Skip to main content
This guide will walk you through setting up SCIM (System for Cross-domain Identity Management) provisioning with Bruno using Okta SWA (Secure Web Authentication).
Prerequisites: Before configuring Okta, you must first enable SCIM provisioning in Bruno and generate an API key. Follow the Enabling SCIM Provisioning section in the overview page to complete this setup and save your API key for use in the steps below.

​
Create your Okta App

Already have an Okta App for SSO? If you previously set up a Bruno Okta application for SAML SSO, you can reuse it for SCIM provisioning. Skip to the Configure your Okta App section to add provisioning to your existing application.
  1. As an Okta admin, navigate to Applications and click Create App Integration
License portal login
  1. Select SWA - Secure Web Authentication and click Next
License portal login
  1. On the Create SWA Integration page, add the following values and click Finish:
    • App name: (Unique App Name - e.g. Bruno SCIM Integration)
    • App’s login page URL: https://license.usebruno.com/
License portal login

​
Configure your Okta App

  1. On your newly created application page, select the General tab
  2. Under App Settings, select Edit, and check the Provisioning option SCIM and click Save
License portal login
  1. Return to your Okta app, select the Provisioning tab, under SCIM Connection select Edit and configure the following values:
    • SCIM connector base URL: https://license.usebruno.com/scim/v2
    • Unique identifier field for users: email
    • Supported provisioning actions: Check the following options:
      • Import New Users and Profile Updates
      • Push New Users
      • Push Profile Updates
      • Push Groups
    • Authentication: set to HTTP Header
    • Under HTTP Header, for token: add the generated API Key value from the prerequisites step
License portal login
  1. Click Test Connector Configuration. If successful, a Connector configured successfully message dialogue appears.
License portal login
  1. Click Save to complete the Provisioning integration.
  2. Under the Provisioning tab, select the To Apps setting, edit and enable the following options and click Save:
    • Create Users
    • Update User Attributes
    • Deactivate Users
License portal login Your SCIM integration is now complete. You can now begin assigning users to Bruno.

​
Configure Admin Role Mapping

Admin Role Mapping lets you provision specific Okta users as Bruno License Manager admins. Admins provisioned this way get portal access, do not consume a license seat, and do not appear in the Users list.
This section is optional. Skip it if you only want to provision regular licensed users.
Unlike Entra ID, Okta has no built-in App Roles concept for custom SCIM apps, so this uses a custom profile attribute instead.

​
Add a custom attribute to the Okta user profile

  1. Go to Directory → Profile Editor
  2. Select Okta (the default/base user profile, not this app’s own profile)
  3. Click Add Attribute
  4. Fill in:
    • Data type: string
    • Display name: Bruno License Role
    • Variable name: brunoLicenseRole
    • Attribute type: Personal
  5. Click Save
Add custom attribute in Okta Profile Editor
Do not check any “define enumerated list of values” / array option when creating this attribute. If it renders as a dropdown instead of a plain text box afterward, it was created as an enum with no options, and any value you set on a user’s profile will be silently dropped. It must be a plain free-text string.

​
Add a roles attribute to your Bruno app’s profile

  1. Go to your Bruno SCIM app → Provisioning → To App, click Go to Profile Editor
  2. Click Add Attribute
  3. Fill in:
    • Data type: string
    • Display name: Roles
    • Variable name: roles
  4. Click Save
Add roles attribute to app profile
Okta may default this attribute’s namespace to something app-specific instead of the base SCIM schema, which causes it to be sent nested (e.g. "roles": {"roles": "..."}) instead of as a flat field, and Bruno won’t recognize it. If this happens, use the Okta API to set this attribute’s externalNamespace to urn:ietf:params:scim:schemas:core:2.0:User (matching the other built-in attributes like givenName), the same namespace already used by attributes such as givenName or locale on this profile.

​
Map the attribute to the roles field

  1. Go to your Bruno SCIM app → Provisioning → To App → Attribute Mappings
  2. Find the roles row and click the pencil icon
  3. Set Attribute value to Expression and enter:
  4. Set Apply on to Create and update
  5. Click Save
Configure roles attribute mapping expression
Use user.brunoLicenseRole (global profile), not appuser.brunoLicenseRole. Okta blocks same-profile attribute references in expression mappings.

​
Configure Admin Role Mapping in Bruno

  1. In the Bruno LM portal, go to Settings → SCIM → Admin Role Mapping
  2. Enter the role value(s) that should grant admin access, for example:
  3. Multiple values are supported comma-separated (e.g. bruno-admin, admin). Any match grants admin access.
  4. Values must exactly match what you set on users in Okta (case-sensitive)
  5. Click Save
Configure Admin Role Mapping in Bruno

​
Set the role on users in Okta

For each user you want to provision as a License Manager admin:
  1. Go to Directory → People → [user] → Profile tab → Edit
  2. Find Bruno License Role and set the value to bruno-admin (or whatever you configured above)
  3. Click Save
Set Bruno License Role on a user's profile Leave Bruno License Role empty for users who should be provisioned as regular licensed users.

​
Assign people and groups to Bruno in Okta

  1. Under your created Bruno Application, navigate to the Assignments tab
  2. Select Assign and either Assign to People or Assign to Groups to provision Bruno license keys. If you configured Admin Role Mapping, make sure the assigned user’s Bruno License Role attribute is set first
License portal login License portal login
  1. Assigned users with a matching admin role get portal access directly, with no license key or email. All other assigned users receive an email with their License Key
License portal login

​
Deprovision users from Bruno in Okta

  1. Under your created Bruno Application, navigate to the Assignments tab License portal login
  2. Remove the desired users or groups, their license key(s) will be deactivated and they will receive an email notification License portal login
For more information about configuring SCIM provisioning with Okta, refer to these Okta documentation resources: