Take User Provisioning to the Next Level with Entitlements

Summary

This workshop extends a React and Express.js Todo application’s SCIM-based user provisioning to include entitlements such as roles, licensing, and permissions for enterprise B2B SaaS use. Starting from completed SCIM workshop code, it adds a /Roles endpoint, database-backed roles, SCIM schemas and resource types, and TypeScript implementations that conform to SCIM responses and user resources. The walkthrough connects the API to an Okta SCIM application, discovers schemas and characteristics, and demonstrates synchronizing existing entitlements and assigning a custom is_tall characteristic to a user. It also discusses multi-tenant designs, where organization-specific roles can be addressed through an API key in the Authorization header, while recommending OAuth for production.

Takeaways

1. 1

   The sample API exposes a SCIM /Roles endpoint and adds roles to SCIM user operations, including creating users, listing users, and updating user roles.

2. 2

   Okta can discover schemas and characteristics from the SCIM API and synchronize custom entitlements such as the is_tall characteristic through the core SCIM User entitlements property.

3. 3

   Multi-tenant implementations can target organization-specific roles using an organization API key in the Authorization header; the workshop recommends OAuth instead for production applications.