> ## Documentation Index
> Fetch the complete documentation index at: https://bruno-a6972042-mintlify-c74cb75a.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Okta SCIM provisioning with Bruno
This guide will walk you through setting up SCIM (System for Cross-domain Identity Management) provisioning with Bruno using Okta SWA (Secure Web Authentication).
**Prerequisites**: Before configuring Okta, you must first enable SCIM provisioning in Bruno and generate an API key. Follow the [Enabling SCIM Provisioning](./overview#enabling-scim-provisioning) section in the overview page to complete this setup and save your API key for use in the steps below.
## Create your Okta App
**Already have an Okta App for SSO?** If you previously set up a Bruno Okta application for [SAML SSO](../saml-sso/configure-saml-sso-with-okta), you can reuse it for SCIM provisioning. Skip to the [Configure your Okta App](#configure-your-okta-app) section to add provisioning to your existing application.
1. As an Okta admin, navigate to **Applications** and click **Create App Integration**
2. Select **SWA - Secure Web Authentication** and click **Next**
3. On the **Create SWA Integration** page, add the following values and click **Finish**:
* **App name**: (Unique App Name - e.g. Bruno SCIM Integration)
* **App's login page URL**: `https://license.usebruno.com/`
## Configure your Okta App
1. On your newly created application page, select the **General** tab
2. Under **App Settings**, select **Edit**, and check the **Provisioning** option **SCIM** and click **Save**
3. Return to your Okta app, select the **Provisioning** tab, under **SCIM Connection** select **Edit** and configure the following values:
* **SCIM connector base URL**: `https://license.usebruno.com/scim/v2`
* **Unique identifier field for users**: `email`
* **Supported provisioning actions**: Check the following options:
* `Import New Users and Profile Updates`
* `Push New Users`
* `Push Profile Updates`
* `Push Groups`
* **Authentication**: set to **HTTP Header**
* Under **HTTP Header**, for **token**: add the generated API Key value from the [prerequisites step](./overview#enabling-scim-provisioning)
4. Click **Test Connector Configuration**. If successful, a **Connector configured successfully** message dialogue appears.
5. Click **Save** to complete the Provisioning integration.
6. Under the **Provisioning** tab, select the **To Apps** setting, edit and enable the following options and click **Save**:
* `Create Users`
* `Update User Attributes`
* `Deactivate Users`
Your SCIM integration is now complete. You can now begin [assigning users to Bruno](#assign-people-and-groups-to-bruno-in-okta).
## Configure Admin Role Mapping
Admin Role Mapping lets you provision specific Okta users as Bruno License Manager admins. Admins provisioned this way get portal access, do **not** consume a license seat, and do **not** appear in the Users list.
This section is optional. Skip it if you only want to provision regular licensed users.
Unlike Entra ID, Okta has no built-in App Roles concept for custom SCIM apps, so this uses a custom profile attribute instead.
### Add a custom attribute to the Okta user profile
1. Go to **Directory** → **Profile Editor**
2. Select **Okta** (the default/base user profile, not this app's own profile)
3. Click **Add Attribute**
4. Fill in:
* **Data type**: `string`
* **Display name**: `Bruno License Role`
* **Variable name**: `brunoLicenseRole`
* **Attribute type**: `Personal`
5. Click **Save**
Do not check any "define enumerated list of values" / array option when creating this attribute. If it renders as a dropdown instead of a plain text box afterward, it was created as an enum with no options, and any value you set on a user's profile will be silently dropped. It must be a plain free-text string.
### Add a roles attribute to your Bruno app's profile
1. Go to your Bruno SCIM app → **Provisioning** → **To App**, click **Go to Profile Editor**
2. Click **Add Attribute**
3. Fill in:
* **Data type**: `string`
* **Display name**: `Roles`
* **Variable name**: `roles`
4. Click **Save**
Okta may default this attribute's namespace to something app-specific instead of the base SCIM schema, which causes it to be sent nested (e.g. `"roles": {"roles": "..."}`) instead of as a flat field, and Bruno won't recognize it. If this happens, use the Okta API to set this attribute's `externalNamespace` to `urn:ietf:params:scim:schemas:core:2.0:User` (matching the other built-in attributes like `givenName`), the same namespace already used by attributes such as `givenName` or `locale` on this profile.
### Map the attribute to the roles field
1. Go to your Bruno SCIM app → **Provisioning** → **To App** → **Attribute Mappings**
2. Find the `roles` row and click the pencil icon
3. Set **Attribute value** to **Expression** and enter:
```
user.brunoLicenseRole
```
4. Set **Apply on** to **Create and update**
5. Click **Save**
Use `user.brunoLicenseRole` (global profile), not `appuser.brunoLicenseRole`. Okta blocks same-profile attribute references in expression mappings.
### Configure Admin Role Mapping in Bruno
1. In the Bruno LM portal, go to **Settings → SCIM → Admin Role Mapping**
2. Enter the role value(s) that should grant admin access, for example:
```
bruno-admin
```
3. Multiple values are supported comma-separated (e.g. `bruno-admin, admin`). Any match grants admin access.
4. Values must exactly match what you set on users in Okta (case-sensitive)
5. Click **Save**
### Set the role on users in Okta
For each user you want to provision as a License Manager admin:
1. Go to **Directory → People → \[user] → Profile tab → Edit**
2. Find **Bruno License Role** and set the value to `bruno-admin` (or whatever you configured above)
3. Click **Save**
Leave **Bruno License Role** empty for users who should be provisioned as regular licensed users.
## Assign people and groups to Bruno in Okta
1. Under your created Bruno Application, navigate to the **Assignments** tab
2. Select **Assign** and either **Assign to People** or **Assign to Groups** to provision Bruno license keys. If you [configured Admin Role Mapping](#configure-admin-role-mapping), make sure the assigned user's **Bruno License Role** attribute is set first
3. Assigned users with a matching admin role get portal access directly, with no license key or email. All other assigned users receive an email with their **License Key**
## Deprovision users from Bruno in Okta
1. Under your created Bruno Application, navigate to the **Assignments** tab
2. Remove the desired users or groups, their license key(s) will be deactivated and they will receive an email notification
## Related Resources
For more information about configuring SCIM provisioning with Okta, refer to these Okta documentation resources:
* [Add SCIM provisioning to app integrations](https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_scim.htm) - Step-by-step guide for adding SCIM provisioning to Okta applications
* [SCIM 2.0 protocol overview](https://help.okta.com/en-us/content/topics/provisioning/opp/opp-provision-scim-messages.htm) - Reference for SCIM 2.0 messages and provisioning operations
* [On-premises provisioning with SCIM](https://help.okta.com/en-us/content/topics/provisioning/opp/opp-architecture.htm) - Architecture and setup for SCIM provisioning
* [Test SCIM connectors](https://help.okta.com/en-us/content/topics/provisioning/opp/opp-test-scim-server.htm) - Guide for testing SCIM connectors and servers
* [Okta provisioning documentation](https://help.okta.com/en-us/content/topics/provisioning/provisioning.htm) - Comprehensive provisioning documentation and best practices