Setup SCIM

SCIM (System for Cross-domain Identity Management) keeps Bifrost in sync with Okta in real time - new users are provisioned, deactivated users are suspended, and group memberships are updated without waiting for the next login or background sync.

Complete SSO using OIDC before setting up SCIM. Okta does not support SCIM on a custom OIDC app, so SCIM runs as a separate app alongside your existing OIDC integration.

Step 1: Enable SCIM in Bifrost

Open your Okta provider

In your Bifrost dashboard, go to Governance → User Provisioning and open your configured Okta provider.

Bifrost Okta provider dashboard showing connection details and attribute mappings — The Okta provider dashboard showing your connection details and attribute mappings.

Enable SCIM provisioning

Click the settings icon to open Provider Configuration.Toggle on Enable SCIM Provisioning and click Save & Enable.

Copy the SCIM credentials

After saving, Bifrost shows a Setup Complete dialog with:

SCIM Endpoint URL - the base URL Okta will send provisioning requests to
Provisioning Token - the bearer token Okta uses to authenticate

Copy both values now - you will need them in Step 3.

Bifrost Setup Complete dialog displaying the SCIM Endpoint URL and one-time Provisioning Token — Setup Complete dialog showing the SCIM Endpoint URL and Provisioning Token.

The provisioning token is only shown once. Store it somewhere safe before closing this dialog. You can always rotate it later, but the previous token will immediately become invalid.

Alternative: seed the token declaratively (Helm / config.json)

If you manage Bifrost with Helm or a static config.json (GitOps), you can seed the Provisioning Token yourself instead of generating it in the dashboard.

Generate a token

openssl rand -base64 32 | tr '+/' '-_' | tr -d '='

This produces a URL-safe token in the same format Bifrost mints internally.

Add it to your SCIM config

Helm values.yaml:

bifrost:
  scim:
    enabled: true
    provider: "okta"
    config:
      issuerUrl: "https://your-domain.okta.com/oauth2/default"
      clientId: "..."
      clientSecret: "env.OKTA_CLIENT_SECRET"
      apiToken: "env.OKTA_API_TOKEN"
      provisioningToken: "env.SCIM_PROVISIONING_TOKEN"   # or the literal token
      claimScimAttributes:                                # per-claim SCIM interpretation
        groups:
          attributeType: "group"        # "user" (SCIM User attribute) or "group" (match SCIM Group)
          attributeValue: "displayName"
      claimsSyncMode: "both"                                # provisioning source: "both" (SCIM + login claims) or "scim" (SCIM only - ignore login claims)

The same keys (provisioningToken, claimScimAttributes, claimsSyncMode) apply directly under scim_config.config in a raw config.json.

Keep the token in a Kubernetes Secret and reference it with the env. prefix - never commit the literal value. Rotating the token in the dashboard invalidates any value seeded here.

Then use this token as the API Token and your deployment’s SCIM endpoint as the SCIM 2.0 Base URL in Step 3 - the rest of the Okta setup is identical.

Provisioning source

The provider configuration includes a Provisioning source setting that controls whether IdP login claims still provision users, or whether SCIM is the sole source of truth:

Option	Config value	Behavior
SCIM and login claims (default)	`both`	Both SCIM and IdP login / token-refresh claims create and update users, roles, teams, and business units.
SCIM only - ignore login claims	`scim`	SCIM is the sole source of truth. OIDC claims will be ignored and will never create or update users from claims - new users must be pushed by SCIM. At login, a user is admitted only if what SCIM last pushed for them resolves to a role, even if they already hold one; anyone SCIM hasn’t pushed yet is denied.

Choose SCIM only when provisioning must be fully controlled by your IdP’s SCIM app and login-time claim changes should never alter membership. Leave it on the default SCIM and login claims if users are also provisioned just-in-time on first login. This maps to the claimsSyncMode config key (both or scim) and is inert when SCIM Provisioning is disabled - claims always sync then.

