CamperCamperDocs
Open app

Directory

Okta setup

Okta pushes your workforce into Camper over SCIM: Users become identities, Push Groups become team org units, and the roles attribute elevates dashboard operators. Okta stays the source of truth — people you deactivate or unassign leave Camper on the next push.

Camper does not support Okta Import Users or Import Groups. Camper is the SCIM server: Okta pushes Users and Groups into Camper (To App and Push Groups). Camper is not an Okta import source.

Sign-in is a separate OIDC app registration — Enterprise SSO → Configuration Steps in Okta.

Prerequisites

  • Owner or admin in Camper
  • Okta Lifecycle Management for SCIM User/Group push (without it you can still prepare for SSO; full directory push needs LCM)
  • Permission to create apps and configure provisioning in Okta

Summary of steps

  1. Copy SCIM Base URL and token from Camper
  2. Create / configure the SCIM app in Okta
  3. Assign users and push groups
  4. Map department (and optional custom attributes)
  5. Optionally map roles for operators
  6. Verify in Camper

1. Get your Camper SCIM endpoint

  1. In Camper, open Settings → Identity Providers.
  2. Copy the Base URL (https://api.…/scim/v2).
  3. Click Generate token and copy the bearer token — shown once.

Configuration Steps in Okta

These steps are the Okta Admin half of SCIM. Leave Import Users and Import Groups off — Camper does not support them.

2. Create the SCIM app in Okta

  1. In the Okta Admin console, go to Applications → Browse App Catalog and add SCIM 2.0 Test App (OAuth Bearer Token) — or your Camper app once it appears in the OIN.
  2. On the Provisioning tab, click Configure API Integration and enable it:
    • SCIM connector base URL: the Base URL from step 1
    • OAuth Bearer Token: the token from step 1
    • Unique identifier field for users: userName
  3. Click Test API Credentials — Okta calls GET /Users and should succeed. That check is for push matching, not Import Users.
  4. Under Provisioning → To App, enable Create Users, Update User Attributes, and Deactivate Users. Do not enable Import Users or Import Groups.

3. Scope who syncs

Assign people on the Assignments tab — only assigned users are pushed. Prefer groups over individuals so joiners and leavers flow without per-person work.

4. Push groups (Teams axis)

On the Push Groups tab, add the Okta groups you want as Camper team units. Each pushed group becomes an org unit under the default Teams axis:

Okta changeCamper effect
RenameTeam unit renames in place; linked resources that follow org names update on reconcile
Membership changeMulti-membership updates
Delete / unpushTeam unit archived; managed resources on it archived

5. Map org placement attributes

A new Camper workspace reads department for placement. If Okta already maps department, people land on the Department axis on the first push.

To slice the org differently (office, cost center, product line):

  1. Push the attribute — it must exist on the Camper app profile with External name and External namespace, or Okta stores it locally and never sends it. Walkthrough: Custom attributes → Okta.
  2. In Camper, open Catalog → New axis and pick the attribute from the list Camper actually received.

6. Elevate operators (optional)

Give dashboard operators SCIM Admin. Leave everyone else without a role (or send Viewer).

Typical pattern:

  1. Create an Okta group for Camper operators.
  2. In Provisioning → To App → Attribute Mappings, map roles so members of that group get Admin.
  3. In the Okta Profile Editor (Camper app profile), declare roles as string or string array — not a complex object.

Use only Admin and Viewer (or omit). Do not map Owner. Full table: Roles.

Verify

Assign one test user in Okta, then check Camper:

  • People shows the person (placed if attributes map)
  • Settings → Identity Providers shows Last push received with fresh counts

Offboarding

Deactivating a user or removing them from an assigned group in Okta suspends the identity in Camper on the next push. If they were an operator, their dashboard membership and live sessions for this workspace are revoked immediately.

Universal Logout (session revoke)

When Okta detects risk or an admin clears a user session, it can call Camper’s Global Token Revocation endpoint so that user is signed out of the Camper dashboard immediately — without deprovisioning them from the directory.

ItemValue
EndpointPOST https://api.getcamper.io/oauth/global-token-revocation
EffectDeletes that user’s live Camper sessions in your workspace
Does notSuspend the identity or remove operator membership

Setup

  1. Register Okta as an OIDC IdP under Settings → Identity Providers (same Client ID Okta uses for SSO).
  2. In the Okta app (or OIN config), set the Global token revocation endpoint to the URL above.
  3. Prefer identifying users by email in the logout payload.

Lifecycle offboarding still uses SCIM Deactivate / Delete. Universal Logout is for “kill sessions now” while the person may remain assigned.

Gotchas

  • Okta often sends group membership changes incrementally. If membership looks stale, use Push Groups → Push Now.
  • Rotating the bearer token in Camper breaks Okta until you paste the new token into provisioning.
  • Custom attributes without External name/namespace never leave Okta — the most common “axis is empty” cause.
  • Import Users / Import Groups are not supported. Use To App and Push Groups only.