Configure protocol-specific settings

Your application needs to support at least one protocol for interacting with Okta: SAML or OIDC for authentication, or SCIM for provisioning.

Protocol support details can be submitted all together or asynchronously. For example, if your application currently only supports SAML and SCIM, you can create the submission with the SAML and SCIM protocol details. At a later date, when you add OIDC support to your application, you can return to your integration submission, activate the OIDC support panel, and add in the details needed for Okta to enable OIDC support.

For each protocol, click on the appropriate tab name and change the protocol support drop-down box from Off to On.

Instance URL

For each protocol, enter the Okta instance URL for your integration in the first field.

To get your Okta instance URL:

1. Open the Okta Admin Console in your development org.
2. If you are not in the Classic UI, switch to that view.
3. Click Applications > Applications to see all the integrations in your org.
4. Click on the name of the integration you are going to submit. The browser opens the settings page. Confirm that the settings match what you want as the global defaults for all customers.
5. In your browser, click on the address bar showing the current URL and copy it to your clipboard. This is the Okta instance URL for your integration.
6. Back in the OIN Manager, paste that URL into your submission.

For example:

Protocol-specific settings

Each of the supported protocols has different configuration settings for the remainder of the submission.

• OpenID Connect
• SAML 2.0
• SCIM

• What SCIM version should this integration use? — Choose either SCIM 2.0 (the preferred version), or SCIM 1.1.

• Link to configuration guide — Your configuration guide (in either HTML or PDF format) should have step by step instructions on how to set up provisioning between Okta and your systems. See Prepare a customer-facing configuration guide.

• Select provisioning features to be supported in the integration — These provisioning features should match what you have selected in the Provisioning tab in the settings for your SCIM integration. For details on each of these options, see Configure application provisioning. To activate the Profile Sourcing feature, see Submission process.

• Base URL (enter “n/a” if the URL varies by tenant) — Provide the base URL that your integration uses when sending an outbound call to your SCIM server. This should be a valid production endpoint. If the the URL varies according to which tenant is using it (e.g. lasvegas.example.com/scim/v2/ or seattle.example.com/scim/v2), then type n/a. Explain in your configuration guide how your users should construct the URL while configuring the settings for your application.

• Does your SCIM server support HTTP PATCH operations for modifying resources? — Select Yes if your SCIM server supports updates made through a PATCH.

• What authentication mode should the integration use? — The authentication method must match what your SCIM server expects to receive.

  • Header authentication: Specify what format the token is sent to the server.
  • OAuth 2: Specify the token and authorization endpoint URLs for your SCIM server, along with the consumer key and secret.

• Does your SCIM userName attribute value follow an email address format? — Select Yes if your SCIM server uses a name@company.TLD format for the unique userName attribute.

• Optional: link to demo video — If you have a video that explains how to configure access to your SCIM application, enter the URL for it here.

• Link to Runscope test results — This should be a link to the Runscope site test results showing that your application has successfully passed the SPEC test suite. See Test your SCIM API.

• Link to Runscope CRUD test results — This should be a link to the Runscope site test results showing that your application has successfully passed the CRUD test suite. See Test your Okta integration.

These Runscope test results must show that all tests are passing before the Okta OIN team approves a SCIM integration for the OIN.

As you add configuration information about your integration to the submission page, the indicators in the top right show your progress towards 100% completion.

You must include all required information before you can click the Submit for Review button to move your integration into the submission phase.

Next: Understand the submission process