Data Quality user documentation
home/Data quality/Aperture Data Studio/Configuration/Configure SCIM provisioning

Configure SCIM provisioning

Overview

System for Cross-domain Identity Management (SCIM) is an open standard for automating user and group provisioning between an identity provider (IdP) and an application.

With SCIM provisioning, Aperture Data Studio can automatically create, update, and disable user accounts in response to changes made in your organization's identity management platform. This reduces manual administration and helps keep access in Aperture Data Studio synchronized with your organization's directory.

SCIM is typically used with single sign-on (SSO) technologies such as SAML. SSO authenticates users when they sign in, while SCIM manages user lifecycle and access provisioning.

Configuration

Complete the following configuration to enable SCIM provisioning between your identity provider and Aperture Data Studio.

Configuring Aperture Data Studio as a SCIM server

Before enabling SCIM provisioning, enable and configure SAML authentication with the appropriate setting. This allows users provisioned by the identity provider to be matched with the correct Aperture Data Studio user accounts.

SCIM integrations can operate in the following modes:

  • Server mode: Aperture Data Studio exposes a SCIM endpoint. The identity provider acts as the SCIM client and sends user and group changes to Aperture Data Studio.
  • Client mode: Aperture Data Studio acts as the SCIM client and retrieves user and group changes from the identity provider.

Aperture Data Studio currently supports only server mode. In this mode, the identity provider sends provisioning changes to Aperture Data Studio.

Configure SCIM mappings

A SCIM mapping associates an identity provider group with an Aperture Data Studio role and, optionally, an Aperture Data Studio group.

Each mapping contains the following elements:

Identity provider group Aperture Data Studio role Aperture Data Studio group (optional)
The exact name of the group in the identity provider. The Aperture Data Studio role assigned to members of this group within the environment. The Aperture Data Studio group assigned to members of this group.

Configure Okta

Okta acts as the SCIM client and sends user and group provisioning changes to Aperture Data Studio via REST API.

Configure the SCIM connection in Okta

  1. In Aperture Data Studio, create a REST API key with the SCIM Provision permission.
  2. In Okta, configure the SCIM connector using the Aperture Data Studio SCIM base URL.
  3. Configure the authorization header using the environment external label and the API key in the following format:
    <Environment external label> <Your API Key>
  4. Test the connection to verify that Okta can communicate with Aperture Data Studio.

Configuring SCIM mappings for Okta

  1. In Okta, configure the group as a push group.
  2. In Aperture Data Studio, enable SCIM provisioning for the selected environment.
  3. Add a SCIM mapping using an identity provider group name that exactly matches the corresponding Okta group name.
  4. Select the Aperture Data Studio role and, optionally, the Aperture Data Studio group to assign.

The Okta push group is now associated with the Aperture Data Studio mapping. Subsequent membership changes in Okta are sent to Aperture Data Studio. Aperture Data Studio then provisions or deprovisions the affected users and updates their mapped role and group assignments.

Aperture Data Studio

Configuration