Prerequisites
- A RansomLeak tenant with admin access
- The "Manage Integrations" permission
- Okta super admin or app admin rights
Your tenant is reachable at https://<your-subdomain>.ransomleak.com. Replace
<your-subdomain> with your own subdomain throughout this guide. For help
during setup, email support@ransomleak.com.
RansomLeak is published in the Okta Integration Network. In Okta, open Applications → Browse App Catalog, search for RansomLeak, and add the integration. Provisioning is configured on that app, as described below.
Supported features
- Create users
- Update user attributes
- Deactivate users
- Group push (groups map to roles)
- Team & manager sync
Provisioning is one-directional. Okta is the source of truth and pushes changes into RansomLeak. RansomLeak does not import users or profile updates back into Okta, so leave Import New Users and Import Profile Updates turned off on the Okta app.
Get your SCIM credentials in RansomLeak
-
Sign in to
https://<your-subdomain>.ransomleak.comas a tenant admin. -
Go to Admin → Tenant Settings → SCIM.
-
Click Generate Token and confirm in the dialog. RansomLeak shows your SCIM bearer token and base URL:
Base URLhttps://<subdomain>.ransomleak.com/scim/v2 -
Copy the token now, it is shown only once. Generating a new token invalidates the previous one. Store it securely; you will paste it into Okta next.
Configure Okta
-
If you have not added it yet, go to Applications → Browse App Catalog, search for RansomLeak, and click Add Integration. On the General Settings screen, enter your Subdomain — the part of your RansomLeak URL before
.ransomleak.com(for example,acmeforhttps://acme.ransomleak.com) — and click Done. -
Open the RansomLeak app in Okta and go to the Provisioning tab.
-
Click Configure API Integration and enable it. In the API Token field, paste the SCIM token you copied from RansomLeak.
Enter the raw token only — do not add a
Bearerprefix. The Okta app adds it automatically. The base URL and authentication scheme are pre-configured by the RansomLeak OIN app template, so you do not need to set them. -
Click Test API Credentials, then Save.
-
Under Provisioning → To App, enable:
- Create Users
- Update User Attributes
- Deactivate Users
-
On the app's Sign On tab, set Application username format to Email. RansomLeak's SCIM
userNameis an email address, so this keeps the provisioned account aligned with the user's sign-in identity. -
Assign users or groups to the RansomLeak app. Okta provisions them into RansomLeak.
Attribute mapping
Map the core attributes below. RansomLeak also reads optional attributes, including the SCIM enterprise extension, to populate job titles, teams, and the reporting line, which power team-based and manager-based reporting.
Core attributes
| Okta attribute | SCIM attribute | Populates in RansomLeak |
|---|---|---|
| userName | userName | Email / login |
| Email (primary) | emails[type eq "work"].value | |
| First name | name.givenName | First name |
| Last name | name.familyName | Last name |
| Display name | displayName | Display name |
Teams, managers, and job titles
These come through the standard SCIM enterprise extension
(urn:ietf:params:scim:schemas:extension:enterprise:2.0:User), which Okta sends from
its built-in Department and Manager profile attributes.
| Okta attribute | SCIM attribute | Populates in RansomLeak |
|---|---|---|
| Title | title | Job title |
| Department | …:enterprise:2.0:User:department | Team (created automatically if the name is new) |
| Manager | …:enterprise:2.0:User:manager | Reporting line, used to build your org hierarchy |
RansomLeak creates a team from the department name when it does not exist yet, and links each user to their manager by external ID. If a manager is provisioned after their reports, RansomLeak backfills the reporting line automatically once the manager arrives.
Group push
RansomLeak Groups correspond to tenant roles. Use Okta Push Groups to align an Okta group with a RansomLeak role; pushing the group assigns that role to its members. Group create, update, and delete are supported — see the note on deletion below.
For a user to receive a role through Group Push, they must be both assigned to the RansomLeak app and a member of the pushed group in Okta. A user who is only in the group, or only assigned to the app, will not receive the role until both are true.
Deleting a group. A pushed group must be empty before it can be removed.
Before you unlink or delete a pushed group in Okta (Push Groups → Unlink pushed
group → Delete the group in the target app), first remove all members from the
Okta group and let that change sync — otherwise RansomLeak returns
Cannot delete group with N member(s). Remove all members first. Unlinking an
empty group removes the group→role link but keeps the RansomLeak role itself (roles can
be shared with local users and other integrations); to remove the role entirely, delete it
in RansomLeak under role settings.
Troubleshooting
| Symptom | Fix |
|---|---|
| Test credentials fail |
Confirm you pasted the current SCIM token into the
API Token field, with no extra spaces. Enter the raw token only —
Okta adds the Bearer prefix automatically. If it still fails, regenerate
the token in RansomLeak and update it in Okta.
|
| 401 after it previously worked | The token was regenerated or revoked in RansomLeak. Generate a new one and update Okta. |
| Deactivation not reflected | Ensure Deactivate Users is enabled under Provisioning → To App. |
| "Cannot delete group with N member(s)" | RansomLeak won't delete a role that still has members. Remove all members from the Okta group (and let the change sync) before unlinking or deleting the pushed group. |
Need a hand?
Email support@ransomleak.com and we will help you connect Okta to your tenant.