Okta - Creating Custom Attributes for SCIM User Provisioning

Learn how to create and map custom attributes as a part of user provisioning to the Staffbase platform using SCIM.

In this article, you will learn how to create and map custom attributes to provision users from your identity provider to the Staffbase platform using .

You can define the SCIM schema for user attributes and extend it with custom attributes. These custom attributes can be specific for your Staffbase platform users.

For example, you can create additional custom profile fields to record the skills of your users in the Staffbase platform. If you want to automatically provision values to a custom profile field using SCIM, do the following:

  1. Create a custom attribute in your identity provider.
  2. Copy the custom attribute and paste it in the Qualified SCIM name field for the custom field in the Staffbase Studio.

The schema for creating the custom attributes is urn:ietf:params:scim:schemas:extension:{{CompanyName}}:2.0:User:{{CustomAttribute}}, you need to input the values within {{ }}.
Here, CompanyName is the name of your company and CustomAttribute is the name you want to give the new custom attribute that you want to create.
If your CompanyName is showcase and the custom attribute you want to create is custom_department.
The schema will look like this: urn:ietf:params:scim:schemas:extension:showcase:2.0:User:custom_department.

  • SCIM is already activated for your organization.
  • You have already set up the default mapping in Okta.
  • You have the permissions required to create custom attributes in your identity provider.

The schema for creating custom attributes is the same for all Staffbase supported identity providers. Learn more about the identity providers that Staffbase supports.

In the same section where you configured your default mappings, you can also add custom attributes to provision to custom profile fields in Staffbase.

  1. In the Okta Admin Console, navigate to the default mapping of the application you created.
  2. Navigate to Go to Profile Editor > Add Attribute to define the new attribute, for example department.
  • Display name: The display name in Okta.
  • Variable name: The name of the variable in Okta.
  • External name: The suffix of the name of the qualified SCIM name of the custom profile field in Staffbase.
  • External namespace: urn:ietf:params:scim:schemas:extension:{CompanyName}:2.0:User where {CompanyName} needs to be replaced with the name of your company.

Example Department Custom Attribute

  • Full schema for the Qualified SCIM name: urn:ietf:params:scim:schemas:extension:{CompanyName}:2.0:User:{CustomField}
  • {CompanyName} is showcase
  • {CustomField} is custom_department
  • Qualified SCIM name in Staffbase would be urn:ietf:params:scim:schemas:extension:showcase:2.0:User:custom_department
  • External name in Okta would be: custom_department
  • External namespace in Okta would be: urn:ietf:params:scim:schemas:extension:showcase:2.0:User
  1. Click Save to add the new attribute.

  2. Once you have added all your new attributes, go back to your Application.

  3. In your application, select Provisioning > To App.

  4. Click Show Unmapped Attributes.

  • Look for the new attributes you have created.
  1. Click on the edit icon for the attributes you created.
  2. Select the type Map from Okta Profile.
  3. Select the profile field of your choice. For example, department.
  4. Under Apply on, select Create and update.

If one of the options is not available, SCIM might not yet be enabled for updates.

  1. Click Save.
  • A new custom mapping is now applied.

Now you can give the custom attribute schema you created to the Staffbase administrator, who will configure the custom profile field. Learn more here.

In our example, the custom attribute schema looks like this: urn:ietf:params:scim:schemas:extension:showcase:2.0:User:custom_department

After the custom profile field in the Staffbase Studio is configured with the custom attribute, the custom attribute may not get provisioned the first time you provision users. You might want to test it with Force Sync to ensure it works as expected.