CamperDocs
Open app

Directory

Okta setup

Okta pushes your workforce into Camper over SCIM: Users become identities, Push Groups become team org units, and the roles attribute elevates dashboard operators. Okta stays the source of truth — people you deactivate or unassign in Okta leave Camper automatically.

Prerequisite — SCIM provisioning requires Okta's Lifecycle Management module. Without it you can still assign the app for SSO later (see SCIM provisioning for what each push does).

1. Get your Camper SCIM endpoint

  1. In Camper, open Settings → Identity Providers.
  2. Copy the Base URL (https://api.…/scim/v2).
  3. Click Generate token and copy the bearer token — it is shown once.

2. Create the SCIM app in Okta

  1. In the Okta Admin console, go to Applications → Browse App Catalog and add SCIM 2.0 Test App (OAuth Bearer Token) — or your existing Camper app once published in the OIN.
  2. On the Provisioning tab, click Configure API Integration and enable it:
    • SCIM connector base URL: the Base URL from step 1
    • OAuth Bearer Token: the token from step 1
    • Unique identifier field for users: userName
  3. Click Test API Credentials — Okta calls GET /Users and should succeed.
  4. Under Provisioning → To App, enable Create Users, Update User Attributes, and Deactivate Users.

3. Scope who syncs

Assign people on the Assignments tab — only assigned users are pushed. Assign groups rather than individuals so joiners/movers/leavers flow through with no per-person work.

4. Push groups (team axis)

On the Push Groups tab, add the Okta groups you want as Camper team units. Each pushed group becomes an org unit under teams.*; membership updates, renames, and deletions all follow from Okta:

  • Rename in Okta → the Camper team unit renames in place (same unit, same memberships, linked resources fan out the new name on the next reconcile).
  • Delete / unpush in Okta → the team unit is archived and managed resources linked to it are archived — nothing is destroyed.

5. Map org placement attributes

Camper places each identity on your hierarchy from profile attributes (default: division, department, subDepartment, team). If your Okta profile uses different attribute names, adjust the Attribute map in Camper's Settings → Mappings, and make sure those attributes are mapped in Okta's Provisioning → To App → Attribute Mappings.

6. Elevate operators (optional)

Add a roles attribute mapping in Okta for the people who should operate the Camper dashboard (values: Admin, Member, Viewer, Owner). Everyone else stays a directory identity with no dashboard access.

Verify

Assign one test user in Okta, then check Camper:

  • People shows the person (placed on the hierarchy if attributes map).
  • Settings → Identity Providers shows Last push received with fresh counts.

Offboarding

Deactivating a user or removing them from an assigned group in Okta suspends the identity in Camper on the next push. If they were an operator, their dashboard membership and any live sessions are revoked immediately — no waiting for the next sign-in.

Gotchas

  • Okta sends group membership changes incrementally (SCIM PATCH). If membership looks stale, use Push Groups → Push Now to force a full push.
  • The bearer token is valid until rotated; rotating it in Camper breaks the Okta integration until you paste the new token into the provisioning config.