### Steps to set up SCIM with Okta

1. Set up the password policy (password should contain at least one number and one symbol), if using the **Classic Engine on Okta** follow the below steps **,** or if using the **OIE engine,** follow the steps as mentioned in this [**Okta guide**](https://help.okta.com/oie/en-us/content/topics/identity-engine/authenticators/configure-password.htm) **.**  
   - Navigate to Security -> Authentication on your Okta Administrator Dashboard.  
   - Click Edit and update the password policy by enabling Number and Symbol, then click on Update Policy.

2. Navigate to the Applications view within your Okta Administrator Dashboard.

3. Click on **Create App Integration**.

4. A dialog appears, select SWA - Secure Web Authentication and then click **Next.**

5. Now give the app a name and populate the app’s login URL with [**https://cosmo.wundergraph.com/login**](https://cosmo.wundergraph.com/login) **.**

6. For “ **Who sets the credentials**”, select **Administrator sets username, user sets password.**

7. For the **application username**, select **Email** and then click **Finish.**

8. Now navigate to the **General** tab, click on **Edit** in **App settings.**

9. Enable **SCIM provisioning** and then click on **Save.**

10. Navigate to the settings page on WunderGraph Cosmo and enable **SCIM.**

11. Once SCIM is enabled, you will be provided with a **SCIM Server URL,** copy it **.**

12. Navigate to the API Keys page on WunderGraph Cosmo and click on New API Key.

13. Provide the key with a name, select **Never** for **Expires,** then select **SCIM** under **Permissions**, then click on **Generate API key.**

14. Copy the API key provided.

15. Navigate to the provisioning tab of the app created on okta, then click on **Edit**.

16. Populate the **SCIM connector base URL** with the copied **SCIM server URL** .

17. Populate the **Unique identifier field for users** with **“email”.**

18. Select **Import New Users and Profile Updates, Push New Users and Push Profile Updates** for **Supported provisioning actions.**

19. Select **HTTP Header** for **Authentication Mode.**

20. Populate the **Authorization** field under HTTP Header with the above-copied API key.

21. Click on Test Connector Configuration, a dialog will appear showing the connector is configured successfully, click Close.

22. Click on **Save.**

23. Navigate to the “ **to App”** tab **, and** click on **Edit.**

24. Enable **Create Users, Update User Attributes, Deactivate Users** and **Sync Password.**

25. Under **Sync Password** for **Password type**, select **Sync Okta Password.**

26. Click **save.**

27. Now you can navigate the Assignments tab and assign users/groups who should have access to WunderGraph Cosmo.

If you are using both **SSO with OIDC** and **SCIM**, please make sure that the users assigned in both apps are the same.