Peerbound x Okta Integration Instructions

These instructions are for Okta admins working to connect Peerbound to your company’s Okta SSO.

Creating the Okta app

1. In your Okta tenant create an Okta OIDC app integration

2. Select OIDC as the Sign-in method.

3. Select Web application as the Application type, and set the following parameters

Name: Peerbound
Sign-In Redirect URIs: https://auth.peerbound.com/login/callback

Trusted Origins: https://auth.peerbound.com

Audience URI: https://app.peerbound.com/api/ (may not be required)

4. Record the Client ID and Client Secret that Okta generates for your app integration.

5. Securely provide Client ID and Client Secret to Peerbound. Also share your Okta domain (e.g., {yourcompany}.okta.com).

Provisioning users with SCIM

SCIM allows you to provision and deprovision all users directly in Okta. After completing the above setup to establish a connection between Peerbound will provide you with a SCIM token. With that token, you can now configure SCIM in Okta:

1. Register a second application in the Okta portal by selecting Applications > Browse App Catalog, search for (OAuth Bearer Token) Governance with SCIM 2.0, and select Add Integration. Set an Application label, check Application Visibility, uncheck Browser plugin auto-submit, then select Next and Done.

2. From the integration’s settings page, select the Provisioning tab, then Configure API Integration. Check Enable API Integration. Enter the Base URL and OAuth Bearer Token provided by the Peerbound team. Be sure to remove any trailing forward slash from the URL.

3. Still on the Provisioning tab, in the To App subtab, select Edit next to Provisioning To App, select Edit. Enable only: Create Users, Update User Attributes, and Deactivate Users. Uncheck Set password when creating new users, then select Save.

4. Under Attribute Mappings, use the X button to delete these lines, which can cause issues during PUT operations:

   • Primary email type

   • Primary phone type

   • Address type

Once you have this configured, we recommend you validate both provisioning and deprovisioning a user. Note that deprovisioning a user with SCIM will not immediately end an active user session. However, the user will not be able to log in again or refresh the current session. Therefore, to test deprovisioning, you should log out and then validate that you cannot log back in with the deprovisioned account.

Assigning roles with SCIM

Peerbound has four roles:

• Admin: web access and MCP access; can manage API keys

• Creator: web access and MCP access

• Reader - Anonymized: read-only MCP access

• Reader - Deanonymized: read-only MCP access, including ability to read the identity of “Approved - Anonymous” moments

These roles can be assigned using Okta groups.

1. Create a new Okta group for each role you want to assign users in Peerbound. We recommend giving these groups names starting with “Peerbound”. For example, “Peerbound - Creator” and “Peerbound - Reader”.

2. Assign each Okta user to the appropriate group. This can be done manually user-by-user or a group rule can be used to assign group membership based on another condition (like Department).

3. In the Okta Application you created for Peerbound SCIM, go to the Push Groups tab, and add the groups you just created for Peerbound.

4. Let your Peerbound CSM know what group names you used and how these should be mapped to the Peerbound roles mentioned above. Once they have configured the mapping in Peerbound, validate that changing group assignments in Okta has the expected impact on user permissions.