Step 2: Create a SCIM App in Okta

Browse the App Catalog

In the Okta Admin Console, go to Applications → Applications and click Browse App Catalog.

Okta Applications page with Browse App Catalog button highlighted — Click Browse App Catalog from the Applications page.

Add the SCIM 2.0 Test App

Search for SCIM 2.0 Test App (Header Auth) and add it.

Okta App Catalog search results with SCIM 2.0 Test App (Header Auth) highlighted — Select SCIM 2.0 Test App (Header Auth) from the catalog.

Name the app Bifrost SCIM (or any label you prefer). On the sign-on options screen, skip everything and click Done - this app is used for SCIM provisioning only, not authentication.

Step 3: Configure the SCIM App

Connect the app to Bifrost

Open the Bifrost SCIM app and go to the Provisioning tab.Click Configure API Integration, check Enable API Integration, and enter:

SCIM 2.0 Base URL: the SCIM Endpoint URL from Step 1
API Token: the Provisioning Token from Step 1

Click Test API Credentials to verify the connection, then Save.

Okta SCIM app Configure API Integration dialog with Base URL and API Token fields filled in — Enter the SCIM Endpoint URL and Provisioning Token from Bifrost to connect the app.

Enable provisioning actions

Still under the Provisioning tab, go to To App and enable:

Create Users
Update User Attributes
Deactivate Users

Click Save.

Okta Provisioning To App section with Create Users, Update User Attributes, and Deactivate Users enabled — Provisioning → To App - enable Create Users, Update User Attributes, and Deactivate Users.

Add custom attributes (optional)

Skip this step if you only need to sync standard user fields (name, email, groups).

Syncing custom profile attributes (e.g. employeeId, costCenter, division)

Custom attributes need to be declared in the SCIM app schema before Okta can include them in provisioning payloads.Go to Directory → Profile Editor and select the Bifrost SCIM app profile. Click Add Attribute.

Profile Editor for the Bifrost SCIM app - click Add Attribute to declare a new custom field.

Configure the attribute - for example, for Employee ID:

Field	Value
Display name	`Employee ID`
Variable name	`employeeID`
External name	`employeeID`
External namespace	`urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`

Add Attribute dialog with Display name Employee ID, Variable name employeeID, and External name employeeID filled in — Add Attribute dialog - the External name is what Bifrost receives and must match exactly what you configure in Bifrost's SCIM attribute settings.

Click Save, then click Mappings on the Bifrost SCIM profile.

Click Mappings on the Bifrost SCIM profile to open the attribute mapping view.

Select the Okta User → Bifrost SCIM tab.

Okta User to Bifrost SCIM mapping direction tab showing attribute mapping fields — Okta User to Bifrost SCIM mapping direction - map each Okta profile field to the corresponding SCIM attribute.

Scroll to find your attribute and set its source from the Okta user profile - e.g. user.employeeNumber → employeeID. Click Save Mappings.

Attribute mapping row showing user.employeeID mapped to the employeeID SCIM attribute — Mapping user.employeeID from the Okta user profile to the employeeID SCIM attribute.

Back in Bifrost, go to Attribute Mapping in the provider setup and add a SCIM Attribute entry for employeeID. The External name you set in Okta must match this exactly.

Bifrost Attribute Mapping step showing SCIM Attributes section with employeeID custom attribute entry — In Bifrost's Attribute Mapping step, add the custom SCIM attribute using the same External name configured in Okta.

The External name in Okta’s Profile Editor and the SCIM attribute name in Bifrost must match exactly - including case.

Step 4: Assign Users and Push Groups

Assign users

Go to the Assignments tab in the Bifrost SCIM app.Click Assign → Assign to People or Assign to Groups and select the users or groups to sync with Bifrost.

Bifrost SCIM app Assignments tab with Assign dropdown showing Assign to People and Assign to Groups options — Assign users or groups from the Assignments tab - users are pushed to Bifrost immediately on assignment.

