Articles in this section

See more

Portal: set up SCIM 2.0 with basic authentication

Elizabeth
  • Updated

Set up an IdP to create and manage accounts

Use SCIM 2.0 protocol with your identity provider (IdP) to create, read, update and deactivate accounts in LearnUpon.

For customers using an identity provider with basic authentication like Okta, SCIM (System for Cross-domain Identity Management) makes managing user identities in LearnUpon easier.

Availability: depends on your LearnUpon plan

SCIM 2.0 overview

The SCIM protocol is an application-level REST protocol for provisioning and managing identity data on the web. The protocol supports creation, discovery, retrieval, and modification of core identity resources.

LearnUpon lets you set up an identity provider, such as Okta, that uses SCIM 2.0 to create, read, update and deactivate accounts from a single source.

Currently, this provisioning works in one direction. You create or update accounts in the identity provider, and SCIM creates or updates the same details for a new account in LearnUpon.

You can't create new accounts in LearnUpon and export them to your identity provider.

Background

LearnUpon is not responsible for content outside this site.

Prerequisites

For SCIM 2.0 your LearnUpon portal requires the following features turned on:

With these features in place, you complete the setup for basic authentication in your identity provider, such as Okta.

Access permissions

  • admins with full portal permissions: can set up this feature

SCIM is available in sub-portals. You set up each portal individually as required.

Add SCIM provisioning

Follow the instructions from your identity provider, such as Okta, for basic authentication. For example, see Add SCIM provisioning to app integrations | Okta.

Note: if your portal uses advanced passwords, you need to set up password synchronization in your identity provider.

See: Set advanced password requirements for the portal

Required LearnUpon details for setup

  • SCIM connector base URL:https://yourportal.learnupon.com/api/v1/scim/
  • Unique identifier field for users: email or userName
  • Supported provisioning actions:
    • Import New Users and Profile Updates
    • Push New Users
    • Push Profile Updates
  • Authentication Mode: Basic Auth, using your LearnUpon API key and password

Parameters available for update through SCIM 2.0

You can update the following parameters through SCIM. When you change them in your identity provider, the changes appear in LearnUpon:

  • first_name
  • last_name
  • display_name
  • username
  • email
  • login_enabled
  • portal_membership_type

Use default mappings first

Most Identity Providers (like Okta or Azure AD) automatically map their internal attributes to LearnUpon’s parameters. For example, Okta usually maps name.givenName to LearnUpon's first_name by default. You only need to manually configure these if your IdP does not provide a default mapping.

Set up attribute mapping from your identity provider to LearnUpon

In your identity provider app, you need to specify what data you want the identity provider to share with LearnUpon, and where “push” it to LearnUpon when creating or changing a user’s profile.

For example, in Okta:

  • userName parameter, for Username field in Okta's user profile, should contain your portal's unique identifier, either email or username
  • userType attribute in Okta needs to map to one of the LearnUpon user types (case sensitive): 
    • admin
    • member (a legacy term for learners)
    • manager
    • instructor

If your organization uses different userTypes, you can map them to one of the LearnUpon user types. For example, your organization can map director to the LearnUpon admin user type. Your identity provider will set up an admin account for every director in your organization.

Create detailed user profiles including custom user data

Beyond provisioning the basic parameters from your identity provider (IdP) by default, you can map custom attributes to LearnUpon’s custom user data fields. 

See Use default mappings first about default mappings.

Mapping custom attributes means you can create and maintain user accounts with custom user data automatically, as soon as you create the account in your IdP.

LearnUpon’s custom user data fields drive its dynamic rules and its learning journeys. Setting up accounts with custom attributes from your IdP mean you can build effective learning workflows, and get your learners started as quickly as possible.

See:

This procedure uses Okta as an example IdP. The same process is possible with other providers like Microsoft Entra ID (previously Microsoft Azure AD).

Prerequisites for custom attributes

To add custom attributes mapping you need:

  • SCIM 2.0 set up as your protocol for sharing identity data between systems
  • default SCIM mapping enabled in your IdP

Access permissions to set up custom attributes

  • admins with full portal permissions: can set up this feature

The admin requires permissions in the IdP to create custom attributes.

Map custom attributes in Okta to custom user data in LearnUpon

Warning: in your IdP, you must set the namespace field to urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.

This entry is the standard SCIM enterprise extension namespace that lets you map and synchronize custom attributes between your identity provider and LearnUpon.

In Okta: create a custom attribute in the Okta profile editor

  1. Within Okta, navigate to Profile Editor.
  2. Select the user profile related to your LearnUpon app.
  3. Select Add Attribute and configure the new attribute with the following required fields:
    • Display name: for example, New Custom Attribute Scim
    • Variable name: for example, newcustomattributescim
    • Namespace: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
    • Attribute type: Personal
  4. Save the attribute.

In Okta: map the attribute to your LearnUpon app

  1. Go to your LearnUpon application in Okta.
  2. Navigate to Provisioning > To App.
  3. Select Show Unmapped Attributes.
  4. Find your custom attribute in the list.
  5. Select your custom attribute > Map from Okta Profile.
  6. Select the Okta profile field to map to this attribute.
  7. Save the mapping.

In Okta: verify your attribute schema

Check your custom attribute schema. Look for the syntax format: namespace:attribute_variable_name. For example: 

urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:newcustomattributescim

In LearnUpon: add SCIM attributes

  1. From main navigation go to Settings > Integrations > SAML SSO.
  2. Select SCIM settings.
  3. From Custom user data mappings, enter the Variable name you set in your IdP for each custom user data field. For this example enter newcustomattributescim.
  4. Save to finish.

See:

 

Related articles