Configuring SCIM User Provisioning with Okta (OIN app)

CodeSignal supports SCIM 2.0 for automated user and group provisioning. This guide walks an Okta administrator through enabling SCIM provisioning on the CodeSignal application from the Okta Integration Network (OIN) catalog and connecting it to a CodeSignal organization. SCIM provisioning is configured directly on the CodeSignal app published in the OIN - no separate or custom SCIM app is required.

With SCIM enabled, Okta can automatically provision users into CodeSignal, keep profile information up to date, and deactivate users when access is removed in Okta.

Prerequisites

Before you begin, make sure you have:

• The CodeSignal application added to your Okta tenant from the OIN catalog, with SAML SSO already configured. See the SAML section of this document for setup.
• A CodeSignal organization on a plan that includes SCIM. If you are not sure whether SCIM is enabled for your organization, contact support@codesignal.com.
• An administrator role in your CodeSignal organization.
• An administrator role in your Okta tenant.

Supported features

The Okta CodeSignal application supports the following provisioning features:

• Import New Users (enabled by default) — Okta imports users from CodeSignal.
• Import Profile Updates (enabled by default) — Okta imports profile changes for previously imported users.
• Push New Users — when a user is assigned to the CodeSignal application in Okta, an account is created in CodeSignal.
• Push Profile Updates — updates to a user’s profile in Okta (name, email, status, role) are propagated to CodeSignal.
• Push User Deactivation — when a user is unassigned from the application or deactivated in Okta, the matching account is deactivated in CodeSignal.
• Reactivate Users — reactivating a user in Okta reactivates the matching account in CodeSignal.
• Group Push — Okta groups can be pushed to CodeSignal as Teams, with membership kept in sync. See Group Push below for details.

Import New Users and Import Profile Updates (from app to Okta) are the default features enabled for all OIN applications; both are supported by CodeSignal.

The following standard feature is not supported:

• Sync Password — passwords are intentionally not synced. Users sign in to CodeSignal through SAML SSO.

For more information on the listed features, see the Okta glossary in the Okta Help Center (help.okta.com).

Configuration steps

Step 1: Generate a SCIM token in CodeSignal

1. Sign in to CodeSignal as an organization administrator.
2. Go to Organization Settings.
3. In the User Provisioning card:

• Check Enable SCIM.
• (Optional) Check Enable role management via SCIM if you want CodeSignal user roles to be controlled by Okta.
• (Optional) Check Enable team management via SCIM if you plan to use Group Push to manage CodeSignal Teams from Okta. (This option is visible only when your CodeSignal plan includes Teams.)
• Select a Default role to assign to newly provisioned users.
• Click Generate next to the SCIM token field. Copy the generated token to a secure location.

4. Click Save.

Important: SCIM tokens expire after 180 days. Set a calendar reminder to regenerate and rotate the token in Okta before it expires; otherwise provisioning operations will start returning 401 Unauthorized errors.

Step 2: Configure API integration in Okta

1. In Okta, open the CodeSignal application.
2. Go to the Provisioning tab.
3. Click Configure API Integration.
4. Check Enable API integration.
5. Fill in the credentials:

• API Token: paste the SCIM token you generated in Step 1.

6. Click Test API Credentials. You should see a success message.
7. Click Save.

Step 3: Enable provisioning features

1. Still on the Provisioning tab, select To App in the left-hand menu.
2. Click Edit and enable the following options:

• Create Users
• Update User Attributes
• Deactivate Users

3. Click Save.
4. Select To Okta in the left-hand menu. The default features — Import New Users and Import Profile Updates — are enabled automatically. Leave them enabled unless you have a specific reason to disable them.

Step 4: Set the Application username format

CodeSignal expects each user’s SCIM userName to be their email address. To make sure Okta sends the correct value:

1. On the CodeSignal application page, go to the Sign On tab.
2. Click Edit in the Settings section.
3. Under Credentials Details, set Application username format to Email.
4. Click Save.

Step 5: Assign users to the application

1. Go to the Assignments tab.
2. Assign individual users or groups to the CodeSignal application. Each assigned user will be provisioned to CodeSignal as soon as Okta processes the assignment.

