Okta SCIM Integration

System for cross-domain identity management (SCIM) can be used to automatically provision and de-provision members and groups in your Bitwarden organization.

This article will help you configure a SCIM integration with Okta. Configuration involves working simultaneously with the Bitwarden web vault and Okta Admin Portal. As you proceed, we recommend having both readily available and completing steps in the order they are documented.

The following provisioning features are supported by this integration:

• Push Users: Users in Okta that are assigned to Bitwarden are added as users in Bitwarden.

• Deactivate Users: When users are deactivated in Okta, they will be deactivated in Bitwarden. 

• Push Groups: Groups and their users in Okta can be pushed to Bitwarden.

To start your SCIM integration, open the Admin Console and navigate to Settings → SCIM provisioning:

Select the Enable SCIM checkbox and take note of your SCIM URL and SCIM API Key. You will need to use both values in a later step.

In the Okta Admin Portal, select Applications → Applications from the navigation. On the Application screen, select the Browse App Catalog button:

In the search bar, enter Bitwarden and select Bitwarden:

Select the Add Integration button to proceed to configuration.

On the General Settings tab, give the application a unique, Bitwarden-specific label. Check the Do not display application icon to users and Do not display application icon in Okta Mobile App options and select Done.

Open the Provisioning tab and select the Configure API Integration button.

Once selected, Okta will list a few options for you to configure:

1. Check the Enable API Integration checkbox.

2. In the Base URL field, enter your SCIM URL, which can be found on the SCIM Provisioning screen (learn more).

3. In the API Token field, enter your SCIM API Key (learn more).

Once you are finished, use the Test API Credentials button to test your configuration. If it passes the test, select the Save button.

On the Provisioning → To App screen, select the Edit button:

Enable, at a minimum, Create Users and Deactivate Users. Select Save when you are done.

Open the Assignments tab and use the Assign dropdown menu to assign people or groups to the application. Assigned users and groups will be automatically issued an invitation. Depending on your workflow, you may need to use the Push Groups tab to trigger group provisioning once they are assigned.

Now that your users have been provisioned, they will receive invitations to join the organization. Instruct your users to accept the invitation and, once they have, confirm them to the organization.