Skip to content
  • Home
  • Developers
  • API
  • Releases
  • Community
  • University
  • Status
  • Home
  • Developers
  • API
  • Releases
  • Community
  • University
  • Status
Home Administration Secure Access SCIM Provisioning: OneLogin
Session Replay Getting Started Administration Data Management Definitions Charts Analysis Examples Heap Plays Integrations Heap Connect Data Privacy

Table of Contents

Was this article helpful?

Yes No

Thank you for your feedback!

SCIM Provisioning: OneLogin

In this article you'll learn:

  • Complete steps for setting up OneLogin SCIM provisioning for Heap
This doc is for: Admins

Overview

This feature is only available to customers on the Premier plan. To upgrade, contact your Customer Success Manager or sales@heap.io.

SCIM provisioning allows you to add and remove teammates in Heap directly from OneLogin. OneLogin offers ease of access, the ability to quickly block credentials for departed team members, multi-factor authentication, and more.

Prerequisites

To set up SCIM provisioning with OneLogin, you’ll need to have the following:

  • An existing OneLogin SSO configuration
  • Admin access to your organization’s Heap account
  • Administrator rights in your organization’s OneLogin account

If you set up your Heap application in OneLogin prior to February 2022 you will need to delete your existing OneLogin configuration and then create a new application using the instructions above in order to enable SCIM in your account.

Setup

Note that once SCIM provisioning is enabled, you will be unable to add or remove teammates in Heap and can only add or remove them via OneLogin.

To set up SCIM provisioning via OneLogin, complete these steps:

1. Navigate to the Applications > Applications section of your OneLogin administrator dashboard

This image has an empty alt attribute; its file name is Screen-Shot-2022-02-17-at-4.37.03-PM.png

2. Click the Heap application

3. In the Configuration tab, click Enable API

4. In Heap, go to Account > Manage > Personal settings

5. Click Enable SCIM Provisioning in the Single Sign-On section

6. Select the role you would like new users to be given by default. This can be edited later and individual users can be given different roles after they have been added to Heap.

7. Copy the Bearer Token

8. In OneLogin, paste the Bearer Token into the SCIM Bearer Token field

9. Switch to the Provisioning tab and click Enable provisioning

10. (Optional, but recommended) Change When users are deleted in OneLogin… to Delete to deprovision users in Heap when they are removed in OneLogin

11. Click Save

SCIM provisioning has now been enabled. Assigning new users to Heap in OneLogin will automatically create their account and revoking access will automatically delete their account.

Managing user roles from OneLogin

By default all users will be assigned to the default role you selected when setting up SCIM provisioning. However, you can also assign roles to users using the Heap Role parameter in the Parameters tab in OneLogin.

If a user has a value for this parameter then their account will be given that role in Heap. If they do not have a value for this parameter or this parameter is disabled then they will be given the default role.

The Heap Role should exactly match the name of the role in Heap that you want to assign to the user. If this value is updated in OneLogin, the user’s role will also be updated in Heap. However, the user’s role may also be changed in the Heap UI and this will not be reflected in the OneLogin parameter.

Was this article helpful?

Yes No

Thank you for your feedback!

Last updated November 29, 2022.

OneLoginSCIM Provisioningsingle sign-onSSO

Related Articles

  • Single Sign-on: OneLogin
  • Blog
  • Partners
  • Legal
  • Security
  • Terms
  • About
  • Careers
  • Privacy
  • Contact Us

© 2023 Heap, Inc.