- 11 Jan 2023
- 6 Minutes to read
Managing users via IdP sync - ELA only
- Updated on 11 Jan 2023
- 6 Minutes to read
Airtable supports SSO for a variety of identity providers (IdP). This article is intended for administrators who are looking to provision/de-provision users and sync user groups with their IdP in the Admin Panel. We are starting with Okta, but we will explore supporting additional IdP in the future.
Okta provides its own setup documentation related to managing users and user groups. If you are unfamiliar with how these functions work in Okta, then please check out their documentation below:
More information about our Okta app can be found here.
Any existing users who you have already provisioned to use the Airtable app in Okta will need to be re-provisioned after setup in order to take full advantage of the Okta push features for those users. You can run an Okta import for Airtable to do this in bulk.
There are two important Okta features to consider related to the way that users will sync in Airtable. These are:
- Push new users - When you create a new user in Okta, Okta will automatically create an account for that user in Airtable.
- Push user updates - When you update a user’s supported attributes in Okta, it also updates the user’s values in Airtable. Supported attributes include first and last names and fields that only appear in reports, like cost center, department, and division.
- Push user deactivation - When you deactivate or disable the user's access to Airtable in Okta, this will also deactivate the user in Airtable.
Deactivating a user in Airtable means the user is no longer associated with your Enterprise's Airtable plan. This action will log out all of the user's logged-in sessions. It also means that the user will be greyed-out in any of Airtable's sharing dialogs. To permanently remove the user's account, the admin must either log into the user’s account and delete it through Airtable's interface (in order to transfer out any bases or workspaces owned by that user), or delete the user through the Enterprise API.
TIPWe do not charge for deactivated users. So, if there is a chance the user may need to be re-activated (provisioned) in the future, then leaving them in a deactivated state is likely a good practice to follow.
This will create an Airtable user group with the same name and membership as the source group from Okta (note that Airtable does not currently support nested groups). Once, the groups have been pushed from Okta to Airtable, the admin panel supports renaming groups, updating group membership, and deleting groups.
Configuration Steps: Push from Okta to Airtable
In the following scenario, we will be adding a new group in Okta that will push to Airtable causing a new user group to be created in Airtable that matches the group coming from your organization's Okta instance.
This will bring up a window to add a group name and optional description. The group name chosen here will sync over to Airtable as that same group name. In this case, we are creating a new group for a "Support" team.
We are assigning Heather, Cam, and Samuel to this group since they are support team members in our example.
In this case, we'll find the group by searching for it's name. All that's left is to click the "Save" button at the bottom of the window.
The group should now appear in the Airtable Application's group list. It may take a moment for the "Push Status" column to change from pushing to "Active."
Before moving through the section below, your organization must have already set up Okta to provide SSO and connect to Airtable as highlighted in the sections above. Okta provides its own documentation on how to set up apps to push SCIM data from Okta to an external app using "attribute mapping." This will allow additional user metadata held in Okta to be displayed in various locations throughout Airtable's Enterprise Admin Panel. Specifically, organizations that use cost centers for accounting purposes will find this feature useful.
As stated earlier in this article, this feature is only available for Enterprise customers on our ELA plan offering.
After setting up attribute mapping in the Airtable app in Okta, a "Cost Center" field in the Users page of the Airtable Admin Panel will be populated with any cost center data held in Okta.
Additionally, if cost center data is available for a user, then it will appear on their individual user details page:
Finally, the following information will be available in a CSV export from the admin panel.
- External ID
- Cost Center
- Manager name
- Manager ID
Here is a redacted image of how that information will appear in the exported CSV:
Any additional metadata pushed to Airtable cannot be edited from within Airtable. To edit a user's cost center attributes, you'll need to return to OKTA and change it there.
Is cost center data able to be synced to Airtable via SCIM for any other IdP services besides Okta?
Not at this time. However, we hope to offer functionality with other IdP services in the future.