Setting Up SCIM Provisioning with Okta

Overview

HackerRank enables you to set up provisioning through your SSO by configuring the SCIM protocol.

As an identity provider, Okta enables you to provide SSO access to the cloud, on-premise, and mobile applications. Once you sign into Okta, you can launch your web applications without re-entering your credentials.

This article guides you on how to configure SCIM provisioning with Okta.

Features

The following provisioning features are supported:

• Push new Users
  • New users created through Okta and assigned to HackerRank for Work are created within the application.
  • De-provisioning is not supported. You need to perform this action through HackerRank for Work.

• Push Profile Updates
  • Updates made to a user’s profile within Okta will update the user’s profile in HackerRank for Work.

• Import New Users
  • Users created within HackerRank for Work can be downloaded and turned into a User object in Okta.

• Import Profile Updates
  • Updates on a provisioned user’s profile within HackRank for Work can be downloaded and synced in Okta.

• Push Groups
  • Groups are provisioned as Teams and members within those groups are mapped into the team on HackerRank for Work.
  • Only Add Users to Group is supported.

• Silent Provisioning
  • Users are silently provisioned through Okta, which indicates that new users will not receive Welcome or Activation emails.

Note:  HackerRank accepts only the user's email address. In the setup, the user defines the SAML assertion with the necessary data. HackerRank SSO fails if it receives anything other than an email address.

Prerequisites

Before configuring the provisioning with HackerRank for Work, ensure you configure SSO using SAML.

Configuring SCIM Provisioning with Okta

The process of configuring SCIM Provisioning with Okta includes the following:

1. Generating an API Key from HackerRank
2. Configuring Provisioning for HackerRank
3. Importing Users
4. Provisioning Steps

Generating an API Key from HackerRank

1. Log in to HackerRank for Work with the Company Admin user account.  
2. On the home page, click the drop-down next to the user icon on the top right corner of the page.
3. Click Settings.
4. Click Single Sign On on the left panel.
5. Click Generate Key under SCIM Protocol.
6. Copy the API Key that is generated.

Configuring Provisioning for HackerRank

1. Click the Provisioning tab in the HackerRank for Work application in Okta.
2. Click Configure API Integration.

3. Select the Enable API Integration check box.
4. Enter the API Token generated from HackerRank for Work in API Token.
5. Click Test API Credentials to verify that the token is valid, then click Save.
6. In the To App option under the Provisioning tab, select the Create Users and Update User Attributes check boxes.
7. Click Save. You can now begin provisioning users to HackerRank for Work.

Importing Users

The Import Users option helps to prevent overwriting existing permissions for users that are already created in HackerRank. This option pulls users back into Okta to keep your directory in sync.

To import users:

1. Click the Import tab in the HackerRank for Work application in Okta.
2. Click Import Now to pull the list of users from HackerRank for Work.
3. Select the users to be imported and Confirm Assignments.
4. If users in HackerRank for Work exist in Okta but are not assigned to the HackerRank for Work application, an EXACT label is associated with the user. A new user is not created, but the user will be assigned to the application. 
5. The Confirm Imported User Assignments dialog box appears.
6. Click Confirm.
7. Now, the user appears in your directory.
8. You can navigate to the Assignment tab to verify the newly imported users.

Provisioning Steps

Perform these steps to create users in HackerRank for Work:

1. Click the Assignments tab in the HackerRank for Work application in Okta.
2. Click Assign.

There are two options in this list:

• Assign to People
• Assign to Groups

Assign to People

Provision a single user.

1. 1. Click Assign for the user that you want to provision.
   2. Enter the required attribute fields for these roles:
      • Role
        1. Recruiter
           1. Create tests, questions, and interviews.
           2. Access candidates.
           3. Send invites
        2. Developer
           1. Create tests, questions, and interviews.
           2. Access candidates.
        3. Interviewer
           1. Create and give interviews
      • Company Admin: Grant the ability to override and grant more permissions for users in the whole company.
      • Team Admin: Grant the ability to override permissions for users within the same team.
   3. Click Save and Go Back to view your newly assigned user.

Assign to Groups

Provision a group of users.

