article assumes you are familiar with the concept of provisioning. To learn more, see our introduction to provisioning. If you want to add Okta as an authentication provider, see Configure Okta for SSO in your Code42 cloud environment. 

Considerations

• To enable Okta's provisioning in Code42, your Okta environment must be licensed for the Lifecycle Management feature. If you are not licensed for the feature, you can still use Okta for authentication.  
• Configure your private network, Internet, and VPN settings to allow client devices to communicate with your provisioning provider on port 443. Test client connectivity to the provisioning provider before you proceed.
• Local users cannot be created, updated, or deleted from the provisioning provider. These users can only be managed in the Code42 console. 

Before you begin

Step 1: Create Code42 organizations

This step is only required if you choose to use the Single Organization or Custom SCIM mapping methods. The "c42OrgName" attribute and Custom attribute methods create Code42 organizations automatically. 

Step 2: Add a provisioning provider in the Code42 console

Step 3: Add the Okta application for Code42

Step 4: Configure Okta's provisioning tab

1. In the Okta dashboard, select the Provisioning tab of the Code42 app. 
2. Click Configure API Integration. 
   
3. Select Enable API Integration.
4. Enter the Base URL, Username, and Password generated from the Code42 console (Step 2). 
5. Click Test API Credentials.
   A success message appears. 
6. Click Save. 
7. Under Settings, click To App. 
8. Select Edit. 
9. Enable the following settings: 
   • Create Users
   • Update User Attributes
   • Deactivate User
10. Click Save. 
11. Add additional attributes if needed in the Code42 Attribute Mappings section. 
    For example, if you use the Departing Employees list and would like to display employee information for the departing employees, you must first add the attributes to the Code42 app in Okta. (These attributes must be mapped to fields with valid values. For reference information about attribute mapping, see Okta's regex documentation or the SCIM specification.)
    1. In the Provisioning tab of the Code42 app, scroll to the Code42 Attribute Mappings section. 
    2. Click Go to Profile Editor.
    3. Click Add Attribute. 
    4. Add the following supported attributes. After adding each one, click Save and Add Another.

       • Country 

         • Data type: country code
           Country codes mapped to Code42 must be valid 2-character codes. To convert non-2 character codes to 2-character codes, see Okta's documentation.
         • Display name: Country
         • Variable name: country
         • External name: addresses.^[primary==true].country
         • External namespace: urn:ietf:params:scim:schemas:core:2.0:User

       • Department

         • Display name: Department
         • Variable name: department
         • External name: department
         • External namespace: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

       • Division

         • Display name: Division
         • Variable name: division
         • External name: division
         • External namespace: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
       • Locality
         • Display name: Locality
         • Variable name: locality
         • External name:  addresses.^[primary==true].locality
         • External namespace: urn:ietf:params:scim:schemas:core:2.0:User
       • Region
         • Display name: Region
         • Variable name: region
         • External name: addresses.^[primary==true].region
         • External namespace: urn:ietf:params:scim:schemas:core:2.0:User

       • Title

         • Display name: Title
         • Variable name: title
         • External name: title
         • External namespace: urn:ietf:params:scim:schemas:core:2.0:User

       • UserType

         • Display name: UserType
         • Variable name: usertype
         • External name: usertype
         • External namespace: urn:ietf:params:scim:schemas:core:2.0:User
    5.  When finished adding the last attribute, click Save.
    6. While still in the Profile Editor, map an Okta value to each Code42 attribute by clicking Mappings and selecting Okta to Code42. When done, click Save Mappings.
       Note the following:

• Username should be a syntactically valid email address value. Primary email should be a syntactically valid value identical to Username. 
• Some Okta values may not have the same name as the Code42 attributes:
  • Map the City value in Okta to the Locality attribute in Code42.
  • Map the State value in Okta to the Region attribute in Code42.

12. Push attributes for existing users to Code42.

    1. Return to the Provisioning tab of the Code42 app.
    2. In the navigation pane on the left, select Settings > To App. 
    3. Under Code42 Attribute Mappings, click Force Sync. 
    4. Check the Identity Management Sync Log for the attributes pushed to Code42.

(Optional) Step 5: Edit deactivation delay

Step 6: Push user groups from Okta to Code42 

From the Okta dashboard, push user groups from Okta to Code42. See Okta's documentation for more details. If you are not using groups, continue to Step 7.

Step 7: Choose an organization mapping method

 If you assigned people to the app before you configured mapping, you must manually provision the unprovisioned users later.

Step 8: Configure role mapping

Role mapping allows you to automatically assign Code42 roles and permissions to provisioned users based on their SCIM group. Learn more about Code42 roles and permissions. Users who are not mapped inherit the default roles for their organization. 

1. Click Edit  to the right of Role Mapping. 
   The Edit Role Mapping dialog appears.
   
2. To map SCIM groups, select Map SCIM groups to Code42 roles.
   If you do not want to manage roles with SCIM groups, select Manually to manage roles in Code42.
3. Click Save.
   An Add Mapping button appears under Role Mapping.
4. Click Add Mapping. 
   The Add Role Mapping dialog appears.
   
5. Select a SCIM group from the dropdown. 
   Only groups that have not been mapped appear in the dropdown.
6. Choose one or more roles from the list to apply to this SCIM group. Learn more about Code42 roles and permissions.

7. Click Add. 
   The role mapping appears under the provisioning provider detail. 
8. Repeat until all of your SCIM groups have been mapped to Code42 organizations. 
   The message All SCIM groups are mapped appears. 

Step 9: Assign the Code42 application to users or groups in Okta

Users will not appear in Code42 until you assign them the Code42 app in Okta. We recommend creating a test user in Okta, and assigning the Code42 app to the test user before assigning the app to all users or groups. Once you assign the Code42 app to a user or group, Okta immediately syncs with Code42 and provisions the users. 

See Okta's documentation for more information on assigning users and groups to applications. 

Troubleshooting

External resources

• Okta
  • Manage Group Push
  • Provisioning in applications
  • Users, groups, and profiles
  • Okta Expression Language: Overview
• SCIM: Core schema

Related topics

• Introduction to SCIM provisioning
• Identity management reference
• Configure Okta for SSO in your Code42 cloud environment
• Provision user attributes to Code42