Table of contents:
In this guide, we outline the step-by-step process for seamlessly integrating an internal application, RightHand Cybersecurity (RH), with Okta's authentication system. By leveraging Okta's admin console, we create a RH App and then create a SCIM integration.
NOTE: When a user is suspended from Okta the deactivation of that user is currently not supported in Cyberready. The following actions lead to archiving of a user in Cyberready:
When user is deleted
When user is deactivated
When user is removed from the app that is assigned to Cyberready
Configuration Steps
Log in to the Okta account with admin credentials.
Create a new Application in Okta
Navigate to Okta Dashboard > Applications.
Click Create App Integration.
Select SAML2.0 on the app integration screen and then click Next.
Click Right-Hand Cybersecurity in the App name field. Once you're done with the setup, click Next.
In the Cyberready portal, navigate to your company Settings > Integrations > SSO > Add Integrations → copy your SAML configurations.
Go back to OKTA and paste these settings into the Configure SAML tab and click Next.
Click I'm an OKTA customer adding an internal app and tick the checkbox This is an internal app that we have created and click Finish to complete the setup process.
Okta Settings for Enabling SCIM
Go to the General tab in RH App > Edit App Settings > Provisioning = SCIM and click Save.
Go to Provisioning tab > Integration > SCIM Connection > Edit.
SCIM connector base URL will be the Webhook URL copied from cyberready portal
Make the following selections:
Unique identifier field for users = email
Enable following Supported provisioning actions.
Import New Users and Profile Updates
Push New Users
Push Profile Updates
Push Groups
Authentication Mode > HTTP Header.
HTTP Header Token will be the token copied from Cyberready portal as shown below
Click on Test connector Configuration
Click on Save to complete the configuration
Mapping of SCIM Fields with Right-hand
Currently Right-hand ingests the SCIM fields and the mappings are as follows:
Note: While creating the custom attribute, use the below-mentioned fields for external name.
Right-hand Field | SCIM Field | Okta Field |
userName | userName | |
First Name | name.givenName | user.firstName |
Last Name | name.familyName | user.lastName |
Department | department | user.department |
Manager Name | managerValue | user.managerId |
Office Location | formatted | user.postalAddress |
Job Title | title | user.title |
Division | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:division | user.division |
Employee Type | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeType | user.userType |
Mapping of SCIM Schema with Right-hand
Currently, Right-hand ingests the SCIM Schema and the mappings are as follows:
Note: While creating the custom attribute, use the below-mentioned Schema for external namespace.
Right-hand Schema | SCIM Schema | Okta Schema |
urn:ietf:params:scim:schemas:core:2.0:User | urn:ietf:params:scim:schemas:core:2.0:User | urn:ietf:params:scim:schemas:core:2.0:User |
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User |
You can refer the screenshot below:
Syncing User Groups via Push Groups
Okta supports syncing User Groups to Cyberready using Okta's Push Groups feature. To enable this, go to the Push Groups tab in your RH app in Okta, select the groups you want to sync, and push them.
Please follow the below instructions to sync user groups to the Right-Hand platform
Step 1: Assign the SCIM application to the group
In the Okta Admin Console, go to Directory > Groups.
Select the group you want to sync.
Open the Applications tab and click Assign applications.
Find the Right-Hand Cybersecurity SCIM application and click Assign.
Click Save and Go Back, then click Done.
Step 2: Push the group to Right-Hand Cybersecurity
Go to Applications and Resources > Applications and open the Right-Hand Cybersecurity SCIM application.
Open the Push Groups tab. If this is your first sync, the list is empty.
Click Push Groups > Find groups by name.
Search for and select the group, then click Save.
Wait for the Push Status to change from Pushing to Active.
Step 3: Verify the sync in Right-Hand Cybersecurity
Sign in to the Right-Hand Cybersecurity platform and check that the group's users appear.
To confirm group membership, open a synced user with an assigned pushed group and click Edit. The user’s group should match the Okta group you pushed.
Limitation: Removing a user from a group in Okta does not automatically sync to Cyberready. After removing a user from a group, you must manually trigger a Push Groups sync for that specific group. This is an Okta platform limitation.