Configure SCIM Provisioning with Okta

Overview

This guide explains how an Okta administrator and a SmarterSends administrator configure SCIM provisioning. After configuration, Okta can manage supported user lifecycle operations in SmarterSends.

Supported features

• Create users: Creates a SmarterSends user when the user is assigned to the SmarterSends application in Okta.
• Update user attributes: Updates supported SmarterSends user attributes when mapped values change in Okta.
• Deactivate users: Deactivates a SmarterSends user when the user is deactivated or unassigned in Okta.
• Import users: Imports SmarterSends users into Okta.
• Profile sourcing: Allows SmarterSends to act as a profile source when enabled in Okta.
• Group push: Pushes selected Okta groups and their memberships to SmarterSends.

Only the features listed above are supported.

For definitions of these features, see the Okta Glossary
 

Prerequisites

Before you begin, make sure that:

• You have a SmarterSends account with administrator access.
• You have an Okta account with permission to configure application provisioning.
• The SmarterSends SAML 2.0 integration has been configured and saved.
• You know your SmarterSends subdomain.

Your SmarterSends subdomain is the part of your account URL before .smartersends.com.

Example:

SmarterSends URL: https://acme.smartersends.com
Subdomain: acme

Enter only acme in Okta. Do not enter https://, .smartersends.com, a path, or a trailing slash.

Configuration steps

Part 1: Obtain the SCIM API token from SmarterSends

1. Sign in to SmarterSends with an administrator account at:

  https://YOUR_SUBDOMAIN.smartersends.com

2. Go to Integrations.
3. Open the SAML2 with SCIM integration.
4. Locate the SCIM Bearer Token. This is the API token Okta uses to authenticate SCIM requests.
5. Copy the token.

Treat the token as a secret. Do not include it in support tickets, screenshots, chat messages, or other unsecured communications.

Part 2: Verify the subdomain in Okta

1. Sign in to the Okta Admin Console.
2. Go to Applications > Applications > SmarterSends.
3. Open the General tab.
4. Verify that Subdomain contains only your SmarterSends subdomain.

  Example: If your account URL is https://acme.smartersends.com, enter acme.

5. Save the General settings if you made a change.

Part 3: Add the SCIM API token in Okta

1. In the SmarterSends application in Okta, open the Provisioning tab.
2. Under Settings, select Integration.
3. Click Configure API Integration.
4. Select Enable API Integration.
5. In the API Token field, paste the SCIM Bearer Token copied from SmarterSends.
6. Click Test API Credentials.
7. Confirm that Okta reports a successful connection.
8. Click Save.

The SmarterSends integration derives the SCIM endpoint from the Subdomain value. Do not paste the API token into the Subdomain field.

Part 4: Enable provisioning from Okta to SmarterSends

1. In the SmarterSends application in Okta, go to Provisioning > To App.
2. Click Edit.
3. Enable the features required by your organization:

  Create Users
  Update User Attributes
  Deactivate Users

4. Click Save.

Part 5: Review user mappings

1. In the SmarterSends application in Okta, go to Provisioning > To App.
2. Review the attribute mappings.
3. Confirm that the Okta username used for SmarterSends is the user's email address.
4. Keep the default mappings unless your organization has a specific mapping requirement.
5. Save any changes.

Part 6: Assign a test user

1. Open the Assignments tab for the SmarterSends application in Okta.
2. Assign the application to a non-production test user.
3. Confirm that the user is created in SmarterSends.
4. Change a mapped attribute in Okta and confirm that the value is updated in SmarterSends.
5. Unassign or deactivate the test user in Okta and confirm that the user is deactivated in SmarterSends.
6. After testing succeeds, assign the application to the required users or groups.

Part 7: Configure group push, if required

1. Open the Push Groups tab for the SmarterSends application in Okta.
2. Click Push Groups.
3. Find the Okta group by name or by rule.
4. Select the group and configure the push.
5. Save the configuration.
6. Confirm in SmarterSends that the group and its membership were received.

Troubleshooting

Test API Credentials fails

- Verify that the Subdomain field contains only the portion before .smartersends.com.
- Verify that the API token was copied from SmarterSends > Integrations > SAML2 with SCIM.
- Copy the token again and make sure that it does not contain leading or trailing spaces.
- Verify that Enable API Integration is selected.
- If the token was replaced in SmarterSends, paste the current token into Okta and test again.

A user is not created in SmarterSends

- Verify that Create Users is enabled under Provisioning > To App.
- Verify that the user or one of the user's Okta groups is assigned to the SmarterSends application.
- Verify that the user's email address is populated and mapped as the SmarterSends username.
- Review the Okta System Log for the provisioning error.

User attributes are not updated

- Verify that Update User Attributes is enabled.
- Review the To App attribute mappings.
- Confirm that the changed Okta attribute is mapped to a supported SmarterSends attribute.
- Review the Okta System Log for the provisioning error.

A user is not deactivated

- Verify that Deactivate Users is enabled.
- Verify that the user was unassigned from the application or deactivated in Okta.
- Review the Okta System Log for the provisioning error.

A group is not pushed

- Verify that the group was added separately on the Push Groups tab. Assigning a group to the application does not automatically configure Group Push.
- Review the group push status and any errors shown by Okta.

Support

For help with the SmarterSends integration, email [e-mail] or submit a request at:
https://smartersends.zendesk.com/hc/en-us/requests/new