Step 6 (optional): Configure Group Push

If you want to manage CodeSignal Teams from Okta, see Group Push below.

Verify provisioning

To confirm provisioning is working correctly:

1. Assign a test user to the application and verify the user appears in CodeSignal.
2. Update a user attribute in Okta and confirm the change syncs successfully.
3. Remove the assignment and confirm the user is deactivated in CodeSignal.

You can review provisioning activity in Okta under Applications › CodeSignal › Tasks.

Role provisioning

CodeSignal sets each user’s role from Okta through the SCIM roles attribute. The CodeSignal OIN app ships with a pre-configured app_role attribute (mapped to roles.^[primary==true].value in the User core schema), pre-populated with CodeSignal’s default system roles. You do not need to create this attribute — you only manage which role values it offers and assign a value per user. Role provisioning is optional.

Requirements

• Enable role management via SCIM must be checked in the CodeSignal User Provisioning card before roles take effect (see Step 1 above). Until it is enabled on the CodeSignal side, the role value Okta sends is accepted by the SCIM endpoint but not persisted, and every user keeps the Default role.
• A Default role must be selected in the CodeSignal User Provisioning card. It is applied to any user provisioned without a role value.

Manage the available role values

The app_role attribute comes preset with CodeSignal’s default system roles. If your organization uses custom roles — or you want to remove roles you don’t use — edit the attribute’s value list:

1. In Okta, open the CodeSignal application, go to Provisioning › To App, and open the Profile Editor (or Directory › Profile Editor › CodeSignal).
2. Find the app_role attribute and click the edit (pencil) icon.

3. Under the attribute’s enumerated value list (Define enumerated value list of values):

   a. Add a role - add a new entry: set Display name to a friendly label and Value to the exact CodeSignal role key.

   b. Update a role - change the entry's Value to the correct CodeSignal role key, or rename its Display name.

   c. Delete a role - remove the entries for roles your organization does not use.

     4. Click Save.

Each Value must match an existing role key in your CodeSignal organization. You can find a role’s key in the URL of its Edit role page in the CodeSignal dashboard. A value that does not match a valid role key is rejected during provisioning (the SCIM call returns a “Role not found” error).

Assign a role to a user

5. For each assigned user, set the app_role attribute to one of the configured values.

6. The role is applied on the next Push Profile Updates sync. A user left without a value receives the Default role.

Group Push

CodeSignal uses SCIM groups to manage Teams. Pushing an Okta group to CodeSignal:

• Creates a Team in CodeSignal with the same name as the Okta group.
• Adds the group’s members to that Team. Membership in the Team is replaced (not merged) every time Okta pushes an update — this is standard SCIM behavior.

Requirements

To use Group Push with CodeSignal:

1. Your CodeSignal plan must include Teams. Contact support@codesignal.com if you are not sure.
2. Enable team management via SCIM must be checked in the CodeSignal User Provisioning card (see Step 1 above).
3. The users in the Okta group must also be assigned to the CodeSignal application in Okta. A user who is in a pushed group but is not assigned to the application will not appear in the corresponding CodeSignal Team.

If either requirement (1) or (2) is missing, Group Push requests will return 403 Forbidden and the push will fail in Okta.

Before you start: Enable team management via SCIM must be checked in the CodeSignal User Provisioning card (Step 1) *before* you push any groups from Okta. If it is not enabled on the CodeSignal side first, Group Push requests return 403 Forbidden.

Steps

1. In CodeSignal, confirm Enable team management via SCIM is checked in the User Provisioning card (see Step 1). This must be enabled before pushing groups.
2. In Okta, open the CodeSignal application.
3. Go to the Push Groups tab.
4. Click Push Groups, then choose Find groups by name or Find groups by rule.
5. Select the Okta group(s) you want to push to CodeSignal and confirm.
6. Verify that the Teams appear in CodeSignal under Organization Settings › Teams.

Troubleshoot

Additional notes

• Deactivating a user in Okta will deactivate the user in CodeSignal but will not permanently delete historical assessment data.
• Changes made directly in CodeSignal may be overwritten by future Okta syncs for SCIM-managed attributes.

Support contact

If you encounter issues that are not covered above, contact CodeSignal support at support@codesignal.com.