User Provisioning and Deprovisioning with SCIM 2.0

Steps

1. Log in to with Super Admin credentials.

2. Go to Integration > SCIM.

3. Turn on the SCIM Provisioning option.

4. Review the following configuration details displayed on the screen:

   • Base URL: The URL of the instance configured with Okta.

     Example: https://testmanagement.qmetry.com/scim/v2

     The SCIM administrator must use this URL to integrate the SCIM system with .

   • Supported SCIM 2.0 tool: Okta. Use the following syntax for Group Name and Custom Attribute in Okta.

     • Group Name: _{ProjectKey}_{Role} for project and role mapping.

     • Custom Attribute: _User_LicenseType for license type mapping, regular and read-only.

5. When prompted with a confirmation message, click Yes to enable SCIM provisioning.

   displays a success message confirming the activation.

Steps

1. Log in to your Okta Admin account.

2. Go to Applications > Applications.

3. Click Create App Integration.

4. Select SAML 2.0 as the sign-in method, then click Next.

5. Enter an App Name (for example, SSO) and click Next.

6. In the SAML Settings section, provide the following details:

   • Single sign-on URL: Enter your SSO endpoint, including the organization code.

     • Example:

       • URL: https://testmanagement.qmetry.com

       • Organization Code: QTMTST1.

       • Resulting SSO URL: https://testmanagement.qmetry.com/saml/SSO/alias/QTMTST1

     • Select Use this for Recipient URL and Destination URL.

   • Audience URI (SP Entity ID): Enter your application’s Entity ID corresponding to your Org Code.

   • Application Username: Choose Okta username prefix as the default value for user identification.

7. Click Next.

8. Select This is an internal app that we have created, then click Finish.

Steps

1. In Okta, open the (QTM) application you created earlier.

2. Go to the General tab.

3. Click Edit under App Settings.

4. Under Provisioning, select SCIM to enable SCIM-based user provisioning.

5. Click Save.

   After saving, the Provisioning tab becomes available for configuration.

Steps

1. In Okta, open your (QTM) app integration settings.

2. Go to the Provisioning tab. The SCIM connection settings appear under Settings > Integration.

3. Click Edit to modify the SCIM connection configuration.

4. Enter the following details:

   • SCIM connector base URL: Enter the SCIM connector base URL. You can find the base URL in Integration > SCIM in .

     • Syntax {QTM_url}/scim/v2.

     • Example: https://qtmcloud.qmetry.com/scim/v2

   • Unique identifier field for user: Enter the field name of the unique identifier for the users on the SCIM server. This is a static parameter value.

     • Example: userName

   • Supported provisioning actions: Select the provisioning actions supported by the SCIM Server. The following provisioning features are supported:

     • Push New Users: This option populates the Settings > To App page and contains settings for all the user information that flows from Okta into the SCIM app.

     • Push Profile Updates: This option populates the Settings > To App page and contains settings for all profile information that flows from Okta into the SCIM app.

     • Push Groups: This option populates the Settings > To App page and contains settings for all group information that flows from Okta into the SCIM app.

   • Authorization Mode: This is the mode you want Okta to use to connect to your SCIM app. Select HTTP Header.

   • Authorization: To authenticate using the HTTP Header, you need to provide a bearer token that provides authorization against your SCIM app. Enter the Open API Key of the Super Administrator of the instance.

   Generate the Open API Key

   1. Log in to QMetry Test Management with Super Administrator credentials.

   2. Navigate to Integration > Open API.

   3. In the Generate Open API section, click Generate to create a new key.

   4. Copy the generated key and paste it into the Authorization field in Okta.

5. Click Test Connector Configuration to verify the connection.

   Note

   If you are using the Okta Integrator, ensure that the following options are checked:

   • Import New Users and Profile Updates

   • Import Groups

   A success message confirms that the SCIM connector is configured correctly. Close the confirmation pop-up.

6. Click Save to apply and store the configuration.

Steps

1. Log in to Okta with an Admin account.

2. Go to Applications > Applications.

3. Open your (QTM) app integration.

4. Go to the Provisioning tab.

   You’ll see three sub-tabs:

   • To App

   • To Okta

   • Integration

5. Select the To App tab.

   You can configure what is to be copied from Okta to the app integration.

