Setting Up SCIM Provisioning with Okta

Features

The following provisioning features are supported:

• Push new Users
  • New users created through Okta and assigned to HackerRank for Work will be created within the application.
  • De-provisioning is not supported. This action needs to be done through HackerRank for Work.

• Push Profile Updates
  • Updates made to a user’s profile within Okta will update the user’s profile in HackerRank for Work.

• Import New Users
  • Users who were created within HackerRank for Work can be downloaded and turned into a User object in Okta.

• Import Profile Updates
  • Updates on a provisioned user’s profile within HackRank for Work can be downloaded and synced in Okta.

• Push Groups
  • Groups will be provisioned as Teams and members within those groups will be mapped into the team on HackerRank for Work.
  • Only Add Users to Group is supported.

• Silent Provisioning
  • Users are silently provisioned through Okta, meaning new users will not receive Welcome or Activation emails.

Note:  HackerRank can only accept the user's email address. In setup, the user defines the SAML assertion with necessary data. HackerRank SSO will fail if it receives anything but an email address.

Requirements

Before you configure provisioning with HackerRank for Work, make sure you have configured SSO using SAML. Please follow these steps if you have not set that up. After setting up SSO, follow these steps to generate your API Token:

1. Log into your admin account on HackerRank for Work.

2. On the home page, click the arrow next to the user icon on the top right corner of the page, and select Settings.
3. Click on SSO Settings from the side panel
4. Click on the Generate API Key button under SCIM Protocol.
5. Copy the API Key that was generated. This will be used later in the configuration steps.

Configuration Steps

Configure your Provisioning settings for HackerRank for Work as shown below, 

1. Within the HackerRank for Work application in Okta, click on the Provisioning tab
2. Click on the Configure API Integration button

3. Check the Enable API Integration box
4. Enter the API Token that was generated from HackerRank for Work into the API Token field. Click on the Test API Credentials button to verify that the token is valid, then click on the Save button.
5. In the To App option under the Provisioning tab, check the boxes to enable Create Users and Update User Attributes
6. Click on the Save button. You can now begin provisioning users to HackerRank for Work.

Import Users

If you already have a list of users created in HackerRank and want to avoid overwriting existing permissions, pull users back into Okta to keep your directory in sync with Import Users.

1. Within the HackerRank for Work application in Okta, click on the Import tab
2. Click on the Import Now button to pull the list of users from HackerRank for Work
3. Select the users who should be imported and Confirm Assignments. If users in HackerRank for Work already exist in Okta but not assigned to the HackerRank for Work application, you will see an EXACT label associated with the user. A new user will not be created, instead, the user will be assigned to the application. 
4. A dialog box will appear. Click Confirm.
5. Now, the user should appear in your directory and you can navigate back to the Assignment tab to verify the newly imported users.

Provisioning Steps

Follow these steps to create users within HackerRank for Work.

1. Within the HackerRank for Work application in Okta, click on the Assignments tab
2. Click on the Assign button to open a couple options

1. Assign to People: Provision a single user
   1. Click in the Assign button for the user that you want to provision
   2. Fill out the required attribute fields for:
      1. Role
         1. Recruiter
            1. Create tests, questions, and interviews
            2. Access candidates
            3. Send invites
         2. Developer
            1. Create tests, questions, and interviews
            2. Access candidates
         3. Interviewer
            1. Create and give interviews
      2. Company Admin: Grant ability to override and grant more permissions for users in the whole company.
      3. Team Admin: Grant ability to override permissions for users within the same team.
   3. Click on the Save and Go Back button to see your newly assigned user
2. Assign to Groups: Provision a group of users
   1. Click on the Assign button for the group that you want to provision
   2. Fill out the required attribute fields for (all users within the group will be provisioned with the same value for the attributes):
      1. Role
         1. Recruiter
            1. Create tests, questions, and interviews
            2. Access candidates
            3. Send invites
         2. Developer
            1. Create tests, questions, and interviews
            2. Access candidates
         3. Interviewer
            1. Create and give interviews
      2. Company Admin: Grant ability to override and grant more permissions for users in the whole company.
      3. Team Admin: Grant ability to override permissions for users within the same team.
   3. Click on the Save and Go Back button. You will notice that your group has been assigned to the application.
   4. You can also view the list of users who were assigned in the People tab

