Set up SSO and provisioning with Okta
Setting up SSO and provisioning with Microsoft Entra ID requires specific permissions. To connect your Identity Provider and automate account management, you must have rights to “Manage company settings”, "Manage users", and "Manage user groups" in Contractbook. Ensure you have these permissions enabled before proceeding, or contact your Company administrator for help.
Once enabled, follow these steps to set up the integration.
Prerequisites
Administrator access to your company’s Microsoft Entra admin center.
A valid Contractbook API key. You can request your SSO API key from Contractbook Support team.
A working Entra ID setup with the users from your organization you want to synchronize with Contractbook.
A secret token for an admin user, provided to you by the Contractbook Support team.
Our Tenant URL: https://api.contractbook.com/scim.
Create SSO app integration in Okta
Navigate to your organization's Okta account and select the Applications menu.
Click the Create App Integration button.
Select OIDC - OpenID Connect as the Sign-in method.
Select Single-Page Application as the Application type and click to proceed.
Enter a name for your application.
Check Authorization Code under Grant Type.
Paste the sign-in and sign-out redirect URIs provided in the prerequisites.
Leave Trusted Origins blank.
Leave Enable immediate access unchecked under the Assignments section.
Configure SSO connection
Go to the General settings tab of your new application and click Edit.
Change Login initiated by to Either Okta or App.
Update Application visibility as needed.
Set the Initiate login URI to the exact same address as the sign-in redirect URI.
Send your Okta Organisation ID, Application ID, and Issuer URI to the Contractbook Support Team to finalize the connection.
Verify you have access to the API > Authorization Servers settings to find your Issuer URI.
Set up SCIM 2.0 provisioning
Go to the Applications section in your Okta account.
Click Browse App Catalog.
Type "SCIM" in the search bar and select SCIM 2.0 Test App (Header Auth).
Click Add Integration.
Enter your preferred name for the application and click Next.
Choose Secure Web Application and configure your desired username and password setup.
Select Email for the Application username format under Credentials Details.
Click Done to create the application.
Configure API integration for SCIM
Navigate to the Provisioning tab in your new SCIM application.
Click Configure API Integration.
Check the Enable API integration box.
Paste the Tenant URL (https://api.contractbook.com/scim) and your Secret Token.
Click Test API Credentials to verify the connection to Contractbook.
Click Save once the test is successful.
Check attribute mappings
Navigate to the Provisioning tab and scroll to Attribute mappings.
Ensure the following fields are mapped exactly:
userName
email
emailType
primaryPhone
primaryPhoneType
addressType
streetAddress
Click Go to Profile Editor to add any missing fields manually.
Provision users and user groups
Navigate to the Assignments tab to assign users.
Click Assign and choose either Assign to People or Assign to Group.
Click Assign next to the specific users or groups, then click Done.
Navigate to the Push Groups tab to synchronize group permissions.
Click Push Groups and search for the desired Okta group.
Click + Create a group to map it.
Select Push group membership immediately to sync right away, then click Save.
Helpful guides: