Roles and permissions
The following roles can configure SCIM:
Administrators
You can assign Hyperproof roles to Okta groups, so everyone in a group is provisioned to Hyperproof with that group's role. This saves you from setting roles one user at a time. To assign roles to individual users instead, see Assigning Hyperproof roles to individuals in Okta for SCIM provisioning.
Note: Assigning roles to groups is different from pushing groups. Push Groups synchronizes group membership to Hyperproof groups, but it doesn't set Hyperproof roles. See Provisioning groups from Okta using SCIM.
By default, the Hyperproof Okta app's role attribute can only be set on a per-user basis. To assign roles by group, you replace it with a group-level role attribute. The new attribute still works for users you individually assign to the app.
Before you begin
You need Okta administrator access to the Hyperproof app and to Directory > Profile Editor.
SCIM provisioning must already be set up for the Hyperproof app. See Okta SCIM workflow.
Make a note of the roles of any users assigned to the app individually. Okta clears these roles in Okta when you complete Step 1. Their roles in Hyperproof don't change, but you'll need to set them again in Okta.
Step 1: Replace the Hyperproof Role attribute
Delete the existing per-user role attribute, then add a group-level one with the same variable name.
What happens to users already assigned to the app: Deleting the attribute clears each user's role in Okta, so their assignments show no role until you set one again. Their access and roles in Hyperproof don't change. Users stay assigned and active, and Hyperproof keeps their current role until Okta sends a new one. After you add the new attribute, re-set roles on individual assignments by clicking the edit icon next to each user on the app's Assignments tab. Users who get their role from a group are updated when you complete Step 2.
In the Okta Admin Console, go to Directory > Profile Editor.
Open the user profile for your Hyperproof app (for example, Hyperproof User).
Find the Hyperproof Role attribute (variable name
role) and click the X to delete it. Confirm the deletion.Click Add Attribute and enter the settings in the table below.
Click Save Attribute.
If Okta shows an error that the variable name is in use, the deletion is still finishing. Wait a minute and save again.
Setting | Value |
Data type | string |
Display name | Hyperproof Role |
Variable name |
|
External name |
|
External namespace |
|
Description | Optional, for example "User's role in Hyperproof" |
Enum | Select Define enumerated list of values |
Attribute members | Admin = |
Attribute required | Not selected |
Attribute type | Group |
The attribute member values must match exactly. Display names can be anything you like.
Step 2: Assign roles to Okta groups
Go to Applications > Applications and open the Hyperproof app.
On the Assignments tab, click Assign > Assign to Groups.
Click Assign next to a group, choose a Hyperproof Role, and click Save and Go Back.
Repeat for each group, then click Done.
To change a group's role later, click the edit icon next to the group on the Assignments tab.
Okta provisions the group's members to Hyperproof with that role. Users already in Hyperproof are updated to the new role.
Step 3: Set group priority
If a user belongs to more than one assigned group, Okta uses the role from the highest-priority group.
On the Hyperproof app's Assignments tab, filter by Groups.
Drag the groups into order, highest priority first. We recommend ordering from most to least access:
Admin
Compliance manager
User
Limited access user
How Okta decides a user's role
Okta, not Hyperproof, decides which role to send. Keep in mind the following:
An individual assignment overrides group roles. If a user is assigned to the app directly and through a group, Okta sends the role from the individual assignment. Adding that user to a higher-access group changes nothing.
Removing an individual assignment can deactivate the user. If you remove a user's individual assignment while they're still in an assigned group, Okta may deactivate them in Hyperproof instead of switching them to the group's role.
We recommend giving each user a role in one way only: either through a group or individually, not both.
Troubleshooting
Problem | What to do |
Okta says the variable name | The old attribute is still being deleted. Wait a minute and save again. |
A user didn't get their group's role. | Check whether the user is also individually assigned to the app. Their individual role takes priority. |
A user was deactivated after you removed their individual assignment. | In Okta, remove the user from their group and add them back. Okta reactivates them in Hyperproof with the group's role. |
A user in several groups got the wrong role. | Check the group order on the Assignments tab (Step 3). |
A new user was provisioned as Limited access user. | No role was set for them in Okta. Assign them to a group with a role, or set a role on their individual assignment. |
For information on the entire SCIM provisioning workflow, see the Okta SCIM workflow.