IdP Configuration - Okta

On this page

SingleStore SCIM supports Okta with the SCIM 2.0 protocol and Okta custom application integrations. This applies only to Custom applications, not Okta Integration Network (OIN) applications. Refer to Create custom app integrations for more information on creating custom applications.

Prerequisites

RBAC authorization for the Organization Team feature.
RBAC user sync for the Engine RBAC at SingleStore database level.

Configure SCIM Provisioning

On the Okta Portal, select General tab.
Navigate to App Settings and select Edit.
Select Provisioning > SCIM > Save.
In the Provisioning tab, select Settings > Integration > Edit.
Enter the endpoint URL from SingleStore SCIM configuration in SCIM connector base URL.
Enter userName in Unique identifier field for users.
Select the following in Supported provisioning actions:
1. Push New Users
2. Push Profile Updates
3. Push Groups
Select HTTP Header in Authentication Mode.
Enter the secret token from SingleStore SCIM configuration in Authorization.
Select Test Connector Configuration. Okta displays the test results.
Navigate to Provisioning > To App.
Select Edit to enable the following:
1. Create Users
2. Update User Attributes
3. Deactivate Users

Remarks

Okta separates provisioning into two categories:
- Assignments for user information.
- Push Groups for group information.
To sync groups and memberships, add the group in Push Groups after assigning it in Assignments
When changing the SCIM endpoint in the same Okta app integration, SingleStore does not recommend deleting groups in the target application before removing them from Push Groups. Otherwise, Okta throws an error for updates to the SCIM endpoint instead of creating groups in the new (empty) SCIM endpoint..
If the SCIM endpoint is changed, reset or refresh the SCIM configuration in Okta.
The primary email is the unique identifier in SingleStore organization, changing it triggers an update to the user matched to the new primary email in Okta.

Last modified: December 16, 2024

Was this article helpful?

Verification instructions

Note: You must install cosign to verify the authenticity of the SingleStore file.

Use the following steps to verify the authenticity of singlestoredb-server, singlestoredb-toolbox, singlestoredb-studio, and singlestore-client SingleStore files that have been downloaded.

You may perform the following steps on any computer that can run cosign, such as the main deployment host of the cluster.

(Optional) Run the following command to view the associated signature files.
Shell
```
curl undefined
```
Download the signature file from the SingleStore release server.
- Option 1: Click the Download Signature button next to the SingleStore file.
- Option 2: Copy and paste the following URL into the address bar of your browser and save the signature file.
- Option 3: Run the following command to download the signature file.
  Shell
```
curl -O undefined
```

After the signature file has been downloaded, run the following command to verify the authenticity of the SingleStore file.

Shell

echo -n undefined |
    cosign verify-blob --certificate-oidc-issuer https://oidc.eks.us-east-1.amazonaws.com/id/CCDCDBA1379A5596AB5B2E46DCA385BC \
      --certificate-identity https://kubernetes.io/namespaces/freya-production/serviceaccounts/job-worker \
      --bundle undefined \
      --new-bundle-format -

Verified OK