Skip to main content
Use this guide to manage Sela users and groups from Okta. SCIM provisioning uses a separate Okta application from the OIDC application used for single sign-on.
Treat the SCIM bearer token like a password. Store and share it only through an approved secrets manager. Never send it through ordinary email or include it in a support ticket.

​
Before you begin

Ask your Sela contact for:
  • Your SCIM Base URL
  • Your SCIM Bearer Token
You also need Okta administrator access that allows you to add applications and assign users and groups.

​
Configure SCIM

1

Add the SCIM application

In Okta Admin:
  1. Open Applications → Browse App Catalog.
  2. Search for (OAuth Bearer Token) Governance with SCIM 2.0.
  3. Select the application and click Add Integration.
  4. Set Application label to Sela SCIM.
  5. Enable Do not display application icon to users.
  6. Disable Browser plugin auto-submit.
  7. Click Next, then Done.
This application handles provisioning only. Do not replace or modify your existing Sela OIDC application.
2

Connect Okta to Sela

Open the new Sela SCIM application, then:
  1. Open Provisioning → Integration.
  2. Click Configure API Integration.
  3. Enable API Integration.
  4. Enter the SCIM 2.0 Base URL provided by Sela.
  5. Enter the OAuth Bearer Token provided by Sela.
  6. Click Test API Credentials.
  7. After Okta reports a successful connection, click Save.
Enter the Base URL exactly as provided, without adding a trailing slash.
3

Enable user provisioning

Open Provisioning → To App, click Edit, and configure:
  • Create Users: enabled
  • Update User Attributes: enabled
  • Deactivate Users: enabled
  • Sync Password: disabled
  • Set password when creating new users: disabled
Click Save.
4

Keep only required mappings

Under Provisioning → To App → Attribute Mappings, keep the mappings that send these required values:
  • User name
  • First name
  • Last name
  • Primary email
Keep the system-managed external ID and active status fields if Okta displays them. Remove every other optional mapping unless Sela has asked you to provision that attribute.In particular, remove these default type mappings if they are present because they can cause user update requests to fail:
  • Primary email type
  • Primary phone type
  • Address type
5

Assign users and groups

Open the Assignments tab and assign the people or groups that Okta should provision into Sela.Users who need to sign in must also be assigned to the separate Sela SSO application. Assigning a group to the SCIM application provisions its users, but does not push the group object itself.
6

Push groups

To provision group objects and memberships:
  1. Open the Push Groups tab.
  2. Select Push Groups → Find groups by name.
  3. Choose the group to send to Sela.
  4. Confirm the match and click Save.
  5. Repeat for each group Sela should receive.

​
Verify the integration

Start with one test user and one test group before assigning production users:
  1. Assign the test user to the Sela SCIM application.
  2. Confirm the assignment reaches a provisioned state in Okta.
  3. Ask your Sela contact to confirm that the user and pushed group arrived.
  4. Update the user’s first or last name and confirm the update is synchronized.
  5. Unassign the user and confirm that the user is deactivated in Sela.

​
Troubleshooting

​
Test API Credentials returns 401

Re-enter the bearer token. If the token was lost or rotated, ask Sela for a new token.

​
Test API Credentials fails with the correct token

Confirm that the SCIM Base URL has no trailing slash and was copied exactly as provided.

​
Users are not provisioned

Confirm that Create Users is enabled and that the user is assigned to the SCIM application.

​
User updates fail

Confirm that Update User Attributes is enabled and remove the three type mappings listed above. Also confirm that all required mappings remain configured.

​
Groups do not appear

Assigning a group to the application provisions its users but does not push the group object. Configure the group separately under Push Groups.