1. Code42 Support
  2. Incydr
  3. Incydr administration
  4. Configuring
  5. SCIM provisioning

How to provision users to Incydr from Okta

Updated

Overview

Provisioning automatically adds and deactivates users in your Incydr environment as well as assigns users roles and permissions. This article explains how to connect Okta provisioning and Incydr. Once configured, Incydr automatically adds, updates, and removes users based on syncs from Okta to Incydr.

This article assumes you are familiar with the concept of provisioning. To learn more, see our introduction to provisioning. If you want to add Okta as an authentication provider, see Configure Okta for SSO in your Incydr cloud environment. 

Considerations

  • To use this functionality, you must be assigned the Identity Management Administrator role. 

  • To enable Okta's provisioning in Incydr, your Okta environment must be licensed for the Lifecycle Management feature. If you are not licensed for the feature, you can still use Okta for authentication.

  • Configure your private network, Internet, and VPN settings to allow client devices to communicate with your provisioning provider on port 443. Test client connectivity to the provisioning provider before you proceed.

  • Local users cannot be created, updated, or deleted from the provisioning provider. These users can only be managed in the Incydr console.

User Provisioning

The following user provisioning features are available in the Incydr Okta application in the cloud. For more information on these provisioning features, see Okta's documentation.

Supported 

  • Create Users: New users created in Okta are also created in Incydr
  • Deactivate users:  Deactivating the user in Okta deactivates the user in Incydr
    Note: Deactivating an Incydr user means removing the user's account and placing the user's data into cold storage. Learn more about deactivating a user. By default, there is a 15 minute delay before Incydr deactivates a user. 
  • Push groups: Adds groups and users from Okta to Incydr
  • Update user attributes: Okta updates users' profiles. Okta profile values overwrite any changes made in Incydr.

Not Supported 

  • Import users from Incydr to Okta
  • Password sync

Deactivate users

There are a few special considerations when deactivating users. 

Deactivation delay

When a provisioning provider sends an update to deactivate a user, Incydr waits 15 minutes before deactivating the user. This helps protect against moving users backup archives into cold storage if the users are accidently deactivated in the provisioning provider. You can adjust the delay time in the Incydr console. Note that the delay only applies when deactivating users using provisioning. When you manually deactivate users in the Incydr console, there is no delay.

Okta suspended state

You can suspend users via Okta. Suspended users cannot sign in to the Incydr console or agents on their devices. However, suspending users does not deauthorize them (sign them out of the agent) if they are currently signed in.

Backup agent only: When you suspend users in Okta, you must go to the Incydr console and manually block those users. Blocking users signs them out, and prevents them from signing back in to the agents on their devices. 

Users on legal hold cannot be deactivated

Backup agent only

If you place users under legal hold, the provisioning provider cannot deactivate them. Their data is retained for the legal hold process. Users are blocked instead of deactivated. Once your release users from legal hold, they are automatically deactivated.

Before you begin

Determine how you want to map users from the provisioning provider to Incydr organizations. To learn more, see our introduction to provisioning article. There are several ways to map users to an Incydr organization: 

Create new users in an Incydr organization

Assigns all users to the same Incydr organization. New users are moved to this organization. Users that are subsequently moved outside of this organization remain in their new organization. 

Example use case
Use this option if you use a single organization to manage users in the Incydr console.

Map users to organizations based on the provider's "c42OrgName" attribute  

Creates new organizations or assigns users to existing organizations based on the value for the user attribute c42OrgName. This value becomes the name for the Incydr org. This attribute is managed on the provisioning provider. 

Example use case
Use this method if you wish to manage users in the provisioning provider (and not in the Incydr console). Whatever is the value for this attribute becomes the name for the Incydr org. Incydr creates new organizations or assigns users to existing organizations based on the value. 

Map users to organizations using SCIM groups

Assigns users to Incydr organizations based on their SCIM group. If you choose this option, create organizations in the Incydr console before you begin.

Example use case
Use this mapping if your users are already assigned to SCIM groups. For example, a user is part of two different SCIM groups: an executive group and a UK group. You want this user's backup policies to match the other executives in your company, so this user should be assigned to the same Incydr organization as the other executives. In the Incydr console, you can choose the executive group to take priority over the UK group. This way you can place all of the executives in your company in the same organization and ensure they have the same backup policies.

