Jira Cloud Users & Groups Provisioning: Okta Sync Guide (SCIM)

Before you begin

• You need admin access to both your Jira Cloud site and your Okta Admin Console.
• Know whether you are syncing Licensed Users or Portal Customers.

Download and Installation

• Log into your Jira instance as admin.
• Under Apps section, click on Explore more apps.
• Search for miniOrange SCIM.
• Click Try it free to begin a new trial of the app.
• After installation, locate the miniOrange Users & Groups Provisioning For Jira app and click to open it.

1: Admin Setup Configuration

Upon installing the miniOrange Users & Groups Provisioning For Jira app, the admin needs to configure the Admin Token and API Key to complete the admin setup and start the provisioning process.

Part A: Configure Atlassian API Token

• Go to Atlassian Account and login with your admin account.
• Create API Token without scope and save at a safe place.

• Go to Admin Setup page inside plugin and edit API Token Configuration (using pencil button)

• Enter your Atlassian admin Email Address, API Token, and expiry date of API Token.

• Click on Save Token.

Part B: Configure Atlassian API Key

• Go to Atlassian Administration
• Select your organization if you have more than one.
• Navigate to Organization settings → API Keys
• Click "Create API Key" and select "API keys without scopes"

• Go to Admin Setup page inside plugin and edit API Key Configuration (using pencil button)
• Enter API Key and click on Save API Key button. 

Once these configurations are fully processed, your core administrative setup is complete and ready for application configuration.

2: Service Provider Configuration (Jira)

After completing the administrative setup, the admin needs to configure the service provider (Jira App) to establish a connection with the identity provider (e.g., Okta).

To configure the service provider, go to the plugin configuration page, click the + Add New App button, and select the desired identity provider from the provider list.

Case 1: Synchronize Licensed Users

• Select Okta as the IDP from the providers list.

• In the Application Configuration section, enter a distinct identifier in the Application Name field (e.g., SCIM App).
• Select Licensed as the user sync type to provision IDP users as licensed users in the Jira directory.
• Keep a note of SCIM Base URL and Bearer Token in a safe place and click Next to head to the provisioning operation section.

In the Provisioning Operations section:

User Operations:

• Enable Import Users toggle to provision users in the Jira directory. Ensure the Import Users toggle is switched ON.
• In the Deactivated User Action dropdown, select the action that should be taken when a user is unassigned or deactivated in Okta.

Group Operations:

• Switch to Group Operations and enable Import Groups.
• Group operations can be performed either with On-the-Fly Group Mapping or Manual Group Mapping.

1. On the Fly Group Mapping:

• Use this tab to automatically create groups from the IdP in Jira Cloud if they don't already exist, and assign users to the corresponding groups.
• You can enable the Apply Regular Expressions on Group Names option to transform group names using Regex patterns before mapping them to Jira groups.
• Use the Filter Incoming Groups section to filter the group names received from the identity provider.

2. Manual Group Mapping:

To map groups from your IdP to Jira's native groups, select this tab. When the sync executes, the users from respective groups of the IdP will be mapped to Jira groups as per configuration.

Keep Existing Groups

This setting controls how a user's Jira group memberships are managed during provisioning and deprovisioning performed by by the Identity Provider (IdP).

Enabled:

• For any new user added to IdP groups, it will be added to Jira groups. But if users are removed from IdP groups, Jira group memberships are preserved in the Jira directory.
• Example: Current Jira groups: jira-software-users, jira-administrators. Groups received from Okta: developers, employees. Resulting Jira groups: jira-software-users, jira-administrators, developers, employees No existing Jira group memberships are removed.

Disabled:

• During provisioning, deprovisioning, or user unassignment, all existing Jira group memberships are removed except those specified in the Exclude Groups list. During provisioning, the user is subsequently assigned only to the groups received from the Identity Provider (IdP).
• Example: Current Jira groups: jira-software-users, jira-administrators, support-team. Groups received from Okta: developers, employees.
  Excluded groups: jira-administrators. Resulting Jira groups after provisioning: jira-administrators, developers, employees.

After provisioning, the groups jira-software-users and support-team are removed because they are not received from the IdP and are not included in the exclusion list.

Exclude Groups: Use the Exclude Groups option to specify Jira groups that should never be removed during provisioning or deprovisioning operations, such as jira-administrators or org-admins. These groups will always be retained regardless of the user's group assignments in the IdP.

Case 2: Synchronize Portal-Only Customers

• Select Okta as the IDP from the providers list.
• In the Application Configuration section, enter a distinct identifier in the Application Name field (e.g.,SCIM APP).
• Select Portal Customers as a user sync type to provision IDP users as Portal customers in the Jira directory.

• Keep note of the Customer Base URL and Bearer Token in a safe place and click Next to head to the provisioning operation section.

In the Provisioning Operations section:

• Enable the Import Customers toggle to provision users in the Jira directory.

• Map the attributes from the IDP that you want to sync so they appear in the customer profile.

• Map Jira portal with Groups available inside IdP.

• Configure available options based on your use case and requirements.
• Click Next, review the configurations, and save.

Review & Submit

• Once satisfied with the setup overview, click the Save Configuration button in the bottom-right corner to save your integration profile.

3: Identity Provider Configuration

Now switch to Okta to configure the connection using the SCIM Base URL (or Customer Base URL) and Bearer Token copied in Step 2.

• Log in to your Okta organization as a user with administrator privileges.
• In the Admin Console, navigate to Applications → Applications and click Browse App Catalog.

• Search for SCIM and select the SCIM 2.0 Test App (Bearer Token) application.

• Click Add Integration and complete the setup with a recognizable application label.

• Once the app is created, go to the Provisioning tab of the application and click Configure API Integration.
• Check Enable API Integration and enter the values copied in Step 2:
• SCIM 2.0 Base URL: the SCIM Base URL (or Customer Base URL) from the app.
• OAuth Bearer Token: the Bearer Token from the app.

• Click Test API Credentials. If the connection is established, a success message will appear. Click Save.

• Under the Provisioning tab, click To App in the left Settings panel, then click Edit. Check the Create Users, Update User Attributes, and Deactivate Users checkboxes and click Save.

• Go to the Assignments tab and assign the users you want to provision to Jira. You can also assign groups; members of assigned groups will be provisioned to Jira.

• To sync group memberships (licensed sync only), go to the Push Groups tab and click Push Groups. Find the group by name (or by rule), select it, and ensure


Push group memberships immediately is enabled to activate group push.

Verification

• The app profile will appear on your main dashboard.
• Trigger On Demand Provision or let the SCIM sync cycle trigger as per schedule.
• In Jira, navigate to User Management and confirm that users and groups from Okta appear in the directory. You can also review sync activity under the Audit Logs tab of the Plugin app.

The miniOrange Users & Groups Provisioning For Jira app is now successfully set up with Okta via SCIM.