User Provisioning with OKTA

This topic illustrates integration with Okta for provisioning users via SCIM. The integration workflow includes configuring provisioning parameters in the Okta tenant.

Before You Begin

• If your Netskope tenant is hardened using IP Allowlist (Settings > Administration > IP Allowlist), then ensure that you add the respective source IP addresses of your IdP to the Custom IP list.

• Obtain SCIM base URL and and SCIM token from your tenant

Setting up user provisioning using OKTA includes the following steps:

1. Configuring Netskope SCIM Provisioning in Okta
2. Validating SCIM Provisioning Configuration

Configuring Netskope SCIM Provisioning in Okta

This section illustrates the steps for configuring the Netskope User Enrollment app in the Okta tenant. The Netskope User Enrollment App in Okta combines both user authentication and enrollment functionality for inline access methods and is also responsible for provisioning the Okta-sourced users and groups into the Netskope Platform.

1. Login to OKTA admin UI and click the Admin button (in the page header) to access the admin section.
2. Go to Applications > Applications. In the Applications page, click Browse App Catalog, search for Netskope, and select the Netskope User Enrollment app.
3. Click Add Integration in the Add Netskope User Enrollment page.
4. Give a name (Application Label) for this app. For example: Netskope SAML Auth. Select Do Not Display Application Icon to Users. As the Netskope User Enrollment App is strictly for User Provisioning and Authentication, it is not an application users will need to interact with from their Okta Dashboard. Click Done.
5. Go to the Provisioning tab and click the Configure API Integration button.
6. Select the Enable API Integration option. See the SCIM Settings for User Provisioning topic for steps to generate token and get the REST API v2 URL.
   • In the API Token, copy and paste the v2 token generated.
   • In the Base URL, enter the REST API v2 URL: https://<tenant-name>.goskope.com/api/v2/scim.
   • Select the Import Groups checkbox if there is a requirement for group linking. More on the topic can be found here and here.
   • Select Test API Credentials before proceeding. You should receive a Netskope User Enrollment was verified successfully! message.
   • Click Save.
7. In the Provisioning tab > To App, select Create Users, Update User Attributes, and Deactivate Users to complete the Netskope and Okta Lifecycle management capabilities.
8. Navigate to the Assignments tab and Assign test users and/or groups. If managing users by group is a requirement in Netskope, ensure that you navigate to the Push Groups tab and push appropriate groups to Netskope.

Validating SCIM Provisioning Configuration

At this stage, it’s best to select a test group and users to ensure identities are provisioned within Netskope. To validate if the users/groups were created successfully, do the following:

1. Log in to your Netskope tenant.
2. Go to Settings > Security Cloud Platform > Netskope Client. Select both Users and Groups and validate both were created successfully.