Search

Okta SCIM ClickUp configuration guide

Workspaces that rely on Okta for provisioning can use custom roles to fully integrate with Okta. Any role created in ClickUp can be added as an option within Okta, making it easy to integrate custom roles into existing workflows.

What you'll need

  • Before you can set up provisioning, you need to have Okta SSO enabled for your Workspace.
  • Only Okta admins can configure Okta SCIM.

Configure Okta SCIM

To configure Okta SCIM:

  1. After Okta SSO is enabled, you'll see a SCIM Base URL and SCIM API Token.

    If your Identity Provider (IdP) supports SCIM but you're not using Okta, you will still need the SCIM Base URL and SCIM API Token presented after successfully integrating SSO. If SCIM isn't supported for your IdP's official ClickUp SSO integration, Custom SAML must be used instead.

    Screenshot of the Okta SSO authentication page.
  2. In your Okta Dashboard, navigate to the ClickUp application and click the Provisioning tab.
  3. Check the Enable provisioning features checkbox.
  4. Click Configure API Integration.
  5. Check the Enable API integration box.
  6. Copy and paste your SCIM Base URL and SCIM API Token from step 1.
    Screenshot of someone pasting their Base URL and API token.
  7. Click Test API Credentials. If successful, a verification message appears.
  8. Click Save.
  9. In the left panel, select To App.
  10. Choose the Provisioning Features you want to enable.
  11. Assign people to the app and finish the application setup.
  12. When assigning users or groups, assign the ClickUp Role attribute. If this attribute is unset, everyone will default to the member role.

What you can do

You can take the following actions using Okta SCIM:

Action Description
Push New Users

New users created through Okta are also created in the third-party application.

Okta creates a username and email, but no password. If a user gets locked out due to SSO becoming unlinked, an owner or admin must change the SSO policy to optional so the user can reset their password.
Push New Group

New groups created through Okta are also created as Teams within ClickUp.
Push Profile Updates Updates to the user's profile through Okta are also made in the third-party application.
Push User Deactivation

Deactivating or disabling the user's access to the application through Okta also deactivates the user in the third-party application. When users are deactivated in Okta, they are removed from the associated ClickUp Workspace. Users will not be able to access anything in that Workspace, but their data will remain available as an "inactive user."

For this application, deactivating a user means removing access to log in, but maintaining the user's Chorus information as an inactive user.
Reactivate Users User accounts can be reactivated in the application.

Troubleshooting tips

Below are some helpful tips when configuring Okta SCIM:

  • Once a user is created in ClickUp, they won't receive updates when the givenName, lastName, or email is changed in Okta. Only updates made to the ClickUp Role are sent from Okta to ClickUp. If a change must be made to the email or username, it must be done by the user in their ClickUp settings.

  • If your name in ClickUp displays as your email address, you can update it on your personal settings page.
    Screenshot of the full name option in My Settings.png

  • To set a custom role for your users, you can map to either the customRoleName attribute or the customRoleId attribute. If you do not have someone who can access the public ClickUp API, create an attribute in the Okta profile that is an enumerated list of names that match the custom roles you created in your ClickUp Workspace. Make sure this maps to customRoleName during user provisioning.

    If the custom role name is changed in ClickUp, this mapping will break. If you can access the ClickUp Public API, use the customRoleId attribute to ensure that the custom role mapping does not break when custom role names are changed in ClickUp. To find out the IDs that correspond to the custom roles that you created, use this endpoint to find the list of roles available in your Workspace.

Custom role attributes

The following custom role attributes are available:

Model Custom role attributes
Base
  • id
  • userName
  • Name: {givenName and familyName}
  • active
  • emails
  • Array of emails with value property and primary (boolean) property
  • title

  • urn:ietf:params:scim:schemas:core:2.0:User
Extension
  • role
  • clickupRole
  • customRoleId
  • customRoleName
  • urn:ietf:params:scim:schemas:extension:ClickUp:2.0:User
Enterprise
  • manager
  • urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

Was this article helpful?