1. 1. Click Assign for the group that you want to provision.
   2. Enter the required attribute fields for these roles: (all users within the group will be provisioned with the same value for the attributes).
      • Role
        1. Recruiter
           1. Create tests, questions, and interviews.
           2. Access candidates.
           3. Send invites.
        2. Developer
           1. Create tests, questions, and interviews.
           2. Access candidates.
        3. Interviewer
           1. Create and give interviews
      • Company Admin: Grant the ability to override and grant more permissions for users in the whole company.
      • Team Admin: Grant the ability to override permissions for users within the same team.
   3. Click Save and Go Back. Your group has been assigned to the application.
   4. You can also view the list of users assigned in the People tab.

Migrating to New Instance of HackerRank

The HackerRank SCIM application is updated to provide a better experience to Okta users. The summary of changes is:

• A new attribute (Interviewer Role) is added

If you are a current user, you need to add a new instance of HackerRank in your Okta org.

If you already have an existing instance of HackerRank, follow these steps to migrate to a newly updated instance of HackerRank:

1. Log in to your Okta org as an Admin.
2. Open the Admin UI.
3. Click Add Applications.
4. Add a new instance of HackerRank.
5. Configure the application including Provisioning.
6. After SCIM Provisioning has been enabled, go to the Import tab of your new HackerRank app instance.
7. Click Import Now.
8. After the users from HackerRank are downloaded, select the users you want created or linked in Okta.

8. Click Confirm Assignments. A pop-up appears to confirm with proceeding for the assignment confirmation.

 

9. Click Confirm. 
10. Navigate to the Admin Dashboard.
11. Open your previous HackerRank app instance.
    
12. Go to the Provisioning tab.
13. On the SETTINGS section, click the API option.
14. Click the Edit option and clear the Enable API Integration checkbox.
15. Click Save.
16. You can now deactivate or delete your previous HackerRank app instance and use the new HackerRank app you added.

Note:

• If you were using SAML as the sign-on mode for your previous HackerRank app instance, you will need to set up SAML on your new HackerRank app instance in Okta (recommended) or maintain the previous HackerRank app instance to ensure that the SAML functionality continues to work.
• If you were using your previous HackerRank app as a profile master for certain Okta attributes, you must set your new HackerRank app as the profile master for the same attributes. 

Push Groups

To have access to tests and candidate reports, it is a best practice for users to be part of at least one team.

Follow these steps to assign your users to a team within HackerRank for Work.

Warning: Users must be provisioned to the application using Assignments for Push Groups to work. Group names must be unique and have not been created on HackerRank.

1. Click the Push Groups tab in the HackerRank for Work application on Okta.
2. Click Push Groups.
3. Select Find groups By name.
4. Using the search box, find your group
5. Click Save.
6. On successful group push, Active status appears for the group.

Common Group - Team Configurations

• All users are in one group.
• If you want HackerRank users to be in one team and have equal access to all tests and candidates, push a single group that all users belong to. For example, Everyone or HackerRank Users.
• The group will be pushed and only those users assigned through the Assignments tab will be added to the team Everyone.
• HackerRank users are in teams according to organization recruiting.
• If you want to create Teams in HackerRank that correspond to organizations, divisions, or geo-locations, find the corresponding groups in Okta and push them as Teams in HackerRank.

User Attributes

There are various attributes that you need to configure when assigning or updating users.

• Username/Email: The primary email is used as the username in HackerRank and cannot be updated from Okta. Choosing to update either username or primary email in Okta will not be reflected in the HackerRank for Work application.
• Given Name: First name of the user.
• Family Name: Last name of the user.
• Role
  • Recruiter
    • Create tests, questions, and interviews.
    • Access candidates.
    • Send invites.
  • Developer
    • Create tests, questions, and interviews.
    • Access candidates.
  • Interviewer
    • Create and give interviews.
• Company Admin: Ability to override and grant more permissions for users in the whole company. The value must be either true or false.
• Team Admin: Ability to override permissions for users within the same team. The value must be either true or false.

Troubleshooting and Tips

• We suggest keeping Okta as the source of truth.
• This integration is optimized for creating users and teams. The following Okta features are not supported.
  • De-provisioning is not supported. Users to be locked or removed from a team must be done through the HackerRank for Work application.
  • Teams in HackerRank cannot be synced back to Okta as a Push Group option.
  • Push Now functionality.
  • Delete Group in the target app.
  • Remove member from the group.