Okta

Skyramp Testbot is available in the Okta Integration Network (OIN). Okta Express Configuration sets up single sign-on (SSO) and SCIM provisioning for your Skyramp organization in a few clicks. You do not need to copy any values between Okta and Skyramp.

Supported Features

Single sign-on (OIDC): sign in from the Okta dashboard (IdP-initiated) or from Skyramp (SP-initiated).
Just-in-time provisioning: a person assigned in Okta joins your Skyramp organization at their first sign-in.
SCIM provisioning: create users, update user attributes and deactivate users.
Role mapping: set each person's Skyramp role from Okta (optional).

NOTE: Group push and password sync are not supported.

Prerequisites

Ensure you have the following before you start:

An Okta admin account that can add apps (Super Admin, or App Admin).
A Skyramp organization, and an account with the Admin role in it.
Access to your DNS settings, to verify your email domain.

Configure SSO

Add Skyramp Testbot from the Okta catalog, then run Express Configuration for SSO.

In the Okta Admin Console, go to Applications > Applications and click Browse App Catalog.
Search for Skyramp Testbot, then click Add Integration. Enter a label and click Done.
On the Sign On tab, click Express Configure SSO.
Sign in to Skyramp with your Skyramp Admin account. If you belong to more than one Skyramp organization, select the one to connect.
Review the permissions and click Accept.

Okta confirms that SSO is configured.

Configure Provisioning

On the Provisioning tab, click Express Configure SCIM.
Sign in to Skyramp with the same Admin account and click Accept.
Under To App, ensure Create Users, Update User Attributes and Deactivate Users are enabled.

Verify Your Email Domain

Skyramp adds a person to your organization only when their email address is on a verified domain. Verify each domain once.

In Skyramp, open Settings > Enterprise sign-in as an Admin.
Open the domain verification link and add your domain, for example example.com.
Add the DNS TXT record it shows, then click Verify.
Open Settings > Enterprise sign-in again. Your domain shows as Verified.

NOTE: People whose email address is on another domain do not join your Skyramp organization.

Role Mapping

By default, people join with your organization's default role. To set each person's role from Okta instead, add a Skyramp role attribute. Skyramp then shows the role as locked.

In the Okta Admin Console, go to Directory > Profile Editor and open the Skyramp Testbot app profile.
Click Add Attribute and enter these values:

Field	Value
Display name	Skyramp role
External name	`roles.^[primary==true].value`
External namespace	`urn:ietf:params:scim:schemas:core:2.0:User`

When you assign a person, set Skyramp role to admin, editor, viewer or no_access.

NOTE: Role mapping is optional. A person with no value, or an unknown value, joins as a viewer.

Assign People and Sign In

On the app's Assignments tab, assign people or groups. Each person appears in Skyramp under Settings > People within a minute.

People can sign in two ways:

From Okta: click the Skyramp Testbot tile on the Okta dashboard.
From Skyramp: open https://testbot-staging.skyramp.dev, click Continue with SSO and enter a work email address.

When you unassign or deactivate a person in Okta, Skyramp removes them from your organization.

Troubleshooting

Problem	Solution
A person is assigned in Okta but does not appear in Skyramp	Verify the domain of their email address. See Verify Your Email Domain.
"We could not find single sign-on for your domain"	Open Settings > Enterprise sign-in in Skyramp once after you verify the domain.
A person signs in but has no role	Ensure their email address is on a verified domain, and check the spelling of the Skyramp role value.
Okta asks for Okta Verify at sign-in	Your Okta authentication policy requires a second factor. Change the app's policy if this is not intended.

For more help, contact support@skyramp.dev

References