Skip to main content

Integrate Okta SCIM Provisioning and Push Groups for Automated User Management

Feature RequestSignage

As an IT Admin, I want the Korbyt platform to support Okta SCIM provisioning and push groups so that user and role management is automated and aligned with enterprise identity governance policies.


Acceptance Criteria:

  • Given the IT Admin has connected their Okta instance to Korbyt, when SCIM provisioning is enabled, then user accounts are automatically created, updated, or deactivated based on Okta directory changes.

  • Given an Okta group is mapped to a Korbyt role, when the group membership changes, then the user's Korbyt role updates accordingly.

  • When a user is removed from all relevant groups or disabled in Okta, their Korbyt access is revoked.

  • Admins can configure group-to-role mappings via the Korbyt admin UI.

  • Korbyt provides audit logs of SCIM sync events and role assignments.

Product Area
Korbyt Signage
Posted by Ross Wilson ·
Status: In Progress1 comment

Log in to comment and vote

Comments1

  • Justin Howell

    •

    Oct 28

    •

    Merged request

    •

    1 vote

    Feature Request: SCIM Provisioning and SSO Group-Based Role Management

    Feature Request: SCIM Provisioning and SSO Group-Based Role Management

    We currently use Okta as our identity provider for Korbyt CMS authentication through SAML 2.0 SSO. While this provides centralized authentication, user provisioning, deprovisioning, and permission management still require additional administration within Korbyt.

    We would like Korbyt to support SCIM 2.0 provisioning and identity-provider-driven group and role management for CMS users.

    Requested Functionality

    1. SCIM 2.0 User Provisioning

    • Automatically create Korbyt CMS accounts when users are assigned the application in Okta.

    • Synchronize user attributes such as name, email, and account status.

    • Automatically deactivate or disable accounts when users are removed from the Okta application or deactivated in Okta.

    • Support reactivation when access is restored.

    2. Group-Based Role and Permission Management

    • Synchronize Okta group memberships with Korbyt CMS.

    • Map Okta groups to Korbyt roles and permission levels.

    • Support group-based access to specific content, folders, players, and other CMS resources where applicable.

    • Automatically update Korbyt permissions when a user's Okta group membership changes.

    • Support multiple group memberships and clearly defined role precedence.

    3. Centralized Access Lifecycle Management

    Ideally, administrators could manage the complete Korbyt user lifecycle through Okta, without needing to manually provision accounts or maintain permissions separately within Korbyt.

    Business Justification

    At the University of Notre Dame, Korbyt supports digital signage across multiple campus departments, each with different administrative responsibilities and access requirements.

    Our IT organization centrally manages identities and access through Okta. Supporting SCIM and group-based role assignments would:

    • Reduce manual user administration and configuration errors.

    • Improve security by ensuring access is promptly revoked when users leave or change roles.

    • Simplify onboarding and offboarding for departmental administrators.

    • Ensure Korbyt permissions remain aligned with centrally managed institutional access policies.

    • Improve auditing and compliance by maintaining Okta as the authoritative source for user access.

    The goal is to extend our existing Okta SSO integration beyond authentication to include automated user lifecycle management and authorization.