Configuring SCIM for Automated User Provisioning in Fullstory

This article provides guidance for configuring System for Cross-domain Identity Management (SCIM) for your Fullstory account. SCIM, when used in conjunction with Single Sign-On (SSO), allows you to automate the provisioning and deprovisioning of user accounts in Fullstory directly from your Identity Provider (IdP). This streamlines user management and enhances security.

Enabling SCIM in Fullstory

Admin users can configure SCIM in Fullstory.

1. Within Fullstory, go to Settings > Account Management > SSO.
2. Under Account Provisioning, select SCIM Provisioning from the dropdown menu.
   
   
   Note: If you don't see Account Provisioning, ensure that SAML SSO is already configured for your Fullstory organization. See How do I configure SSO? for more information.
3. Fullstory will display information that you will need to enter into your IdP later, including the following:
   • SCIM connector base URL
   • Unique identifier for users
   • Authentication mode
   • Authorization token
4. Click Generate Authorization Token. Keep this information secure as it will be used to authorize the connection from your IdP.

Setting up the SCIM connection in Okta

The following steps provide an example of how to configure SCIM with Okta. The specific steps may vary depending on your IdP.

1. From your Okta Admin console, navigate to Applications > Applications.
2. Select the Okta Application that you have configured for Fullstory SSO.
3. For the selected Okta Application, click on the General tab and then click Edit.
4. Under Provisioning, select SCIM and click Save. This will add a Provisioning tab to your Fullstory Okta application.
5. Click on the new Provisioning tab.
6. Under Integration, click Edit.
7. Using the information obtained from Fullstory in the previous section, fill out the following details:
   • SCIM connector base URL
   • Unique identifier field for users
   • Supported provisioning actions
   • Authentication Mode
   • Authorization token
8. Click Test Connector Configuration.
9. If the test is successful, click Save.

Mapping User Roles via SCIM Attributes (Recommended)

To automatically assign Fullstory roles to users based on their group memberships in Okta, follow these steps:

1. In Okta, navigate to Directory > Profile Editor.
2. Select your Fullstory Okta Application and click + Add Attribute.
3. Fill out the attribute details with the following information:

4. Add the following Attribute Members with their corresponding Value:

5. Ensure Attribute Type is set to Group.
6. Click Save.
7. In Okta, navigate back to your Fullstory Okta application and click on the Assignments tab.
8. Add the groups you want to map to Fullstory roles.
9. Click the pencil icon to open the Edit Group Assignment screen, you should now see the Fullstory Role attribute.
10. Select the desired Fullstory role from the dropdown that you want to assign to members of this Okta group.
11. Click Save and repeat this for all relevant Okta groups.

Enabling SCIM Functionality in the Fullstory Okta App

1. From the Okta Application, navigate to Provisioning > To App and click Edit.
2. Select the provisioning features you want Okta to manage. It is recommended to enable Create Users, Update User Attributes, and Deactivate Users.
3. Click Save.

Converting Existing Users to SCIM Users (If Applicable)

If you already have users assigned to the Fullstory Okta application before configuring SCIM, you may need to manually provision them via SCIM:

1. In the Okta Application, navigate to the Assignments tab.
2. Click Provision User and follow the prompts to ensure existing users are managed through SCIM. You will only need to do this if you had users assigned before enabling SCIM.

By following these steps, you can successfully configure SCIM for your Fullstory organization, enabling automated user provisioning and deprovisioning through your Identity Provider. This will streamline your user management processes and enhance the security of your Fullstory account. Remember to consult the documentation for your specific Identity Provider for any variations in the configuration steps.