1. Kion Success Center
  2. Accessing Kion
  3. Identity Management Systems

Configuring Okta IDMS with SCIM Support

Follow

Last updated

Overview

This guide provides step-by-step instructions to integrate Kion with Okta using SCIM 2.0. SCIM (System for Cross-domain Identity Management) enables Okta to automate the creation, updating, and deactivation of users and groups in Kion.

Supported Features

Feature Supported
Create Users ✅
Update User Attributes ✅
Deactivate Users ✅
Push Groups ✅
Update Group Memberships ✅
Import Users ❌
Import Groups ❌


Note: Provisioning is one-way from Okta → Kion. Importing users or groups from Kion to Okta is not supported.

Prerequisites

  • Your Kion instance URL (e.g., https://<yourcompany.kion.io>)
  • A Kion IDMS administrator account
  • An Okta administrator account
  • Okta should already be configured in Kion as a SAML IDMS. Follow the steps in this article to create this configuration before proceeding.
  • Network Communication from Okta to your Kion instance. For more information on Okta's Public IP Addresses, reference their support article. Okta then maps the corresponding IP ranges for their cells in this article. You may need to edit the Security Group on your Kion User Load Balancer to allow this traffic.

Configuration Steps

Step 1: Enable SCIM and Generate Token in Kion

  1. Log in to Kion as an administrator.
  2. Navigate to Users > Identity Management Systems.
  3. Click on the existing Okta IDMS and browse to the SCIM Key tab.
  4. Click Generate Token.
  5. Copy the token — you'll use it in Okta later under the Provisioning tab.

Step 2: Configure the Okta SCIM Integration

A. Add the SCIM Base URL (General Tab)

  1. In the Okta Admin Console, go to: Applications > Applications > [Your Kion App]
  2. Click on the General tab.
  3. Under App Settings, click Edit.
  4. In the SCIM connector base URL field, enter:
    https://<yourcompany.kion.io>/api/scim
  5. Click Save.

B. Enable API Integration (Provisioning Tab)

  1. Go to the Provisioning tab.
  2. Click Configure API Integration.
  3. Check Enable API Integration.
  4. In the Authorization field, enter your token as provided from the Kion application.
  5. Click Test API Credentials.
  6. Once successful, click Save.

Step 3: Enable SCIM Provisioning Features

Under Provisioning > To App, enable the following:

  • Create Users ✅
  • Update User Attributes ✅
  • Deactivate Users ✅

Click Save after enabling each option.

Step 4: Provision Users

If you are transitioning an existing IDMS with users already present in Kion, you must also provision users with Okta so that existing user objects are associated properly. Otherwise, synchronization of those objects will fail. Follow these steps:

  1. Go to the Assignments.
  2. Select Provision User. You will be prompted to create a job to provision existing users. Select OK.
  3. This job will run in the background. Monitor the status of this job using the View Logs link at the top of the Application page.
    1. You should see a message that shows "Provision sync job started" to indicate that the process has started. If you see a message that just shows "FAILURE", click on that message to reveal the cause.
    2. You will know this process has finished when you see "Provision sync job completed SUCCESS" in the logs.

Supported User Attributes

Okta Attribute Kion Field
userName username (Required)
email email
givenName First Name
familyName Last Name
active Active/Inactive

Note: userName (username) must be unique in Kion and is used as the primary identifier.

Group Provisioning Behavior

  • Groups pushed from Okta are created in Kion.
  • Group membership updates are synced in Kion.
  • Group roles and permissions must be manually configured in Kion.

Limitations

  • ❌ Users and groups cannot be imported from Kion to Okta.
  • ✅ SCIM provisioning is one-way (Okta → Kion).

Troubleshooting

Issue Resolution
401 Unauthorized error Verify the token is correctly formatted. The token field should contain only the token value. Do not prefix with any values such as "Bearer ".
SCIM test fails in Okta
  • Ensure the SCIM base URL is correct and accessible from Okta to Kion.
  • Specifically ensure that you have properly permitted Okta in your Security Groups on your Kion User Load Balancer.
  • Ensure that any Security Groups permitting Okta are attached to your User Load Balance for Kion.
Attributes not syncing Check field mappings and supported attributes.
Service Temporarily Unavailable The remote Kion instance may be stopped and should be started.
Connect to <hostname> [<hostname>/<IP>] failed: Connect timed out
  • Ensure the SCIM base URL is correct and accessible from Okta to Kion.
  • Specifically ensure that you have properly permitted Okta in your Security Groups on your Kion User Load Balancer.
  • Ensure that any Security Groups permitting Okta are attached to your User Load Balance for Kion.
504 error while testing connectivity to Kion from Okta
  • Ensure the SCIM base URL is correct and accessible from Okta to Kion.
  • Specifically ensure that you have properly permitted Okta in your Security Groups on your Kion User Load Balancer.
  • Ensure that any Security Groups permitting Okta are attached to your User Load Balance for Kion.

Additional Resources

Related to