> ## Documentation Index
> Fetch the complete documentation index at: https://docs.portkey.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Set up Okta for SCIM provisioning with Prisma AIRS AI Gateway.

The AI Gateway supports provisioning Users & Groups with Okta SAML Apps.

<Warning>
  Okta does not support SCIM Provisioning with OIDC apps; only SAML apps are supported.
</Warning>

To set up SCIM provisioning between the AI Gateway and Okta, you must first create a SAML App on Okta.

***

### Setting up SCIM Provisioning

1. Navigate to the app settings. Under general settings, enable the SCIM provisioning checkbox.

   <Info>
     The `Provisioning` tab should be visible after enabling SCIM provisioning. Navigate to that page.
   </Info>

2. Obtain the Tenant URL and Secret Token from the AI Gateway Admin Settings page (if SCIM is enabled for your organisation).

   * [AI Gateway Settings Page](https://stratacloudmanager.paloaltonetworks.com/)

3. Fill in the values from Strata Cloud Manager into Okta's provisioning settings and click **`Test Connection`**. If successful, click **`Save`**.
   <Note>
     Ensure you choose the Authentication Mode as `HTTP Header`.
   </Note>

4. Check all the boxes as specified in the image below for full support of SCIM provisioning operations.

5. Once the details are saved, you will see two more options along with integration, namely `To App` and `To Okta`.

   Select `To App` to configure provisioning from Okta to the AI Gateway.

   Enable the following checkboxes:

   * Create Users
   * Update User Attributes
   * Deactivate Users

   After saving the settings, the application header should resemble the following image.

This completes the SCIM provisioning settings between Okta and the AI Gateway.

Whenever you assign a `User` or `Group` to the application, Okta automatically pushes the updates to the AI Gateway.

***

### Organisation role support

The AI Gateway supports the following organisation roles:

* **`owner`**  (Organisation Owner)
* **`admin`**  (Organisation Admin)
* **`member`**  (Organisation Member)

Users assigned any other role will default to the **member** role.

#### Editing Attributes

Okta by default doesn't support role attributes. To support role attributes, you need to edit the attributes in Okta.

1. Navigate to the app settings. Under general settings, click on the `Provisioning` tab.

2. Click on the `Go to Profile Editor` button, found under **Attribute Mappings** section.

3. Click on the `Add Attribute` button.

4. Fill the form with the following details:

5. Click on the `Save` button.

#### Verifying the changes

To verify the changes, you can assign a user to the application with the desired role (e.g., **`owner`**, **`member`**, or **`admin`**) for the organisation.

<Warning>
  Make sure to select only **one** role for a user, if multiple selected user will be assigned to highest qualified role.
</Warning>

***

### Group Provisioning with Okta

The AI Gateway supports RBAC (Role-Based Access Control) for workspaces mapped to groups in Okta. You have two options for mapping groups to workspaces:

**Option 1: Flexible Group Mapping (Recommended)**

Provision groups with any naming convention from Okta, then map them to workspaces and assign roles directly from Management Plane. This eliminates the need for specific naming formats.

1. Push your groups to the AI Gateway from Okta (see steps below)
2. Navigate to **Admin Settings > Authentication Settings > SCIM Provisioning** in the AI Gateway
3. Use the **SCIM Mappings List** section to map groups to workspaces and assign roles

For detailed instructions, see the [SCIM Group Management](/docs/aigw/product/enterprise-offering/org-management/scim/group-management) guide.

<Info>
  This is the recommended approach as it provides flexibility in group naming and easier management of group-to-workspace mappings.
</Info>

**Option 2: Naming Convention (Legacy)**

Alternatively, you can use the following naming convention for automatic mapping:

* **Format:** `ws-{group}-role-{role}`
  * **Role:** One of `admin`, `member`, or `manager`
* A user should belong to only one group per `{group}`.

**Example:**
For a `Sales` workspace:

* `ws-Sales-role-admin`
* `ws-Sales-role-manager`
* `ws-Sales-role-member`

Users assigned to these groups will inherit the corresponding role in the AI Gateway.

**Custom Prefix and Separator Configuration:**

You can configure your own prefix and separator to match your organisation's group naming conventions. Navigate to **Admin Settings > Authentication Settings > SCIM Provisioning** in Management Plane and configure the **Pattern Based SCIM Grouping** section with your preferred prefix and separator.

For example, if you configure:

* **Prefix:** `ws-`
* **Role Separator:** `-role-`

Then your groups should follow: `ws-{group}{role_separator}{admin,manager,member}`

For detailed instructions, see the [SCIM Group Management](/docs/aigw/product/enterprise-offering/org-management/scim/group-management#configuring-group-naming-format-optional) guide.

<Warning>
  Automatic provisioning with Okta works for `Users`, but it does not automatically work for `Groups`.
</Warning>

To support automatic provisioning for groups, you must first push the groups to the App (The AI Gateway). Then, Okta will automatically provision updates.

To push the groups to the AI Gateway, navigate to the `Push Groups` tab. If it is not found, ensure you have followed all the steps correctly and enabled all the fields mentioned in the Provisioning steps.

1. Click on **Push Groups**.

2. Select **Find group by name**.

3. Enter the name of the group, select the group from the list, and click **Save** or **Save & Add Another** to assign a new group.

<Tip>
  You can also use `Find groups by rule` to push multiple groups using a filter.
</Tip>

<Note>
  If there is any discrepancy or issue with group provisioning, you can retry provisioning by clicking the `Push Now` option. This can be found under the `Push Status` column in the groups list.
</Note>

***


## Related topics

- [Bring Your Own Auth](/docs/aigw/product/mcp-gateway/authentication/external-oauth.md)
- [SSO](/docs/aigw/product/enterprise-offering/org-management/sso.md)
- [SCIM Group Management](/docs/aigw/product/enterprise-offering/org-management/scim/group-management.md)
- [Snowflake MCP server](/docs/aigw/integrations/mcp-servers/snowflake-mcp-server.md)
- [Secret References](/docs/aigw/product/enterprise-offering/secret-references.md)