This article describes how to integrate Okta with RSA Cloud Access Service (CAS) using SCIM.

Configure CAS as a SCIM Server

Perform these steps to configure CAS as a SCIM server. 
Procedure

1. Sign in to the RSA Cloud Administration Console and click Users > Identity Sources > Add Identity Source.
2. On the New Identity Source page, choose SCIM Managed.
   1. Specify the Identity Source Name.
   2. Enable SCIM connection user provisioning from a SCIM source.
   3. Copy the SCIM Service Provider Base URL.
      
3. In the Authentication section, select API Key.
4. Copy the SCIM Service API key. This is used in Okta configuration.
5. Choose No Password Available to CAS for authentication. 
   
6. Save the configuration and click Publish Changes.
   After publishing, your application is now enabled for SCIM. 

Configure Okta as a SCIM Client

Perform these steps to configure Okta as a SCIM client. 
Procedure

1. Log in to the Okta admin web interface with the OKTA default admin user or any other admin https://IP-address.okta.com/oauth2/.
2. Click Applications > Create App Integration Server Profiles > SAML Identity Provider.
   
3. Under Applications, click Create App Integration.
4. Choose SWA - Secure Web Authentication and click Next.
   

In the Okta configuration, there are two available options: SAML 2.0 and SWA (Secure Web Authentication).

• If you choose SAML 2.0, follow the configuration steps outlined in the Okta - RSA Ready Implementation Guide.
• If you choose SWA (Secure Web Authentication), perform the following steps.

1. Specify the App name as mentioned in the following image.
   
2. Navigate to General > App Settings > Provisioning, and choose SCIM.
   
3. Navigate to the Provisioning tab > the Integration section, and specify the SCIM connection details.
   1. SCIM connector base URL copied from CAS.
   2. Unique identifier field for users: userName
   3. Supported provisioning actions: select the following checkboxes
      1. Import New Users and Profile Updates
      2. Push New Users
      3. Push Profile Updates
   4. Authentication Mode: Select HTTP Header
   5. HTTP Header Authorization: Copy the Bearer token from CAS. Test connector configuration should be successful.
      
      
      
4. Verify the password configuration. Navigate to Security > Authenticators, select Actions > Edit for the Password authenticator, and ensure the password settings are configured according to the requirements listed in the following images. 
   
   

The configuration is complete.