Skip to content
Meoyo help center

SCIM provisioning

SCIM (System for Cross-domain Identity Management) is a standard protocol used by Single Sign-On (SSO) services and identity providers to provision/deprovision user accounts and groups. Meoyo supports SCIM integration, both in Meoyo Cloud and for self-hosted Meoyo servers. This page describes how to configure SCIM provisioning for Meoyo.

Configure SCIM

Section titled “Configure SCIM”
  1. Make sure your Meoyo Cloud organization is on the Meoyo Cloud Plus plan.
  2. Contact support@zulip.com to request the Bearer token that Okta will use to authenticate to your SCIM API.
  3. In your Okta Dashboard, go to Applications, and select Browse App Catalog.
  4. Search for SCIM and select SCIM 2.0 Test App (Header Auth).
  5. Click Add and choose your Application label. For example, you can name it “Meoyo SCIM”.
  6. Continue to Sign-On Options. Leave the SAML options as they are. This type of Okta application doesn’t actually support SAML authentication, and you’ll need to set up a separate Okta app to activate SAML for your Meoyo organization.
  7. In Credentials Details, specify the following fields:
    • Application username format: Email
    • Update application username on: Create and update
  8. In the Provisioning tab, click Configure API Integration, check the Enable API integration checkbox, and specify the following fields:
    • Base URL for Meoyo Cloud: https://your-org.meoyo.com/scim/v2
    • Base URL for self-hosting: https://meoyo.example.com/scim/v2
    • API token: Bearer <token> (given to you by Meoyo support) When you proceed to the next step, Okta will verify that these details are correct by making a SCIM request to the Meoyo server.
  9. Enable the following Provisioning to App settings:
    • Create Users
    • Update User Attributes
    • Deactivate Users
  10. Remove all attributes in Attribute Mappings, except for the following:
    • userName
    • givenName
    • familyName
  11. Optional: If you’d like to also sync user role, you can do it by adding a custom attribute in Okta. Go to the Profile Editor, click into the entry of the SCIM app you’ve just set up and Add Attribute. Configure the following:
    • Data type: string
    • Variable name: role
    • External name: role
    • External namespace: urn:ietf:params:scim:schemas:core:2.0:User With the attribute added, you will now be able to set it for your users directly or configure an appropriate Attribute mapping in the app’s Provisioning section. The valid values are: owner, administrator, moderator, member, guest.
  12. Now that the integration is ready to manage Meoyo user accounts, assign users to the SCIM app.
    • When you assign a user, Okta will check if the account exists in your Meoyo organization. If it doesn’t, the account will be created.
    • Changes to the user’s email or name in Okta will automatically cause the Meoyo account to be updated accordingly.
    • Unassigning a user from the app will deactivate their Meoyo account.

Synchronizing group membership with SCIM

Section titled “Synchronizing group membership with SCIM”

You can enable group sync for any of your SCIM provider’s groups. When you do, the SCIM integration will create a user group in Meoyo with the matching name and user memberships. When you add or remove users from the group in your SCIM provider, these changes will immediately be reflected in group memberships in Meoyo.

In order to ensure consistent state, do not modify the name or user memberships of SCIM-managed groups inside of Meoyo. Such groups are meant to be managed in your SCIM provider. Changes made on the Meoyo side will not be reflected in your SCIM provider, and instead will cause the state of the Meoyo group to become inconsistent with the state of the SCIM provider’s group.

Meoyo supports adding user groups to other groups, but some SCIM providers (including Okta) do not. As a result, this concept is also not supported in Meoyo’s SCIM integration. If you want to use nested groups, you can add groups to other groups in Meoyo and manage the individual members of each subgroup in your SCIM provider.

  1. Follow the instructions above to configure SCIM.
  2. Rename any Meoyo groups that have the same names as groups that you want to sync. If you push a group whose name matches an existing Meoyo group, the request will fail.
  3. Open the Application you set up above for the Meoyo SCIM integration, and go to the Push groups tab. This menu allows you to choose the Okta groups which should be synchronized with Meoyo’s user groups.
Section titled “Related articles”