Okta SCIM provisioning for JetBrains Hub: token, base URL, and syncing user updates – Support | JetBrains

Problem

User profile attributes (including name/display name changes) are not synchronized as expected when using Okta provisioning with JetBrains Hub.

Cause

SCIM provisioning was not configured correctly. For synchronization to work, the SCIM integration requires a Hub token from an admin-level account (or a dedicated service account with admin permissions), and the SCIM base URL must point to the Hub instance.

Resolution

Enable SCIM Provisioning in Okta
- Configure SCIM provisioning with the SCIM base URL: https:///api/rest/scim2, ensuring it's the Hub URL rather than the IDE Services URL.
- Log into JetBrains Hub with an admin account or create a dedicated service account with admin permissions.
- Generate a Permanent Token under the admin/service account's profile in Hub.
- In Okta under Integration → Authorization (HTTP Header) for SCIM, input this token without a Bearer prefix.
Push Updates via SCIM Integration
- Ensure the following provisioning options are selected in the Okta provisioning app:
  - Create Users
  - Update User Attributes
  - Deactivate Users
- Run a manual synchronization or wait for the scheduled sync to propagate updated user information to Hub.
Update Existing Users
- Existing user profiles may not update automatically. A logged-in user can perform a full logout of IDE Services and log back in to trigger the provisioning sync.
- Alternatively, simulate a small change to the user's profile in Okta followed by saving to trigger an attribute update.

Verification

Confirm that changes in Okta user attributes are propagated to Hub for newly provisioned users.
If existing profiles require manual intervention, consider using the user account merging functionality to unify duplicate accounts created before provisioning was configured correctly.

Additional Recommendations

Periodically review SCIM permissions and token validity to ensure provisioning remains stable.