Assigned users are pushed to Bifrost immediately. When a user is unassigned or deactivated in Okta, Bifrost deactivates them in real time.

Push groups (for team and BU mapping)

If you use group membership to drive Bifrost team or business unit assignments, you need to push the groups themselves - not just the users in them.Go to the Push Groups tab in the Bifrost SCIM app and click Push Groups.You can push groups by name (search for specific groups) or by rule (create a filter that automatically pushes any matching groups - useful if your groups follow a naming convention like Bifrost-*).

Push Groups tab showing Find groups by name and Find groups by rule options — Push Groups tab - choose to find groups by name or create a rule to push all matching groups automatically.

Push Groups by rule dialog with Rule name Bifrost Groups and Group name filter starting with Bifrost — Push by rule - set a filter (e.g. Group name starts with 'Bifrost') to automatically push all matching groups.

Once groups are pushed and showing as Active, Bifrost tracks their membership in real time.

Push Groups list showing Bifrost-Admin and Bifrost-Viewer groups with Active push status — Pushed groups showing as Active - Bifrost now tracks membership changes for these groups in real time.

In Bifrost, configure Attribute-to-Team or Attribute-to-Business Unit mappings using the group displayName as the match value to automatically assign users to teams or business units based on their group membership.

Step 5: Verify in Bifrost

Once assignments and group pushes are active, confirm everything is syncing correctly.

Go to Governance → Users to see provisioned users and their assigned roles
Go to Governance → Teams to see teams populated from pushed groups
Go to Governance → Business Units to see business units resolved from group or attribute mappings

Changes in Okta - new assignments, group membership updates, deactivations - will reflect in Bifrost in real time.

How Sync Works

Real-time push - Okta pushes user and group changes to Bifrost immediately when they occur. No background reconciliation while SCIM Provisioning is on - even if you configured an API token in SSO using OIDC Step 4, Bifrost’s scheduled directory sync is turned off while SCIM Provisioning is enabled. Make sure Okta pushes every change, including deactivations.

Troubleshooting

Test API Credentials fails - verify the SCIM Base URL has no trailing slash and the API token matches exactly what Bifrost generated. Rotate the token in Bifrost and update Okta if needed. Users are pushed but have no role - SCIM provisions the user record; role assignment comes from attribute mappings in the OIDC provider. Confirm your Attribute-to-Role mappings are set and the relevant claims are present in the JWT. Custom attribute is not arriving in Bifrost - confirm the External name in Okta’s Profile Editor matches the SCIM attribute name in Bifrost exactly (case-sensitive). Also verify the Okta User → Bifrost SCIM mapping direction is saved. Group membership is not syncing - ensure groups are added under Push Groups, not just Assignments. Assignments sync users; Push Groups syncs group membership.

Runbooks

CLI Agents & Editors

SDKs & Frameworks

Identity Providers (SSO)

Content Safety (Guardrails)

Observability

Vector Databases

Step 1: Enable SCIM in Bifrost

Alternative: seed the token declaratively (Helm / config.json)

Provisioning source

Step 2: Create a SCIM App in Okta

Step 3: Configure the SCIM App

Step 4: Assign Users and Push Groups

Step 5: Verify in Bifrost

How Sync Works

Troubleshooting

​Step 1: Enable SCIM in Bifrost

​Alternative: seed the token declaratively (Helm / config.json)

​Provisioning source

​Step 2: Create a SCIM App in Okta

​Step 3: Configure the SCIM App

​Step 4: Assign Users and Push Groups

​Step 5: Verify in Bifrost

​How Sync Works

​Troubleshooting

Step 1: Enable SCIM in Bifrost

Alternative: seed the token declaratively (Helm / config.json)

Provisioning source

Step 2: Create a SCIM App in Okta

Step 3: Configure the SCIM App

Step 4: Assign Users and Push Groups

Step 5: Verify in Bifrost

How Sync Works

Troubleshooting