Configuring Okta SCIM integration for Nintex Automation K2

Use this guide to configure and install the SCIM test app in Okta. The app lets you use OAuth 2.0 Authorization Code grant flow as your method of authentication and SCIM as your method of identity provisioning.

Definitions:

  • OKTA SCIM test app: the application in Okta set up to provision identities using the SCIM protocol.

Prerequisites

Ensure that you have the following before you start configuring Okta:

  • An Okta account with admin privileges
  • SCIM API URL
  • K2 service account

Supported features

The following items are the current features supported by the Okta SCIM integration for Nintex Automation K2:

  • SP-initiated SSO
  • Create Users
  • Update User Attributes
  • Deactivate/Reactivate Users
  • Group Push

Procedure

Use these steps to configure the SCIM test app in Okta.

For this step you need the K2 SCIM API URL and K2 service account details mentioned in the prerequisites section  above:

  1. Log in to Okta and add the SCIM Test app by clicking Browse App Catalog:

  2. Select the All integrations tab, search for and select the SCIM 2.0 test app (Basic auth) app.

  3. Click Add Integration to provision the app.

  4. Name your app, and set Sign-On options. Leave this as SAML 2.0 and click done.
  5. Click on the Provisioning tab and then Configure API Integration.
  6. Check Enable API integration and fill in your credentials.
    Description Example

    SCIM 2.0 Base Url     		This URL is the endpoint of SCIM on your environment https://nintex.k2demo.xyz/api/scim/v2/4/
    Username Username of your K2 service account Bob@k2test.com
    Password Password for K2 service account Password321!
    For example:


    Click Test API credentials to check if a connection can be made and then click save.
  7. Click To App under Settings. Click Edit and select Enable for each of the options you'd like to have from the supported features listed above. For example:
    • Create Users
    • Update User Attributes
    • Deactivate Users
    • Click Save to continue.
With an IDP set up and client app created as shown in the previous section you will need the following from the IDP:
  • Clientid – ID for you client app
  • Authority – Domain for you IDP
  • Client Secret - GUID generated by your client

Follow the steps below to configure OIDC for your environment

  1. Extract OIDC preview from {K2 install location}\Setup\Features\ K2OIDC Preview.zip

  2. Run ConfigureOIDC.exe as administrator

  3. Provide the K2 database connection string and press Enter. The default option will connect to localhost SQL instance database, named K2.

    Copy

    K2 database connection string example

    Data Source=Localhost;Initial Catalog=K2;Integrated Security=True;Pooling=True;Encrypt=True;TrustServerCertificate=True

  4. Provide the K2 host server connection string and press Enter. We recommend using the integrated authentication to localhost, as this will work correctly if the current user has rights to execute SmartObjects.

    Copy

    Host server connection string example

    Integrated=True;IsPrimaryLogin=True;Authenticate=True;EncryptedPassword=False;Host=Localhost;Port=5555 

  5. Run step 1 to install the OpenID assemblies. Once completed, you will be returned to the main menu.

  6. Run step 2 and provide the following values:

    1. Client ID – the client Id from the OIDC application created.

    2. Authority – the issuer base url eg https://trial-5190475.okta.com (to check locate the OIDC metadata endpoint eg https://providerurl/.well-known/openid-configuration).

    3. ClientSecret – the client secret configured for the OIDC application.

    4. Claim issuer/security label name: K2OIDC.

  7. Run step 3 to reconfigure your web configurations.

  8. Run step 4 to enable SCIM. This option will enable Sync Engine and the K2 SCIM endpoint.

If you need to revert back to WS-Fed to access Management in order to configure the K2 server, then run option 5 once you have reverted, and should you want to go back to OIDC run option 6.

After creating the SCIM test app, you must assign people, groups, and group membership details to it for provisioning. Assign people and group names from the Assignments tab, and create the group membership details from the Push Groups tab. This section describes the process for both.

  1. Click on the Assignments tab and select People from the left-hand pane. Then click Assign and choose Assign to People.

  2. Search for and Assign the required people. When you click Assign, a page of details for the chosen person opens, as shown in step 3 below.

  3. Click Save and Go Back to assign another person, or click Done when you have assigned everyone you want to.