SCIM Setup for Okta

If your organization uses Okta to manage user identify information, Fleetio offers an integration to set up the System for Cross-domain Identity Management, or SCIM. This article covers how to successfully set up SCIM to start managing user lifecycles.

Adding the Integration

In order to set up SCIM, you need to have already set up SAML in Fleetio.

Step 1: Enable SCIM in Fleetio and Okta

To enable SCIM in Fleetio, contact your Customer Success Specialist. You will not be able to see some of the fields necessary for setup until this step is complete.

You also need to enable SCIM in Okta. To do this:

  1. Select your Fleetio application in Okta.
  2. Go to the General tab.
  3. Select Edit in App Settings, then select SCIM from the "Provisioning" options.
  4. Select Save.

Step 2: Fill Out the Integration Connection Details

The next step is to fill out the integration details in Okta.

  1. Go to the Provisioning tab in the Okta application.
  2. Select Integration from the Settings menu, then select Edit.
  3. Fill in the following details:
    • SCIM Connector Base URL - This is found in Fleetio once SCIM has been enabled for your account:
      1. Go to your Account Menu and select Settings.
      2. In the Settings sidebar, click SAML Connectors in the Integrations section.
      3. On the connector, select > Edit. Copy the SCIM Base URL and paste it into Okta.
    • Unique identifier Fields for users - type userName in this field.
  4. Select Save.

Step 3: Set Provisioning Options

  1. Go to the Provisioning tab, then select Edit.
  2. Select the checkboxes for "Create Users," "Update User Attributes," and "Deactivate Users" if they aren't already selected.
  3. Select Save.

Step 4: Add Attributes for Fleetio Admin and Fleetio Role

When setting up a SCIM integration with Okta, Okta will provide base attributes set by default. You can either leave these attributes and mappings or delete the ones your organization does not use for identity information. To set up the integration with Fleetio, two new attributes need to be created.

  1. Go to the Provisioning tab, scroll down to the Attribute Mapping section, and select Go to Profile Editor.
  2. Select Add Attribute.
  3. Fill in the details for the Fleetio Role attribute:
    • Data type - string
    • Display name - Fleetio Role
    • Variable name - role_name
    • External name - role_name
    • External namespace - urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
    • Attribute Length - Greater than 1
  1. Select Save and Add Another.
  2. Fill in the details for the Fleetio Admin attribute:
    • Data type - string
    • Display name - User Type
    • Variable name - user_type
    • External name - user_type
    • Possible Values - [admin, regular]
    • External namespace - urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
  1. Select Save.

At this point, you can start assigning people from your Directory to your Fleetio application.

NOTE: A user's email address must match the domain of the Okta application to be added successfully.

Other Attributes (Optional)

After saving the attribute list, you will be taken back to the Attribute Mapping screen. Here, you will set up what values Okta will send to Fleetio when provisioning a user. Below is a description of what each attribute means in Fleetio and what values are accepted:

All attributes are prefixed with urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:

Attribute
Description
Accepted Values
employee
The user is an employee
true or false
operator
The user is an operator
true or false
technician
The user is a technician
true or false
NOTE: All accepted values are case-sensitive.

Record Set Attributes

All regular users are created using the default record sets on your account. If you would like each user to have a different record set, Fleetio accepts the following attributes:

Attribute Description Accepted Values
vehicles_record_set The Vehicle record set name Record set names are found under your Fleetio account settings
contacts_record_set The Contact record set name Record set names are found under your Fleetio account settings
equipment_record_set The Tools record set name
NOTE: Tools was previously known as Equipment
Record set names are found under your Fleetio account settings
inspection_forms_record_set The Inspection Form record set name Record set names are found under your Fleetio account settings
parts_record_set The Part Location record set name Record set names are found under your Fleetio account settings

Record Sets are an account-level setting that dictates which record collections a user can access. It is an optional attribute to add to your Fleetio application.

Shop Network Attributes (Optional)

  1. Go to the Provisioning tab, scroll down to the Attribute Mapping section, and select Go to Profile Editor.
  2. Select Add Attribute.
  3. Fill in the details for the Fleetio Auto Integrate Roles attribute:
    • Data type - string
    • Display name - Auto Integrate Roles
    • Variable name - auto_integrate_roles
    • External name - auto_integrate_roles
    • External namespace - urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
    • Possible Values - [client_admin, client_user_admin, client_view_ro, client_manual_ro_approval, no_access]
    • If assigning multiple roles to a user, combine them with a string. E.g. client_admin, client_view_ro, client_manual_ro_approval
    • This feature is currently limited to Parent Groups in the account, and does not support Shop Network Hierarchies.
  1. Select Save and Add Another.
  2. Fill in the details for the Fleetio Auto Inegrate max auth limit attribute:
    • Data type - number
    • Display name - Auto Integrate Max Auth Limit
    • Variable name - auto_integrate_max_auth_limit
    • External name - auto_integrate_max_auth_limit
    • External namespace - urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

NOTE: This value must be a number, not a string. 1000 is a valid value, $1,000 and 1,000 are not.

  1. Select Save.

Assigning Users to Fleetio

If the user is being assigned a role, the role must already exist in Fleetio. Be sure to type in the role name exactly as it is found in Fleetio.

If you have added record set mappings, leaving the Record Set field blank will give a user full access to the record set. If you want to assign a user a configured record set, it must already exist in Fleetio. Be sure to type the record set name exactly as it is found in Fleetio.

If the user is assigned as an admin, leave the role field blank and select "true" from the Fleetio Admin drop-down menu.

Adding and Assigning Groups to Fleetio

If your organization uses groups in Fleetio to manage users, you can push group assignments to Fleetio. Create groups in Okta by selecting Directory > Groups. When you're ready to push the group to Fleetio and assign people, follow these steps:

  1. Go to your application in Okta.
  2. Go to the Push Groups tab and select Push Groups > Find groups by name.
  3. Find the group and select Save.
  4. Select the Active status drop-down for the group, then select Push Now.

If the group already exists in Fleetio, Okta will find the match and users will be pushed to the corresponding group. If it's a new group, it will be created in Fleetio. Once the group is matched or created, select the group name in Okta and manage assigned users. Whenever you add or remove people from this group, select Push Now from the status drop-down menu to be sure the changes are reflected in Fleetio.