> ## Documentation Index
> Fetch the complete documentation index at: https://next.gentrace.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM

> Configure SCIM for automated user provisioning in Gentrace

# SCIM

Gentrace supports SCIM for user provisioning. We support any SCIM provider via a custom configuration, and test for Okta in particular.

<Warning>
  Gentrace only supports SCIM for user provisioning. Group
  provisioning is not supported, as Gentrace does not have a concepts
  of groups yet.
</Warning>

## Setup

Generally, SCIM setup is quite simple.

After setting up SSO, navigate to [security settings](https://gentrace.ai/s/security) and create a SCIM key.

<Frame>
  <img src="https://mintcdn.com/gentrace/9dIPysEl4JbHm2X9/images/scim/scim-gentrace.png?fit=max&auto=format&n=9dIPysEl4JbHm2X9&q=85&s=f27c4c3269d12bc0642d4e6467883e1c" alt="Create SCIM key" width="1179" height="1069" data-path="images/scim/scim-gentrace.png" />
</Frame>

Then, use our SCIM server (base URL: [https://gentrace.ai/api/scim/v2](https://gentrace.ai/api/scim/v2)) and Bearer authentication with the SCIM key to provision users.

## Setup with Okta

<Warning>
  Okta unfortunately does not allow OIDC and SCIM to be configured in the same application. You'll need to create two applications, one for OIDC and one for SCIM.

  Learn more from Okta: [SCIM and OIDC in Okta](https://support.okta.com/help/s/article/configure-scim-for-a-custom-oidc-app?language=en_US)
</Warning>

### Step 1: Create SCIM key

After setting up SSO, navigate to [security settings](https://gentrace.ai/s/security) and create a SCIM key.

### Step 2: Create SAML application in Okta (SAML will not be used)

Create a new SAML application in Okta.

<Frame>
  <img src="https://mintcdn.com/gentrace/9dIPysEl4JbHm2X9/images/scim/scim-okta-start.png?fit=max&auto=format&n=9dIPysEl4JbHm2X9&q=85&s=706ebd530112bb6df419cc444ee866e6" alt="Create Okta application" width="1405" height="815" data-path="images/scim/scim-okta-start.png" />
</Frame>

<Note>
  We won't actually use the SAML settings; this just allows us to get to SCIM setup.

  The only setting that matters here is "Application username"
</Note>

Fill in:

* Single sign-on URL: `https://gentrace.ai` (not used)
* Audience URI: `test` (not used)
* Application username: Email (actually matters)

<Frame>
  <img src="https://mintcdn.com/gentrace/9dIPysEl4JbHm2X9/images/scim/scim-okta-saml.png?fit=max&auto=format&n=9dIPysEl4JbHm2X9&q=85&s=540139305346b3010f2042e9d49b186e" alt="Configure Okta application" width="933" height="743" data-path="images/scim/scim-okta-saml.png" />
</Frame>

Complete creation.

### Step 3: Enable and configure SCIM

In your new Okta app, under "General," press "Edit" and then check the box for "Enable SCIM provisioning." Press "Save."

<Frame>
  <img src="https://mintcdn.com/gentrace/9dIPysEl4JbHm2X9/images/scim/scim-okta-enable.png?fit=max&auto=format&n=9dIPysEl4JbHm2X9&q=85&s=506ad0d53182a2ff1cdaef6484dd6b60" alt="Enable SCIM provisioning" width="1164" height="1097" data-path="images/scim/scim-okta-enable.png" />
</Frame>

Navigate to the new "Provisioning" tab and press "Edit."

Fill out the following:

* SCIM connector base URL: `https://gentrace.ai/api/scim/v2`
* Unique identifier field for user: `userName`
* Supported provisioning actions: Import New Users and Profile Updates, Push New Users, Push Profile Updates
* Authentication Mode: HTTP Header
* Authorization (Bearer): Use the SCIM key from Gentrace

Press "Test Connector Configuration" to validate that the configuration is correct.

Then, press "Save."

<Frame>
  <img src="https://mintcdn.com/gentrace/9dIPysEl4JbHm2X9/images/scim/scim-okta-config.png?fit=max&auto=format&n=9dIPysEl4JbHm2X9&q=85&s=7020323705657154b3c4103dd75734ec" alt="Configure Okta SCIM settings" width="976" height="913" data-path="images/scim/scim-okta-config.png" />
</Frame>

### Step 4: Configure SCIM "To App" settings

Under "To App", press "Edit", and change the following settings.

* Create Users: Enable, and ensure the "default username" is set to "Email."
* Update User Attributes: Enable.
* Deactivate Users: Enable.
* Sync Password: do not enable

<Frame>
  <img src="https://mintcdn.com/gentrace/9dIPysEl4JbHm2X9/images/scim/scim-okta-to-app.png?fit=max&auto=format&n=9dIPysEl4JbHm2X9&q=85&s=2525572ea56b8bc62836c3c67b829ecb" alt="Configure Okta SCIM 'To App' settings" width="1380" height="1012" data-path="images/scim/scim-okta-to-app.png" />
</Frame>

### Step 5: Add users to the app

You may now add and remove users from the application.

If you run into any issues, please get in touch at [support@gentrace.ai](mailto:support@gentrace.ai).