Compare methods

  Automatically creates organizations in Incydr Requires you to create Incydr organizations before you begin Requires your provider to send SCIM groups to Incydr
Create new users in an Incydr organization   x  
Map all users to organizations based on the provider's "c42OrgName" attribute x    
Map users to organizations using SCIM groups   x x

Step 1: Create Incydr organizations

This step is only required if you choose to use the Single Organization or Custom SCIM mapping methods. The "c42OrgName" attribute and Custom attribute methods create Incydr organizations automatically. 

Step 2: Add a provisioning provider in the Incydr console

  1. In the Incydr console, navigate to Administration > Integrations > Identity Management.
  2. Select the Provisioning tab.
    Add_provisioning_provider
  3. Click Add Provisioning Provider and select Add SCIM Provider from the menu.
    The Add SCIM provisioning provider dialog is displayed.
    Add_SCIM_provisioning_provider
  4. Enter a display name, and for Authentication credential type select API credentials (default).
    You must select API credentials for use with Okta provisioning.
  5. Click Next. 
  6. The SCIM Provider Created message appears. Leave this message open. You need this information for the next step in the provisioning provider setup.
    After you have used the information here for provisioning provider setup, click Done.
    Add_scim_provisioning

Step 3: Add the Okta application for Code42/Incydr

  1. Sign in to your Okta dashboard.
  2. Add the Code42 application.
    Note: There are two Code42 apps on Okta's website. Add the Code42 app, which is used for cloud environments. The Code42 Single Tenant app is used in single-tenant cloud environments.
    Incydr app in Okta
  3. Configure the general settings, and click Next. 
Wait to assign people or groups to Okta's Code42 application
Do not assign people to Okta's Code42 application yet. First complete the organization mapping (Step 7) and role mapping (Step 8). If you assign people to the Code42 application before you configure mapping, Okta cannot automatically map users to Code42 organizations and roles, and you must manually provision the unprovisioned users later.

Step 4: Configure Okta's provisioning tab

  1. In the Okta dashboard, select the Provisioning tab of the Code42 app. 
  2. Click Configure API Integration. 
    Okta-Provisioning-tab
  3. Select Enable API Integration.
  4. Enter the Base URL, Username, and Password generated from the Incydr console (Step 2). 
  5. Click Test API Credentials.
    A success message appears. 
  6. Click Save. 
  7. Under Settings, click To App. 
  8. Select Edit. 
  9. Enable the following settings: 
    • Create Users
    • Update User Attributes
    • Deactivate Users
  10. Click Save. 
    Okta-enable-provisioning
  11. Add additional attributes if needed in the Attribute Mappings section. 
    For example, if you would like to display user information for employees, you must first add the attributes to the Code42 app in Okta. For reference information about attribute mapping, see Okta's documentation.
    1. In the Provisioning tab of the Code42 app, scroll to the Attribute Mappings section. 
    2. Click Go to Profile Editor.
    3. Click Add Attribute. 
    4. Add the following supported attributes. After adding each one, click Save and Add Another.

      • Country 

        • Data type: country code
          Country codes mapped must be valid 2-character codes. To convert non-2 character codes to 2-character codes, see Okta's documentation.
        • Display name: Country
        • Variable name: country
        • External name: addresses.^[primary==true].country
        • External namespace: urn:ietf:params:scim:schemas:core:2.0:User

      • Department

        • Display name: Department
        • Variable name: department
        • External name: department
        • External namespace: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

      • Division

        • Display name: Division
        • Variable name: division
        • External name: division
        • External namespace: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

      • Locality

        • Display name: Locality
        • Variable name: locality
        • External name:  addresses.^[primary==true].locality
        • External namespace: urn:ietf:params:scim:schemas:core:2.0:User

      • Region

        • Display name: Region
        • Variable name: region
        • External name: addresses.^[primary==true].region
        • External namespace: urn:ietf:params:scim:schemas:core:2.0:User

      • Title

        • Display name: Title
        • Variable name: title
        • External name: title
        • External namespace: urn:ietf:params:scim:schemas:core:2.0:User

