Features
Push Users - Users in Okta can be assigned to the Fulcrum application in Okta and will automatically be created and added as members to your Fulcrum organization.
Deactivate Users - Users in Okta that are unassigned from the Fulcrum application in Okta will be removed as members from your Fulcrum organization.
Push Membership Updates - Users in Okta can update their email, given name, and/or family name and have those changes updated in their Fulcrum organization membership.
Push Groups (optional) - Groups in Okta can be assigned to the Fulcrum application in Okta. The users in those groups will automatically be created and added as members to your Fulcrum organization. In addition, the groups themselves may be optionally created in Fulcrum as Fulcrum groups.
Map Roles (optional) - When app roles are set up and assigned to users in Okta, Fulcrum members will automatically be assigned the corresponding Fulcrum role.
Requirements
SCIM provisioning is only supported on certain Fulcrum plans with SSO and Developer Pack enabled.
To avoid duplicating existing users when transitioning to using SCIM, please contact your account executive or CSM to coordinate a migration process.
Configuration Steps
In Fulcrum
Sign in as an Owner to the organization you want SCIM provisioning enabled
Create an API token to be used with the SCIM integration
Go to the API page
Click the NEW API TOKEN button
Provide a useful description such as SCIM Okta
Click CREATE TOKEN to create a new API token
Note/copy the token which will be used to configure the Okta Fulcrum application
Note: The API token is tied to the Fulcrum user who generated it. If that user is removed/deactivated a new one will need to be created and reconfigured in Okta.
In Okta
Add the Fulcrum application
Open the Applications dropdown and click Applications followed by the Browse App Catalog button
Search for Fulcrum in the catalog search and select Fulcrum from the available options
Click the Add Integration button
Click Done to finish adding the Fulcrum application
Configure Sign On settings
Click on the Sign On tab
Go through the SAML Setup instructions and take note of the Company Domain
Click Edit to start editing the Sign On settings
Make sure the Organization Name matches the Company Domain from the SAML setup and that Application username format is set to Email
Click Save
Configure Provisioning settings
Click on the Provisioning tab and then Integration
Click the Configure API Integration button
Make sure the Enable API Integration checkbox is checked and for the API Token field enter the Fulcrum API token that was generated during the In Fulcrum section
Click Save
Click To App and then Edit, while still under the Provisioning tab
Enable Create Users, Update User Attributes, and Deactivate Users by making sure they are checked
Click Save
Assign users to the Okta Fulcrum app to have them added to your organization in Fulcrum
Click on the Assignments tab followed by the Assign button and Assign to People option
Click Assign on the user you want to add
Ensure the information looks correct and click Save and Go Back
Repeat steps b and c for each user you want to add
Assign groups to the Okta Fulcrum app to have the users in that group added to your organization in Fulcrum. This step only adds members of Okta groups to Fulcrum. It does not create groups within Fulcrum. See step 6 for those instructions.
Click on the Assignments tab followed by the Assign button and Assign to Groups option
Click Assign on the group you want to add
Repeat for each group you want to add
Click Done when done with adding groups
Push groups to Fulcrum. This will add groups to your organization in Fulcrum and assign the correct members to those groups in Fulcrum.
Click on the Push Groups tab followed by the Push Groups button and Find groups by name option
Search for the name of a previously created Okta group name. Leave the default settings, including Create Group with the same group name. Click Save when done.
Map Roles. When app roles are set up and assigned to users in Okta, Fulcrum members will automatically be assigned the corresponding Fulcrum role.
Go to Directory > Profile Editor > User > Apps
Search for your App
In Attributes click Add Attribute
select Data Type ‘string’
for Display name enter ‘role’
for variable name enter ‘role’
for external name enter ‘role’
for external namespace enter ‘role’
Tick the checkbox ‘Define enumerated list of values’
Add the ‘Attribute members’ according to the available roles in your Fulcrum App
Troubleshooting
Managed and unmanaged users and groups
Fulcrum separates the ecosystems for managed and unmanaged users and groups.
Unmanaged users are users that are created directly in Fulcrum and are not managed by Okta. Okta is in fact unaware of these unmanaged users.
Managed users are created in Okta and are created in Fulcrum via SCIM provisioning. In Fulcrum, these users will be marked as managed.
Similarly, Fulcrum also has managed and unmanaged groups. Unmanaged groups are completely internal to Fulcrum and are not visible to Okta. Managed groups are created and managed in Okta. Group memberships cannot be managed in Fulcrum and must be managed in Okta. Information on managing groups in Fulcrum.
One of the consequences of this split ecosystem is that managed and unmanaged users and groups may have the same name even though they represent different entities. Refreshing the App Groups in Okta will not fetch unmanaged groups from Fulcrum. Pushing a group in Okta that has the same name as an unmanaged group in Fulcrum will result in multiple groups with the same name in Fulcrum. This is expected behavior.
Other Issues
Please reach out to our support team at support@fulcrumapp.com if you have any difficulties.