ENTERPRISE

Integrating SCIM using Okta

• Last updated: July 3, 2023

• Read time: 4 Minutes

In this section, we'll guide you through the process of integrating SCIM with Burp Suite Enterprise Edition using Okta as your identity provider (IdP).

Prerequisites

• Your users and groups are set up in Okta.

• You have already created a custom app integration for Burp Suite Enterprise Edition in Okta and completed the SAML configuration.

If you want to integrate SCIM without setting up SAML, use Okta's pre-built SCIM 2.0 Test App (Header Auth) app integration from the app catalog instead. Note that in this case, some of the steps described here may vary.

Integrating SCIM using Okta involves the following steps:

• Set a port for the SCIM URL and generate an API token.
• Upload a TLS certificate.
• Configure the connection in Okta.
• Push your Okta users and groups to Burp Suite Enterprise Edition.

Set a port for the SCIM URL and generate an API token

You need to set a dedicated port for the SCIM URL that Okta uses to communicate with Burp Suite Enterprise Edition. The base URL takes the following format:

The host is usually the same domain name or IP address as in the Burp Suite Enterprise Edition web server URL. However, this may differ depending on your network infrastructure.

1. Log in to Burp Suite Enterprise Edition as an administrator.
2. From the settings menu , select Integrations.
3. On the SCIM tile, click Configure.
4. Under Configure SCIM, enter the port that you want to use for the SCIM URL. To enable you to configure separate firewall rules for this connection, use a different port than the web server URL.
5. Click Save & generate API token.
6. When prompted, copy and save the new API token somewhere secure.

Upload a TLS certificate

Okta only supports SCIM over HTTPS. This means that you need to enable TLS by uploading a PKCS#12 certificate. Make sure that the certificate has the .p12 file extension. Certificates in .psx format are not supported.

To upload a TLS certificate:

1. In Burp Suite Enterprise Edition, navigate to the SCIM integration settings.
2. In Configure SCIM, activate Use TLS.
3. Click Upload certificate.
4. When prompted, click Choose file and select the certificate.
5. Enter the certificate password.
6. Click Save.

Configure the connection in Okta

Once you've set a SCIM URL and generated an API token in Burp Suite Enterprise Edition, configure the connection from Okta as follows:

Enable SCIM provisioning

1. Log in to Okta.
2. Go to Applications and select the app integration that you created for Burp Suite Enterprise Edition.
3. Go to the General tab.
4. In the App Settings section, click Edit.
5. Under Provisioning, select the Enable SCIM provisioning checkbox.
6. Save your changes.

Enter the connection details

1. In Okta, select the app integration that you created for Burp Suite Enterprise Edition.
2. Go to the Provisioning tab.
3. From the Settings menu on the left, select Integration.
4. In the SCIM Connection panel, click Edit.

5. In the SCIM connector base URL field, enter your SCIM URL in the following format:

   https://<host>:<port>/scim/v2

   Note

   The host is usually the same domain name or IP address as in the Burp Suite Enterprise Edition web server URL, but this may differ depending on your network infrastructure. The port is the one that you configured manually in the Burp Suite Enterprise Edition SCIM settings.

6. In the Unique identifier field for users field, enter userName.

7. Under Supported provisioning actions, select only the following options:

   • Push New Users.
   • Push Profile Updates.
   • Push Groups.
8. Under Authentication mode, select HTTP header.
9. In the Authorization field, enter the API token that you copied from Burp Suite Enterprise Edition.
10. To confirm that the connection is working correctly, click Test Connector Configuration.
11. Save your changes.

Configure the provisioning to app settings

1. In Okta, select the app integration that you created for Burp Suite Enterprise Edition.
2. Go to the Provisioning tab.
3. From the Settings menu on the left, select To App.
4. In the Provisioning To App section, click Edit.

5. Use the checkboxes to enable the following settings:

   • Create Users.
   • Update User Attributes.
   • Deactivate Users.

   If you're not using SAML, enable and configure the Sync Password setting.

6. Save your changes.

Push your Okta users and groups to Burp Suite Enterprise Edition

To push your users and groups to Burp Suite Enterprise Edition, do the following steps.

To push users:

1. In Okta, select the app integration that you created for Burp Suite Enterprise Edition.
2. Go to the Assignments tab.

3. Decide how to assign your users:

   • To assign individual users, click Assign > Assign to People.
   • To assign all users from a particular group to the application, click Assign > Assign to Groups.

To push groups:

1. In Okta, select the app integration that you created for Burp Suite Enterprise Edition.
2. Go to the Push Groups tab.
3. Click Push Groups > Find Group By Name and select the relevant group.

You may need to wait a short while for the users or groups to become available in Burp Suite Enterprise Edition. Any changes you make in Okta sync automatically. Note that users do not have access to any functionality unless you assign them to a group with the relevant roles in Burp Suite Enterprise Edition.