      • UserType

        • Display name: UserType
        • Variable name: usertype
        • External name: usertype
        • External namespace: urn:ietf:params:scim:schemas:core:2.0:User
    5. When finished adding the last attribute, click Save.
    6. While still in the Profile Editor, map an Okta value to each attribute by clicking Mappings and selecting Okta User to Incydr. When done, click Save Mappings.
      Note the following:
  • Username should be a syntactically valid email address value. Primary email should be a syntactically valid value identical to Username. 
  • Some Okta values may not have the same name as the Incydr attributes:
    • Map the city value in Okta to the Locality attribute in Incydr.
    • Map the state value in Okta to the Region attribute in Incydr.
  1. Push attributes for existing users to Incydr.
    1. Return to the Provisioning tab.
    2. In the navigation pane on the left, select Settings > To App. 
    3. Under Attribute Mappings, click Force Sync. 
    4. Check the Identity Management Sync Log for the attributes pushed to Incydr.
Add the Manager attribute 
Use of the Manager attribute from Okta requires additional setup. To add the Manager attribute, contact your Customer Success Manager (CSM) to engage our Professional Services team.

(Optional) Step 5: Edit deactivation delay

In the Incydr console, view the provisioning provider details and select Deactivation Delay. 

The deactivation delay determines how long Incydr waits to deactivate a user after syncing with the provisioning provider. To learn more about user deactivation, see Deactivate and reactivate users and devices.

Backup agent only: Although a delay may be configured, users are immediately blocked during the delay period. Blocking a user means they can no longer sign in to the backup agent, but their devices continue to back up. The delay helps prevent accidently deactivating a user and removing their backup archive. If you need to cancel a pending user deactivation during the delay period, unblock the user.

Step 6: Push SCIM groups from Okta to Incydr 

SCIM groups pushed to Incydr are used to map users to organizations, roles, and watchlists. If you are not using groups, continue to the next step.

To push SCIM groups from Okta:

  1. From the Okta dashboard, go to Applications.
  2. Open the Code42 application.
  3. Click the Push Groups tab.
  4. Select Push Groups.
    See Okta's documentation for more details.
Apply changes after mapping SCIM groups

If you want to map SCIM groups to Incydr organizations in Step 7 or roles in Step 8, you must first push or provision SCIM groups and their users to Incydr so they are available in the Incydr console. 

However, this means that initially the users are provisioned in the default organization and are assigned default roles rather than the ones you want to map them to. To move these users to the desired organizations and roles, ensure that you map SCIM groups to organizations (Step 7) and roles (Step 8) and then apply the mappings using the Apply Org and Role Settings action. 

Step 7: Choose an organization mapping method

The mapping method determines how Incydr assigns users to organizations. Organizations are used to set backup policies and permissions for users in your environment. To change the method, go to Organization Mapping, and click Add Organization Mapping or the edit icon. 

provisioning_provider

The Edit Organization Mapping Method dialog is displayed.
Edit organization mapping

In the Edit Organization Mapping Method dialog, choose one of the following mapping methods:

Create new users in an organization

Assigns all users to the same Incydr organization.

  1. In Edit Organization Mapping Method, choose Create new users in the organization below. 
  2. Select an existing organization to map all users to. 

Map users to organizations based on the provider's "c42OrgName" attribute

Creates new organizations or assigns users to existing organizations based on the value for the user attribute c42OrgName.

  1. In Edit Organization Mapping Method, choose Map users to organization based on the provider's "c42OrgName" attribute. 
  2. Choose an organization where unmapped users will be assigned. Unmapped users are users who do not have the c42OrgName attribute.  

Map users to organizations using SCIM groups

Assigns users to Incydr organizations based on their SCIM group. You can also choose the priority of which organization a user is mapped to if they belong to two or more groups.

  1. In Edit Organization Mapping Method, choose Map users to organizations using SCIM groups. 
  2. Choose an organization where unmapped users will be assigned. Unmapped users are users who either do not belong to a group or their group is not mapped. 
  3. Click Save. 
    The group mapping appears. 
  4. Click Add Mapping.
  5. Select one or more SCIM groups.
    Add Mapping
  6. From Select an Incydr organization, choose an organization from the menu. 
  7. Click Save. 
    The mapping appears on the Provisioning Provider details page. 
  8. Repeat until all of your SCIM groups have been mapped to Incydr organizations. 
    The message All SCIM groups are mapped appears.
    Organization_mapping
  9. (Optional) Adjust the priority of each mapping. This is useful for users who belong to more than one SCIM group. 

