Configuring User Provisioning with Okta
It is possible to provision users and user groups from Okta with the M-Files app integration.
Important information
This is a preview version of the functionality. If you cannot see the necessary configuration options in M-Files Manage, the functionality is not yet available in your M-Files subscription.
When you enable user provisioning in M-Files Manage, all the provisioned users first get the license that you set as the default license type for the provisioned users. This applies also if vault-level user synchronization has been previously used. This means that some users can temporarily get a lower license. You can specify the license type for each user group after the user groups have been provisioned.
With Okta, SCIM is unidirectional, and the changes made in Okta Admin Console are synchronized to M-Files user and login accounts. However, the opposite is not true. Thus, do not use M-Files to make any changes to groups that are provisioned from Okta with SCIM. Changes made to M-Files user accounts will not have any effect in Okta.
Prerequisites
You must have the Subscription admin role in M-Files Manage.
Supported provisioning features
- Creating users
- Updating user attributes
- Deactivating users
- Group push
For more information about user management in Okta, refer to User management in Okta Documentation.
Configuring User Provisioning in M-Files Manage
To configure user provisioning in M-Files Manage:
- Go to .
-
In the top-right corner of the Configurations page, click .
If you cannot see this option, the functionality is not yet available in your M-Files subscription.
-
Enter the necessary information.
- In Configuration name, enter a unique name for the configuration.
- Select Default license type for the provisioned users. All the provisioned users first get this license. You can change a user group's license type to a higher one after user groups have been provisioned. If there are not enough available licenses of the default license type in the subscription, all the users do not get a license.
-
Click Save.
Result:M-Files Manage creates the tenant URL, client ID, and client secret for your configuration.
-
Click the copy icon (
) for each piece of data, that M-Files Manage created, and note down the values.
Note: The client secret is not shown anywhere else when you close the dialog.The client secret is necessary to configure user provisioning in Okta Admin Console.
Configuring User Provisioning in Okta Admin Console
This section tells you how to set up user provisioning in Okta Admin Console with the M-Files application from the Okta App Catalog.
The steps to set up Okta in your Okta Admin Console version can be different from the ones that are given here. Refer to Okta documentation for the latest instructions and more information on Okta app integrations.
- In Okta Admin Console, go to .
- Click Browse App Catalog.
- Find and select the M-Files application.
- Click Add Integration.
- In the general settings, select Do not display application icon to users.
- Click Done.
- Go to the Provisioning tab and click Configure API Integration.
- Select Enable API integration.
-
Enter the data, that you copied after you saved the M-Files Manage configuration for user provisioning, to
the related fields:
- Enter the tenant URL to Base URL.
- Enter the client ID to Username.
- Enter the client secret to Password.
- Click Test API Credentials.
- Click Save.
- On the Settings pane, select To App.
- Click Edit.
-
Specify the settings. See the information in the table and the example
image.
Option Enabled Create Users Yes Create Users > Set password when creating new users No Update User Attributes Yes Deactivate Users Yes
- Go to the Assignments tab.
-
Select which users and user groups to provision to M-Files with the Assign drop-down menu.
If you assign user groups, the group members are provisioned to M-Files, not the group itself. Assign those user groups whose members require access to M-Files.
-
Enable group push to provision the necessary user groups to M-Files. It is recommended that these user
groups are separate from the groups that you assigned. For more information,
refer to App assignments and Group
Push in Okta Documentation.
For instructions, refer to Enable Group Push in Okta Documentation.
If there were not enough available licenses of the default license type in the subscription, some of the provisioned users are waiting for a license. You can see the number of users waiting for a license on the Home page of M-Files Manage. In the list of users on the Users page of M-Files Manage, users waiting for a license have a waiting tag in the License type column.