6. Click Edit to modify the configuration settings.

7. Select the required provisioning options for synchronization from Okta to :

   • Create Users: Creates or links a user in the app integration (for example, App SCIM) when assigning the app to a user in Okta. It assigns a new external application account to each user managed by Okta. Okta sends a random password in its request to create a user.

   • Update User Attributes: Okta updates a user's attributes in the integrated app (for example, App SCIM) when the app is assigned. Any attribute changes made to the Okta user profile will automatically overwrite the corresponding attribute value in the integrated app (for example, App SCIM).

   • Deactivate User: Deactivates user accounts when the users are unassigned in Okta or their Okta account is deactivated. Accounts can be reactivated if the app is reassigned to a user in Okta.

8. Click Save to apply the changes.

   Once saved, To App mappings are enabled, and user provisioning between Okta and begins based on the selected settings.

Steps

1. Log in to your Okta Admin account.

2. Go to Directory and select Profile Editor.

3. Open the Default Okta User profile.

4. Add a new custom attribute, or edit an one named QMetry_User_LicenseType for license type mapping, regular, and read-only.

5. After adding the values, Click Save Attribute.

   If the Attribute required parameter is marked as Yes, the first value will be used as the default when people are added to Okta.

6. Return to the Profiles list.

7. Open the (QTM) application profile.

8. Add a new custom attribute or edit an existing one named QMetry_User_LicenseType for license type mapping, regular, and read-only.

   • External namespace: While adding an attribute, enter urn:ietf:params:scim:schemas:core:2.0:User as the External namespace. The external namespace is used to refer to the namespace in the external system. It allows you to use additional or custom user attributes beyond what is provided by default in SCIM.

9. After adding the values, save the attribute.

10. Return to the Profile page.

11. Click Mappings for the user profile.

12. Select the Okta User to {QTM App} tab to map the user attributes.

13. Click Save Mappings to confirm the mapping between Okta and .

Steps

1. In Okta, open your (QTM) app integration.

2. Go to the Push Groups tab.

3. Click Refresh App Groups.

   • Okta imports all groups created in into Okta.

   • The synchronization process begins automatically.

4. To verify the imported groups, go to Directory > Groups in Okta.

Steps

1. In Okta, go to Directory > Groups.

2. Click Add Group.

   The Add group window opens.

3. In the Name field, enter the group name using the following syntax:

   QMetry_{ProjectKey}_{Role}

4. Click Save.

   The group is added to the list.

Steps

1. In the Okta Admin Console, go to Applications > Applications.

2. Locate the app integration on the list. You can search for the app integration using the Search field if the list is long.

3. Open the app integration once you locate it.

4. Open the Assignments tab.

5. Click Assign and select Assign to Groups.

6. Locate the group to which you want to assign the app integration and click Assign.

7. Review the attributes set in the Assign <application name> to Groups dialog.

8. Click Save and Go Back.

   The Assign button changes to Assignment and becomes disabled, indicating that the app integration has been assigned to the group.

9. Click Done to confirm.

   The app integration is assigned to the selected group. All users within the group automatically gain access to the integration. Each user's assignment type for the app integration is categorized as Group, and this information can be accessed from the Assignments tab of the integration.

10. Open the Groups tab.

    You can see the assignment for the group.

Steps

1. In Okta, open the (QTM) app integration.

2. Locate the required group.

   • Use the Search or Advanced Search options if needed.

3. Open the Push Groups tab.

4. From the Push Groups drop-down list, select Find groups by name.

5. Search for the group name you want to push.

   • When the matching group appears, select it.

6. Select the option Push group memberships immediately.

7. Click Save.

   • The selected group from Okta appears under the list of pushed groups.

8. Under Match result & push action, select Link Group.

   • If a matching group exists in , Okta links it automatically.

9. Click Save again to confirm the configuration.

   The group gets linked automatically.

Steps

1. Log in to Okta with an Admin account.

2. Go to Directory > Groups.

3. Click the group name to open it.

4. Click Assign people.

5. Click the + (Add) icon to select and add users to the group.

   • Assigned users appear in the list with the status Assigned.

6. Click Done to return to the People tab.

   You can verify the assignments in the Assignments tab > People section of the group.