There are no SCIM groups available

This message appears if SCIM groups have not been synced with the Incydr console. Push groups to the Incydr console to begin organization mapping. 

Wait to assign people or groups to the Code42 application in the provisioning provider
Do not assign people to the Code42 application in the provisioning provider yet. Wait until after you have completed the organization mapping and role mapping. If you assign people to the application before you configure mapping, the users are not automatically mapped to organizations and roles.  

 If you assigned people to the app before you configured mapping, you must manually provision the unprovisioned users later.

Step 8: Configure role mapping

Role mapping allows you to automatically assign Incydr roles and permissions to provisioned users based on their SCIM group. Learn more about Incydr roles and permissions. Users who are not mapped inherit the default roles for their organization. 

SCIM Groups
Role Mapping is only available if you are using SCIM groups. 
  1. Click Edit  to the right of Role Mapping. 
    The Edit Role Mapping dialog appears.
    edit_role_mapping
  2. To map SCIM groups, select Map SCIM groups to Incydr roles.
    If you do not want to manage roles with SCIM groups, select Manually to manage roles in Incydr.
  3. Click Save.
    An Add Mapping button appears under Role Mapping.
  4. Click Add Mapping. 
    The Add Role Mapping dialog appears.
    Add Role Mapping
  5. Select a SCIM group from the dropdown. 
    Only groups that have not been mapped appear in the dropdown.
  6. Choose one or more roles from the list to apply to this SCIM group. Learn more about Incydr roles and permissions.
Basic roles
  • If the insider risk agent is deployed to users in this group, include the Agent User role.
  • If the backup agent agent is deployed to users in this group, include the Desktop User and PROe User roles. These roles allow users to sign in to the agent and Incydr console to manage their backups and restore their files. If you are giving external groups access to your Incydr environment (for example, outside legal council) they do not need these roles.
  1. Click Add. 
    The role mapping appears under the provisioning provider detail. 
  2. Repeat until all of your SCIM groups have been mapped to Incydr organizations. 
    The message All SCIM groups are mapped appears. 

There are no SCIM groups available

This message appears if SCIM groups have not been synced with the Incydr console. Push groups to the Incydr console to begin role mapping. 

Step 9: Assign the application to users or groups in Okta

Users will not appear in Incydr until you assign them the app in Okta. Create a test user in Okta and assign the Code42 app to the test user before assigning the app to all users or groups. Once you assign the app to a user or group, Okta immediately syncs with Incydr and provisions the users. 

See Okta's documentation for more information on assigning users and groups to applications. 

Troubleshooting

User details in Okta and Incydr are out-of-sync

Once provisioning is configured in Incydr, you should make all user changes in Okta. Incydr does not sync changes back to Okta, so any changes you make on the Incydr side causes the two apps to become out-of-sync. Updating the Incydr console does not start a sync between Okta and Incydr. Only changes made in Okta can start a sync. 

To view information about provisioning changes, see the Sync Log in the Incydr console. It gives details of all of the users that have been created, updated, or deleted due to provisioning. 

Attributes do not appear as expected on users in Incydr

If you assigned people to the Code42 application before you configured attribute mapping, Okta could not automatically map users to organizations and roles, which can result in user attributes not being updated as expected in Incydr. To correct the problem, verify the attributes are correctly defined in the Profile Editor and the attribute mapping, then manually provision the unprovisioned users, or perform a Force Sync to update user attributes for all the users assigned to the application.

Synchronization results in a server error

If custom user attributes are not configured correctly, it may result in a server error message similar to the following when Okta attempts to synchronize: 

Automatic profile push of user John Doe to app failed: Error while trying to push profile update for John_Doe@example.com: Server Error. 

To resolve the problem, configure the user attributes to match the documentation in Step 4 and then perform a Force Sync or manually provision users that have failed to provision.

Need more help?
Contact our Technical Support Engineers​ for Incydr for Enterprise support.