Setting up Okta SCIM provisioning for Dagster Cloud#

The System for Cross-domain Identity Management specification (SCIM) is a standard designed to manage user identity information. When enabled in Dagster Cloud, SCIM allows you to efficiently and easily manage users in your Identity Provider (IdP) - in this case, Okta - and sync their information to Dagster Cloud.

In this guide, we'll walk you through configuring Okta SCIM provisioning for Dagster Cloud.

About this feature#

Supported features#

With Dagster Cloud's Okta SCIM provisioning feature, you can:

  • Create users. Users that are assigned to the Dagster Cloud application in the IdP will be automatically added to your Dagster Cloud organization.
  • Update user attributes. Updating a user’s name or email address in the IdP will automatically sync the change to your user list in Dagster Cloud.
  • Remove users. Deactivating or unassigning a user from the Dagster Cloud application in the IdP will remove them from the Dagster Cloud organization
  • Push user groups. Groups and their members in the IdP can be pushed to Dagster Cloud as Teams.

Refer to Okta's SCIM documentation for more information about Okta's SCIM offering.

Prerequisites#

To complete the steps in this guide, you'll need:

Step 1: Enable SCIM provisioning in Dagster Cloud#

  1. Sign in to your Dagster Cloud account.
  2. Click the user menu (your icon) > Cloud Settings.
  3. Click the Provisioning tab.
  4. If SCIM provisioning isn't enabled, click the Enable SCIM provisioning button to enable it.
  5. Click Create SCIM token to create an API token. This token will be used to authenticate requests from Okta to Dagster Cloud.

Keep the API token handy - you'll need it in the next step.

Step 2: Enable SCIM provisioning in Okta#

  1. Sign in to your Okta Admin Dashboard.

  2. Using the sidebar, click Applications > Applications.

  3. Click the Dagster Cloud app. Note: If you haven't set up SSO for Okta, follow this guide) to do so before continuing.

  4. Click the Sign On tab and complete the following:

    1. Click Edit.

    2. In the Advanced Sign-on Settings section, enter the name of your organization in the Organization field.

    3. In the Credential Details section, set the Application username format field to Email:

      Configured Sign On tab of Dagster Cloud Okta application

    4. Click Save.

  5. Click the Provisioning tab and complete the following:

    1. Click Configure API Integration.

    2. Check the Enable API integration checkbox that displays.

    3. In the API Token field, paste the Dagster Cloud API token you generated in Step 1:

      Configured Provisioning tab of Dagster Cloud Okta application

    4. Click Test API Credentials to verify that your organization and API token work correctly.

    5. When finished, click Save.

Step 3: Enable user syncing in Okta#

After you confirm that your API credentials work in the Dagster Cloud Okta application, you can enable user syncing:

  1. In the Dagster Cloud Okta app, click the Provisioning tab.

  2. In the Settings panel, click To App.

  3. Click Edit.

  4. Next to Create Users, check the Enable checkbox:

    Highlighted Create users setting and default username setting in Okta

    Note: The default username used to create accounts must be set to Email or user provisioning may not work correctly.

  5. Optionally, check Enable next to Update User Attributes and Deactivate Users to enable these features.

  6. When finished, click Save.

Step 4: Enable group syncing in Okta#

This step is required only if you want to sync Okta user groups to Dagster Cloud as Teams.

When Push groups is enabled in Okta, you can sync user groups from Okta to Dagster Cloud as Teams. Refer to the Okta documentation for setup instructions.

Next steps#

That's it! Once Okta successfully syncs users to Dagster Cloud, synced users will have a 'synced' icon next to them in the Dagster Cloud users page:

Synced/external user icon next to user in Dagster Cloud user list

Refer to the Utilizing SCIM provisioning guide for more info about how user and team management works when SCIM provisioning is enabled.