Migration for New Features

The HackerRank SCIM application has been updated to provide a better overall experience to Okta customers. Here is a summary of changes:

• A new attribute (Interviewer Role) has been added

To take advantage of these updates if you are a current user, you have to add a new instance of HackerRank in your Okta org. If you already have an existing instance of HackerRank, follow the steps below to migrate from that old instance to a newly updated instance of HackerRank:

1. Log in to your Okta org as an Admin
2. Open the Admin UI.
3. Click on the Add Applications button.
4. Add a new instance of HackerRank.
5. Configure the application including Provisioning.
6. After SCIM Provisioning has been enabled, go to the Import tab of your new HackerRank app instance. Click on the Import Now button.
7. After the users from HackerRank are downloaded, select the users you want created or linked in Okta and then click on Confirm Assignments.

8. A pop-up will appear asking if you would like to proceed with the assignment confirmation. Click on the Confirm button. 

9. Go back to your Admin Dashboard.
10. Open your old HackerRank app instance. This is the previous HackerRank app instance you added before adding a new one in step 4.
11. Go to the Provisioning tab.
12. On the SETTINGS section, click on the API option.
13. Click on the Edit option and uncheck Enable API Integration. Click on the Save button.
14. You can now deactivate or delete your old HackerRank app instance and continue using the new HackerRank app you added.

Note:

• If you were using SAML as the sign-on mode for your old HackerRank app instance, you will need to set up SAML on your new HackerRank app instance in Okta (recommended) or maintain the old HackerRank app instance to ensure that the SAML functionality continues to work.
• If you were using your old HackerRank app as a profile master for certain Okta attributes, you would need to set your new HackerRank app as the profile master for the same attributes. 

Push Groups

Follow these steps to assign your users to a team within HackerRank for Work. It is a best practice for all users to be part of at least 1 team so they have access to tests and candidate reports.

Caveat: Users must already be provisioned to the application using Assignments for Push Groups to work. Group names must be unique and have not been created on HackerRank.

1. Within the HackerRank for Work application in Okta, click on the Push Groups tab.
2. Click on the Push Groups button and select Find groups by name
3. Using the search box, find your group and click on the Save button.
4. On successful group push, you will see Active appear for the group.

Common Group - Team configurations

• All users are in one group.
• If you would like all HackerRank users to be in one team and have equal access to all tests and candidates, push a single group that all users belong to. For example, “Everyone” or “HackerRank Users.”
• The group will be pushed and only those users who are assigned through the Assignments tab will be added to a team called “Everyone.”
• HackerRank users are in teams according to organization recruiting.
• If you would like to create Teams in HackerRank that correspond to organizations, divisions, or geo-locations, find corresponding groups in Okta and push them as Teams in HackerRank.

User Attributes

There are several attributes that need to be configured when assigning/updating users.

1. Username/Email: The primary email is used as the username in HackerRank and can not be updated from Okta. Choosing to update either username or primary email in Okta will not be reflected in the HackerRank for Work application.
2. Given Name: First name of the user
3. Family Name: Last name of the user
4. Role
   • Recruiter
     • Create tests, questions, and interviews
     • Access candidates
     • Send invites
   • Developer
     • Create tests, questions, and interviews
     • Access candidates
   • Interviewer
     • Create and give interviews
5. Company Admin: Ability to override and grant more permissions for users in the whole company. The value must be either true/false.
6. Team Admin: Ability to override permissions for users within the same team. The value must be either true/false.

Troubleshooting and Tips

• We suggest keeping Okta as the source of truth.
• This integration is optimized for creating users and teams. The following Okta features are not supported.
  • De-provisioning is not supported. Users who need to be locked or removed from a team must be done through the HackerRank for Work application.
  • Teams in HackerRank cannot be synced back to Okta as a Push Group option.
  • Push Now functionality.
  • Delete Group in the target app.
  • Remove member from the group.