Use this article to configure SAML 2.0 single sign-on (SSO) and SCIM provisioning between Okta and your Quickbase realm.
Configure SAML 2.0 with Okta
Requirements
Before you begin:
You must be a Realm Admin
Your realm must be on a Quickbase Business or Enterprise plan
Supported features
The Okta/Quickbase SAML integration currently supports:
SP-initiated SSO
IdP-initiated SSO
JIT (Just-In-Time) Provisioning
Configure the Quickbase integration
As an Okta Administrator, navigate to Applications and select Browse App Catalog.
Search for Quickbase and select Add.
On General Settings:
Enter an application label.
Enter your realm name as the subdomain.
Select Next.
On the Sign-On Options tab, select SAML 2.0.
Scroll down and select Done.
On the Sign-On tab:
Navigate to the Metadata URL.
Save the XML as an
.xmlfile.Copy the Sign-on URL.
Download the signing certificate.
In your Quickbase Admin Console, navigate to the SAML Authentication tab and select Configure SAML.
Complete the configuration:
Upload the metadata file.
Upload the signing certificate.
Paste the Sign-on URL.
Optional: Enter a support page URL for your internal help page.
For Entity ID, enter your realm's fully qualified domain name (FQDN).
Leave Provider name unchanged.
Select Submit.
Important
The email addresses for your users must match in both Quickbase and Okta.
If you have questions about this configuration, contact Quickbase Technical Support.
Configure SCIM with Okta
Requirements
Before you begin:
You must be a Realm Admin
Your realm must be on a Quickbase Business or Enterprise plan
Complete the SAML 2.0 configuration by following Configure SAML 2.0 with Okta
Create a user token for a realm admin
Supported features
Create new users—New users created through Okta are also created in your Quickbase account/realm.
Update user attributes—Updates made to the user's attributes through Okta are pushed to your Quickbase account/realm.
Deny access—Denying a user in Okta removes their access to your Quickbase realm.
Restore access—Restoring a user in Okta restores their access to your Quickbase realm.
Create groups—New groups created and pushed through Okta are also created in your Quickbase account/realm.
Add users to groups—Users added to the pushed group through Okta are also added to the group in your Quickbase account/realm.
Remove users from groups—Users removed from the group through Okta are also removed from the group in your Quickbase account/realm.
Delete groups—Groups deleted through Okta are removed from your Quickbase account/realm.
Update group name—Updates made to the pushed group name through Okta are pushed to your Quickbase account/realm.
Push groups—Push groups created in Okta pushes the group and all of its members to your Quickbase account/realm.
Configure SCIM Provisioning
After you complete the Quickbase integration, open the Provisioning tab.
Select Enable API Integration.
Paste the realm administrator's user token.
Select Test API Credentials.
After the test succeeds, select Save.
Open the To App tab and enable:
Create Users
Update User Attributes
Deactivate Users
Select Save.
Add users to your application
With SAML 2.0 and SCIM configured, you can add users to your Okta application using these methods:
Add each user individually
Add users through groups
All added users are provisioned in Quickbase and can sign into Quickbase using SSO.
Groups assigned through Okta are pushed to Quickbase and appear on the Groups tab in the Admin Console as managed by Okta.
Assign users individually
On the Assignments tab, select Assign.
Select Assign to People.
Assign users through groups
On the Assignments tab, select Assign.
Select Assign to Groups.
User removal and deprovisioning with Okta
Quickbase supports user deprovisioning through SCIM for Okta.
When a user is deactivated or removed in Okta, SCIM automatically removes that user's access to your Quickbase realm.
Important
If SCIM is enabled, deprovisioning/denial must be managed in Okta. Removing SCIM-provisioned users directly in the Quickbase Admin Console is disabled to ensure Okta remains the single source of truth.
Restrictions
The maximum length for user first name, last name, email, and username is 255 characters.
Spaces are not allowed in username and email values.
When pushing a group, Quickbase does not support linking existing groups that were created in Quickbase to groups that were created in Okta. When requesting Refresh App Groups in Okta, Quickbase returns the groups that were provisioned in Okta, but excludes any groups that were created in Quickbase. As a result, the Quickbase groups are not listed in Link Group.
When using Push Now to resynchronize a group, any Quickbase users (users who were added to the group in Quickbase) are not affected in the Quickbase group. Okta manages only users who were provisioned through Okta.
Importing users and groups from Quickbase to Okta is not recommended.
Troubleshoot
To troubleshoot errors with provisioning, read Troubleshooting IdM provisioning in the Quickbase API Guide.
If you still need help, contact Quickbase Technical Support.