Okta SCIM

System for cross-domain identity management (SCIM) can be used to automatically provision and de-provision members and groups in your Bitwarden organization.

This article will help you configure a SCIM integration with Okta. Configuration involves working simultaneously with the Bitwarden web vault and Okta Admin Portal. As you proceed, we recommend having both readily available and completing steps in the order they are documented.

The following provisioning features are supported by this integration:

• Push users: Users in Okta that are assigned to Bitwarden are added as users in Bitwarden.

• Deactivate users: Users with the deactivated status will no longer have access to their assigned apps. Deactivating a user in Okta will change their Bitwarden status to revoked. 

• Delete user: Users deleted in Okta will be moved to revoked status in the Bitwarden organization.
  

  

  note

  Choosing the suspended status for a user in Okta will not result in a revoked status in Bitwarden.

• Push groups: Groups and their users in Okta can be pushed to Bitwarden.

To start your SCIM integration:

1. From the Admin Console, go to Settings → SCIM provisioning.

2. Check Enable SCIM.

3. Select Save.

4. Your SCIM URL and SCIM API key will appear, which you will later enter in Okta:
   

   

To add Bitwarden within Okta:

1. From the Okta Admin Portal, go to Applications → Applications.

2. Select Browse App Catalog.

3. In the search bar, enter Bitwarden and select Bitwarden:
   

   

4. Select Add Integration, which will open the Bitwarden app's general settings.

5. Enter a unique, Bitwarden-specific name in Application label.

6. Check Do not display application icon to users.

7. Select Done.

To set up provisioning, the following steps must be completed in the same order that's presented here.

To connect Okta with Bitwarden:

1. While still on the Bitwarden app configuration page in Okta, select Provisioning.

2. Select Configure API Integration.

3. Check Enable API Integration.

4. Enter details you found earlier in the Bitwarden Admin Console, from Settings → SCIM provisioning:

   • In the Base URL field, enter your SCIM URL from Bitwarden.

   • In the API Token field, enter your SCIM API key from Bitwarden.
     

     

5. Select Test API Credentials. If you see a confirmation message like "Bitwarden was verified successfully!" then your connection works.

6. Select Save.

To allow specific provisioning actions:

1. While still on the Provisioning tab, select To App.

2. Select Edit:
   

   

3. Check Create Users and Deactivate Users.

4. Select Save.

5. (Optional) Customize the Bitwarden Attribute Mappings.

Open the Assignments tab and use the Assign dropdown menu to assign people or groups to the application. Assigned users and groups will be automatically issued an invitation. Depending on your workflow, you may need to use the Push Groups tab to trigger group provisioning once they are assigned.

Now that your users have been provisioned, they will receive invitations to join the organization. Instruct your users to accept the invitation and, once they have, confirm them to the organization.