Configuring Okta SCIM integration for K2 Cloud

For this step you need the Authority, BaseURL, and Token mentioned in the prerequisites section  above:

1. Log in to Okta and add the K2 Cloud app by clicking Add Application:
   
2. Select the All integrations tab, search for and select the K2 Cloud Low-code process automation app.
   
3. Click Add to provision the app.
   
4. Configure the app by filling the App Settings with the information Nintex DevOps supplied when you were on-boarded. Also check the Application visibility check boxes so that the application icon is not shown to users or in the Okta Mobile app, as in the image below. Click Save to continue.
   

   Received from DevOps	Description	Example
   Authority	This URL/token maps to the App Authority value in Okta	https://login.onk2.com/42705858-CCFF-40AE-BD24-307B4D49AA03
   BaseURL	The domain part of this URL maps to the Scim domain value in Okta. The BaseURL received from DevOps is https://scim.onk2.com/. The domain part is: onk2	onk2
   Token	This GUID maps to the SCIM Config Token value in Okta	E91A3376-8D6B-4496-8D5E-17F651204526

   For example:
   
5. On the Provisioning tab, click Configure API Integration.
   
6. Check the Enable API integration check box and click Authenticate with K2 Cloud Low-code process automation to enable provisioning features.
   
   The K2 identity token service login page opens. Select your Okta domain (dev-xxxxxx.okta.com) and login to continue.
   
   You are returned to the Okta provisioning page after logging in.
7. Uncheck the Import Groups check box. The K2 Cloud identity sync service does not support Okta importing groups from K2 Cloud. Click Continue in the pop-up dialog, then click Save to continue.
   
   When you uncheck the Import Groups box, this dialog shows, click Continue:
   
8. Click To App under Settings. Click Edit and select Enable for each of the options you'd like to have from the supported features listed above. For example:
   • Create Users
   • Update User Attributes
   • Deactivate Users
   Click Save to continue.
   
9. On this same page, take note of the Attribute Mappings. No action is required. The top attribute is the Okta attribute mapped to the SCIM attribute underneath it.
   
   A user's username and a group's name are immutable properties in K2. They cannot change after they have been created, because of this, K2 doesn't support renaming users and groups in Okta.
   
   
   

   Supported Okta attribute mappings:	Okta attribute mappings not supported by K2:
   username givenName familyName email emailType displayName managerValue	honorificPrefix middleName honorificSuffix title nickname profileUrl primaryPhone primaryPhoneType addressType streetAddress locality region postalCode country formatted preferredLanguage locale timezone userType employeeNumber costCenter organization division department entitlements roles

After creating the K2 Cloud app, you must assign people, groups, and group membership details to it for provisioning. Assign people and group names from the Assignments tab, and create the group membership details from the Push Groups tab. This section describes the process for both.

People

1. Click on the Assignments tab and select People from the left-hand pane. Then click Assign and choose Assign to People.
   
2. Search for and Assign the required people. When you click Assign, a page of details for the chosen person opens, as shown in step 3 below.
   
3. Click Save and Go Back to assign another person, or click Done when you have assigned everyone you want to. Note that only the supported K2 Cloud attribute mappings as listed above in supported Attribute Mappings will apply during the provisioning into the K2 Cloud Identity Database.
   

At this point Okta provisions the assigned users via the K2 Cloud app (using the SCIM protocol), into the K2 Cloud Identity Database.

Groups

Assign groups to the K2 Cloud app using the same steps as when assigning people, as described in the section above. Okta will only provision the members of that group into the K2 Cloud Identity Database, the group itself will not be provisioned. To provision groups, use the Push Groups tab.

Push Groups

Use the Push Groups tab to provision group membership details to the K2 Cloud Identity Database. If you push a group but have not assigned the members of that group (or the group itself) to the K2 Cloud app, the group is provisioned without members.

1. Select the Push Groups tab, then select Find groups by name from the drop-down.
   
2. Search for the groups you want to provision to the K2 Cloud instance. Check the Push group memberships immediately option. Click Save & Add Another to search for and add another group. When all the groups you want provisioned are added, click Save to finalize group membership.
   

Use the Okta Dashboard to check for provisioning errors that occurred during the assignment of people and groups, or while pushing groups. You can retry the action that caused the error and if that does not correct the issue, log a ticket with Nintex support. The following points show an example of error checking.

• Navigate to Dashboard and select Tasks. Clicking on an error opens a page where you can retry the failed operation.
  
• In this case, there was an error authenticating. Check the error item and click Retry Selected. Log a ticket with Nintex Customer Central if retry does not work.