implementing-scim-provisioning-with-okta

Implement automated user provisioning and deprovisioning using SCIM 2.0 protocol with Okta as the identity provider.

Jump to install

Repository: xalgord/xalgorix
Last source activity: June 6, 2026 at 16:41
Detected SKILL.md language: English
Stars: 813
Forks: 146

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	implementing-scim-provisioning-with-okta
description	Implement automated user provisioning and deprovisioning using SCIM 2.0 protocol with Okta as the identity provider.
domain	cybersecurity
subdomain	identity-access-management
tags	["scim","okta","provisioning","identity-management","automation","sso","lifecycle-management"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]

Implementing SCIM Provisioning with Okta

Overview

SCIM (System for Cross-domain Identity Management) is an open standard protocol (RFC 7644) that automates the exchange of user identity information between identity providers like Okta and service providers. This skill covers building a SCIM 2.0-compliant API endpoint and integrating it with Okta for automated user lifecycle management including provisioning, deprovisioning, profile updates, and group management.

When to Use

When deploying or configuring implementing scim provisioning with okta capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Common Misconfigurations & Verification

Deprovisioning never reaches the app: Okta "deactivate" only deprovisions when the assignment is pushed and "Deactivate Users" is enabled; unassigning a user or relying on push-groups alone leaves an orphaned active account. Confirm a deactivated Okta user actually flips active:false at the SCIM endpoint, not just loses the app tile.
Hard-delete instead of soft-delete: the SCIM server should set active:false, not return 404 on the record. Verify deactivation maps to your deactivation and that re-activation restores the same id.
userName mutability creates duplicates: if the matching attribute (userName) changes on rename, Okta provisions a second account. Confirm the unique identifier is immutable.
Deprovision lag: measure HR termination → Okta deactivation → SCIM active:false; SOX/SOC2 typically expect same-day. Check the Okta provisioning log for queued/failed retries that silently leave access live.
Verify: the bearer token is rejected after rotation, filter=userName eq "..." returns exactly one record, pagination (startIndex/count) is honored, and the Okta SCIM validator passes CRUD, filtering, and pagination.

Prerequisites

Okta tenant with admin access (Developer or Production)
Application with REST API capable of user management
TLS-secured endpoint (HTTPS required)
Okta API token or OAuth 2.0 client credentials
Python 3.9+ with Flask or FastAPI

Core Concepts

SCIM 2.0 Protocol

SCIM defines a standard schema for representing users and groups via JSON, with a RESTful API for CRUD operations:

Operation	HTTP Method	Endpoint	Description
Create User	POST	/scim/v2/Users	Provisions a new user account
Read User	GET	/scim/v2/Users/{id}	Retrieves user details
Update User	PUT/PATCH	/scim/v2/Users/{id}	Modifies user attributes
Delete User	DELETE	/scim/v2/Users/{id}	Removes user account
List Users	GET	/scim/v2/Users	Lists users with filtering
Create Group	POST	/scim/v2/Groups	Creates a group
Manage Group	PATCH	/scim/v2/Groups/{id}	Add/remove group members

Okta (IdP) ──SCIM 2.0 over HTTPS──> SCIM Server ──> Application Database
     │                                     │
     ├── User Assignment                   ├── Create/Update User
     ├── User Unassignment                 ├── Deactivate User
     ├── Profile Push                      ├── Sync Attributes
     └── Group Push                        └── Manage Groups

from flask import Flask, request, jsonify
import uuid
from datetime import datetime

app = Flask(__name__)

# Bearer token for Okta authentication
SCIM_BEARER_TOKEN = "your-secure-token-here"

def require_auth(f):
    def wrapper(*args, **kwargs):
        auth = request.headers.get("Authorization", "")
        if not auth.startswith("Bearer ") or auth[7:] != SCIM_BEARER_TOKEN:
            return jsonify({"detail": "Unauthorized"}), 401
        return f(*args, **kwargs)
    wrapper.__name__ = f.__name__
    return wrapper

@app.route("/scim/v2/Users", methods=["POST"])
@require_auth
def create_user():
    data = request.json
    user_id = str(uuid.uuid4())
    user = {
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "id": user_id,
        "userName": data.get("userName"),
        "name": data.get("name", {}),
        "emails": data.get("emails", []),
        "active": True,
        "meta": {
            "resourceType": "User",
            "created": datetime.utcnow().isoformat() + "Z",
            "lastModified": datetime.utcnow().isoformat() + "Z",
            "location": f"/scim/v2/Users/{user_id}"
        }
    }
    # Persist user to database
    return jsonify(user), 201

@app.route("/scim/v2/Users", methods=["GET"])
@require_auth
def list_users():
    filter_param = request.args.get("filter", "")
    start_index = int(request.args.get("startIndex", 1))
    count = int(request.args.get("count", 100))
    # Parse filter: userName eq "john@example.com"
    # Query database with filter
    return jsonify({
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
        "totalResults": 0,
        "startIndex": start_index,
        "itemsPerPage": count,
        "Resources": []
    })

Okta Attribute	SCIM Attribute	Direction
login	userName	Okta -> App
firstName	name.givenName	Okta -> App
lastName	name.familyName	Okta -> App
email	emails[type eq "work"].value	Okta -> App
department	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department	Okta -> App

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "detail": "User already exists",
  "status": "409",
  "scimType": "uniqueness"
}