Okta Integration: User Provisioning Setup

With the Okta user provisioning integration, you can facilitate and automate the import of your users into Forecast, without having to manually add users when they join your business. By enabling user provisioning, you will only have to manage users only from your Okta directory, ensuring security, data accuracy, and compliance across your organization.

This article includes:

• Adding Forecast to your Okta applications
• Configuring provisioning to Forecast in Okta

Adding Forecast to your Okta apps

Before you may begin configuring provisioning to Forecast in Okta, it is necessary to add Forecast as an application in Okta. This whole process may only be done by admins in both Forecast and Okta.

To add Forecast as an application in Okta.

1. Head to Okta and click on the Admin button.
2. On the user single sign-on section click on Add App.
   
3. Search for Forecast in the application catalog, and click on it.
   
4. Click on Add Integration.
5. (Optional) Select whether you would like to display the Forecast application icon in Okta to other users.
   
6. Click Next.
7. In the Sign-On Options screen, set the Application username format to Email.
   
   
8. Click Done.

Configuring provisioning to Forecast in Okta

To add the provisioning feature of the Forecast application, navigate to the Applications section in Okta and click the Add Application button. Once that is done follow the steps provided below to configure provisioning. Before proceeding with configuring provisioning it is important to know what provisioning features the integration supports:

• Push New Users - New users created through OKTA will also be created in Forecast
• Push Profile Updates - Updates made to the user's profile through OKTA will be pushed to Forecast
• Push User Deactivation/reactivation - Deactivating the user or disabling the user's access to the application through OKTA will deactivate the user in Forecast
• Import New Users - New users created in Forecast will be downloaded and turned into new AppUser objects, for matching against existing OKTA users

To configure provisioning to Forecast in Okta

1. Find your SCIM username and password from the admin panel.
   1. Click on Admin in the top bar. 
   2. Select Integrations from the dropdown.
   3. Scroll to the SSO integrations and click on Okta. The SCIM username and password will be displayed there.
2. Head to Okta's application page and select Forecast
3. Click on the Provisioning tab.
4. Click on the Configure API Integration.
5. Scroll down to select the Provisioning Features you want to enable.
   
6. Click the "Enable API integration" and fill in the Username and Password received from Step 1.
7. Click the "Test API Credentials" to enable provisioning. A confirmation message will be displayed once completed.
   

Custom permission profiles provisioning

For custom permission users, when a user is provisioned, Forecast searches for a “Permission Profile” with the same name as the user type sent from the single-sign-on platform. This check is just comparing names case insensitive. If it doesn’t find a match, it will default to the profile called ‘Collaborator’. If that doesn’t exist either, the provisioning of the user will fail.