- 27 Apr 2023
- 6 Minutes to read
- Print
- DarkLight
Managing users via IdP sync
- Updated on 27 Apr 2023
- 6 Minutes to read
- Print
- DarkLight
Airtable supports SSO for a variety of identity providers (IdP). This article is intended for administrators who are looking to provision/de-provision users and sync user groups with their IdP in the Admin Panel. We are starting with Okta, but we will explore supporting additional IdP in the future.
Prerequisites
Okta provides its own setup documentation related to managing users and user groups. If you are unfamiliar with how these functions work in Okta, then please check out their documentation below:
More information about our Okta app can be found here. Any existing users who you have already provisioned to use the Airtable app in Okta will need to be re-provisioned after setup in order to take full advantage of the Okta push features for those users. You can run an Okta import for Airtable to do this in bulk.
Okta Features
Push users
There are two important Okta features to consider related to the way that users will sync in Airtable. These are:
- Push new users - When you create a new user in Okta, Okta will automatically create an account for that user in Airtable.
- Push user updates - When you update a user’s supported attributes in Okta, it also updates the user’s values in Airtable. Supported attributes include first and last names and fields that only appear in reports, like cost center, department, and division.
- Push user deactivation - When you deactivate or disable the user's access to Airtable in Okta, this will also deactivate the user in Airtable.
Deactivating a user in Airtable means the user is no longer associated with your Enterprise's Airtable plan. This action will log out all of the user's logged-in sessions. It also means that the user will be greyed-out in any of Airtable's sharing dialogs. To permanently remove the user's account, the admin must either log into the user’s account and delete it through Airtable's interface (in order to transfer out any bases or workspaces owned by that user), or delete the user through the Enterprise API.
TIP
We do not charge for deactivated users. So, if there is a chance the user may need to be re-activated (provisioned) in the future, then leaving them in a deactivated state is likely a good practice to follow.Push groups
This will create an Airtable user group with the same name and membership as the source group from Okta (note that Airtable does not currently support nested groups). Once the groups have been pushed from Okta to Airtable, the Admin Panel supports further changes—it's best to avoid making changes to fields pushed from the IdP (e.g., Group name) as a future sync can overwrite this.
Configuration Steps: Push from Okta to Airtable
In the following scenario, we will be adding a new group in Okta that will push to Airtable causing a new user group to be created in Airtable that matches the group coming from your organization's Okta instance.
This will bring up a window to add a group name and optional description. The group name chosen here will sync over to Airtable as that same group name. In this case, we are creating a new group for a "Support" team.
We are assigning Heather, Cam, and Samuel to this group since they are support team members in our example.
In this case, we'll find the group by searching for it's name. All that's left is to click the "Save" button at the bottom of the window.
The group should now appear in the Airtable Application's group list. It may take a moment for the "Push Status" column to change from pushing to "Active."
Once the push status in Okta is Active, navigate to the Admin Panel in Airtable to make further adjustments related to the group as noted in the Groups Admin Panel article—avoid making changes to the fields pushed from IdP (e.g., Group name) as a future sync can overwrite this.
SCIM metadata
Before moving through the section below, your organization must have already set up Okta to provide SSO and connect to Airtable as highlighted in the sections above. Okta provides its own documentation on how to set up apps to push SCIM data from Okta to an external app using "attribute mapping." This will allow additional user metadata held in Okta to be displayed in various locations throughout Airtable's Enterprise Admin Panel. Specifically, organizations that use cost centers for accounting purposes will find this feature useful. As stated earlier in this article, this feature is only available for Enterprise customers on our ELA plan offering.
After setting up attribute mapping in the Airtable app in Okta, a "Cost Center" field in the Users page of the Airtable Admin Panel will be populated with any cost center data held in Okta.
Additionally, if cost center data is available for a user, then it will appear on their individual user details page:
Finally, the following information will be available in a CSV export from the admin panel.
- External ID
- Title
- Cost Center
- Department
- Division
- Organization
- Manager name
- Manager ID
Here is a redacted image of how that information will appear in the exported CSV:
Any additional metadata pushed to Airtable cannot be edited from within Airtable. To edit a user's cost center attributes, you'll need to return to OKTA and change it there.
FAQs
We support a subset of the specification for System for Cross-domain Identity Management, or SCIM. We also support a select list of user attributes.
Note: SCIM is only available for ELA & CLAIM enterprises, and SSO is a prerequisite for creating and updating users since we don't allow setting passwords with SCIM. For CLAIM enterprises SCIM can only manage claimed users. More information and a complete list of SCIMP API points are available here.