Skip to main content
The AI Gateway supports provisioning Users & Groups with Okta SAML Apps.
Okta does not support SCIM Provisioning with OIDC apps; only SAML apps are supported.
To set up SCIM provisioning between the AI Gateway and Okta, you must first create a SAML App on Okta.

​
Setting up SCIM Provisioning

  1. Navigate to the app settings. Under general settings, enable the SCIM provisioning checkbox.
    The Provisioning tab should be visible after enabling SCIM provisioning. Navigate to that page.
  2. Obtain the Tenant URL and Secret Token from the AI Gateway Admin Settings page (if SCIM is enabled for your organisation).
  3. Fill in the values from Strata Cloud Manager into Okta’s provisioning settings and click Test Connection. If successful, click Save.
    Ensure you choose the Authentication Mode as HTTP Header.
  4. Check all the boxes as specified in the image below for full support of SCIM provisioning operations.
  5. Once the details are saved, you will see two more options along with integration, namely To App and To Okta. Select To App to configure provisioning from Okta to the AI Gateway. Enable the following checkboxes:
    • Create Users
    • Update User Attributes
    • Deactivate Users
    After saving the settings, the application header should resemble the following image.
This completes the SCIM provisioning settings between Okta and the AI Gateway. Whenever you assign a User or Group to the application, Okta automatically pushes the updates to the AI Gateway.

​
Organisation role support

The AI Gateway supports the following organisation roles:
  • owner (Organisation Owner)
  • admin (Organisation Admin)
  • member (Organisation Member)
Users assigned any other role will default to the member role.

​
Editing Attributes

Okta by default doesn’t support role attributes. To support role attributes, you need to edit the attributes in Okta.
  1. Navigate to the app settings. Under general settings, click on the Provisioning tab.
  2. Click on the Go to Profile Editor button, found under Attribute Mappings section.
  3. Click on the Add Attribute button.
  4. Fill the form with the following details:
  5. Click on the Save button.

​
Verifying the changes

To verify the changes, you can assign a user to the application with the desired role (e.g., owner, member, or admin) for the organisation.
Make sure to select only one role for a user, if multiple selected user will be assigned to highest qualified role.

​
Group Provisioning with Okta

The AI Gateway supports RBAC (Role-Based Access Control) for workspaces mapped to groups in Okta. You have two options for mapping groups to workspaces: Option 1: Flexible Group Mapping (Recommended) Provision groups with any naming convention from Okta, then map them to workspaces and assign roles directly from Management Plane. This eliminates the need for specific naming formats.
  1. Push your groups to the AI Gateway from Okta (see steps below)
  2. Navigate to Admin Settings > Authentication Settings > SCIM Provisioning in the AI Gateway
  3. Use the SCIM Mappings List section to map groups to workspaces and assign roles
For detailed instructions, see the SCIM Group Management guide.
This is the recommended approach as it provides flexibility in group naming and easier management of group-to-workspace mappings.
Option 2: Naming Convention (Legacy) Alternatively, you can use the following naming convention for automatic mapping:
  • Format: ws-{group}-role-{role}
    • Role: One of admin, member, or manager
  • A user should belong to only one group per {group}.
Example: For a Sales workspace:
  • ws-Sales-role-admin
  • ws-Sales-role-manager
  • ws-Sales-role-member
Users assigned to these groups will inherit the corresponding role in the AI Gateway. Custom Prefix and Separator Configuration: You can configure your own prefix and separator to match your organisation’s group naming conventions. Navigate to Admin Settings > Authentication Settings > SCIM Provisioning in Management Plane and configure the Pattern Based SCIM Grouping section with your preferred prefix and separator. For example, if you configure:
  • Prefix: ws-
  • Role Separator: -role-
Then your groups should follow: ws-{group}{role_separator}{admin,manager,member} For detailed instructions, see the SCIM Group Management guide.
Automatic provisioning with Okta works for Users, but it does not automatically work for Groups.
To support automatic provisioning for groups, you must first push the groups to the App (The AI Gateway). Then, Okta will automatically provision updates. To push the groups to the AI Gateway, navigate to the Push Groups tab. If it is not found, ensure you have followed all the steps correctly and enabled all the fields mentioned in the Provisioning steps.
  1. Click on Push Groups.
  2. Select Find group by name.
  3. Enter the name of the group, select the group from the list, and click Save or Save & Add Another to assign a new group.
You can also use Find groups by rule to push multiple groups using a filter.
If there is any discrepancy or issue with group provisioning, you can retry provisioning by clicking the Push Now option. This can be found under the Push Status column in the groups list.
Last modified on September 15, 2026