Okta
From Planfix
Integration with Okta allows your company's employees to log into Planfix and other services using a single password (Single Sign-On). This enhances convenience, security, and simplifies user account management.
Supported features
- IdP-initiated SSO (Single Sign-On)
- SP-initiated SSO
- Just-In-Time (JIT) provisioning
- SCIM provisioning
SCIM supported feature
- Create users
- Update users attributes
- Deactivate users
- Import users
Configuration steps
Steps in Planfix:
- Go to the Account management — Integrations — Single Sign-On section.
- Activate integration with Okta.
Steps in Okta:
- Open the Okta administration panel in a separate tab: https://www.okta.com/.
- Go to the Applications section.
- Click on the Browse App Catalog button.
- Search for "Planfix" in the catalog:
- Select the Planfix application and click Add.
- Copy the Planfix account domain from the integration settings in Planfix and click Done.
- In the application settings, go to the Sign On tab.
- Copy the Metadata URL link.
- Paste the Metadata URL link into the corresponding field in the integration settings in Planfix.
- Save the integration settings in Planfix.
Now, on the Planfix login page, you will have the option to authorize through SSO. Ensure that users are granted access to the Planfix application in Okta. When a new user logs in for the first time in Planfix, their account will be automatically created through the JIT (Just-In-Time provisioning) mechanism.
SP-initiated SSO
To initiate SSO from Planfix, follow these steps:
- Go to the Planfix login page.
- Click on the Login with Okta button.
- You will be redirected to the Okta login page.
- Enter your Okta credentials and click Login.
- You will be redirected back to Planfix and logged in automatically.
Setting up SCIM Provisioning
Steps in Okta:
- Go to the Planfix application settings in Okta.
- Open the Provisioning section:
- Copy the SCIM Token from the integration settings in Planfix.
- Paste it into the corresponding field in Okta.
- Perform a configuration check by clicking the Test Connector Configuration button, and click Save to complete the setup.
- Set up rules in the To App section according to your organization's requirements.
- Also, set up rules in the To Okta section if you need to add users from Planfix to Okta.
Supported SCIM attributes
The following SCIM attributes are supported for user provisioning from the schema urn:ietf:params:scim:schemas:core:2.0:User:
| Display Name | Variable Name | Data type | Attribute Type | External name (syntax of attributes' values) | External namespace |
| Username | userName | string | Base | urn:ietf:params:scim:schemas:core:2.0:User | |
| Given name | givenName | string | Base | name.givenName | urn:ietf:params:scim:schemas:core:2.0:User |
| Family name | familyName | string | Base | name.familyName | urn:ietf:params:scim:schemas:core:2.0:User |
| Middle name | middleName | string | Custom | name.middleName | urn:ietf:params:scim:schemas:core:2.0:User |
| Preferred language | preferredLanguage | string | Custom | preferredLanguage | urn:ietf:params:scim:schemas:core:2.0:User |
| Locale | locale | string | Custom | locale | urn:ietf:params:scim:schemas:core:2.0:User |
| Time zone | timezone | string | Custom | timezone | urn:ietf:params:scim:schemas:core:2.0:User |
| Primary phone | primaryPhone | string | Custom | phoneNumbers.^[primary==true].value | urn:ietf:params:scim:schemas:core:2.0:User |
| Primary phone type | primaryPhoneType | string | Custom | phoneNumbers.^[primary==true].type | urn:ietf:params:scim:schemas:core:2.0:User |
| Primary email | string | Custom | emails.^[primary==true].value | urn:ietf:params:scim:schemas:core:2.0:User | |
| Primary email type | emailType | string | Custom | emails.^[primary==true].type | urn:ietf:params:scim:schemas:core:2.0:User |
Note:
- The assignment email and the user’s personal email serve different purposes in the system:
- The personal email is used for account registration and authentication.
- The assignment email is a dedicated address generated for assigning tasks to the user via email from external sources. It may use a system-specific domain (e.g., *.planfix.com) to route such assignments directly into the system.