Integrating Lucid with Okta enables your users to authenticate using SAML single sign-on through Okta. Furthermore, our SCIM integration allows admins to create users and provision and deprovision users within Okta itself, without having to sign in to Lucid. The following tutorial walks through the process of integrating Okta with Lucid. You will need admin privileges in both Okta and Lucid to complete this integration.

Free	Individual	Team	Enterprise	FedRAMP
				*

*To set up the SAML or SCIM integration for Okta on a Lucid GovSuite account, you will need to configure a custom app. For instructions, check out our SAML and SCIM guide: Enable custom app in Okta for Lucid's FedRAMP environment community post.

See the Upgrade your Lucid account article for instructions to upgrade.

Configure the SAML integration for Lucid

Follow the below instructions exactly regardless of whether you are using Lucidchart, Lucidspark, or both.

In Okta:

Browse the Okta Integrations Network and search “Lucid”.
- After you have added the Lucid app to Okta, you can configure the SAML integration so that end users on your Okta instance can authenticate using SAML sign-on through Okta.
In the General Settings section of the Lucid app in Okta, select which Lucid apps you would like to display (Lucidchart and/or Lucidspark). Each will appear in your users app gallery to facilitate IdP initiated sign on.
In the Sign On tab of Okta, click Edit in the top right corner.
Select SAML 2.0 as the sign on method.
Enter your SAML domain name under Advanced Sign on Settings.
- The SAML domain name is a domain specific to your company, which will be used for your account's Sign on/ACS URLs.
- Be sure to enter just your domain (rather than a full URL). For example, if your Sign on URL is https://lucid.app/saml/sso/helpcenterdemo.com, you can enter helpcenterdemo.com.
To access the Okta metadata, navigate to SAML Signing Certificates.
Click Actions.
Select View IdP metadata.
Download the metadata by right clicking on the tab that opens up and select Save As, and save as an XML file.
- This XML file (metadata) contains instructions that Lucid will need to communicate with Okta. You will upload the saved file to Lucid.

In Lucid:

Select Admin.
Click Security in the left-hand menu.
From the dropdown, select Authentication.
Select Configure to the right of the “Allow SAML authentication” option to navigate to your SAML Activation page in Lucid. You will not be able to enable SAML until you have populated your domain and uploaded metadata.
Under "Lucidchart Sign in URL," enter your Domain name.
- This must match what you entered in the Sign On section in Okta. Ensure the domain you are using is not already in use, which will cause the XML file to not upload properly.
Click Save Changes.
Scroll down on the SAML Activation page of Lucid and click Add Identity Provider to upload the XML file you downloaded from Okta.
- The metadata will populate the following fields:
Click Test SAML Connection to verify that Lucid is properly communicating with Okta.
- The connection will only work if the Lucid app has been assigned to your test user in Okta. You can assign the app to users in the Assignments section of the app page.
Navigate back to the Authentication page.
Check the box next to "Allow SAML authentication".
Click Save changes.

You have the option to use encrypted assertions for the identity providers you add for SAML to your Lucid account. To learn more, refer to our SAML overview article.

Note: You can select the Default Authentication method in Lucid, after you have checked the methods that you would like to allow as sign in options above. Users will be prompted to sign in using the default authentication you set up in the Authentication page.

Create users upon login with SAML

Once you have configured SAML with Okta for your Lucidchart account, you can set up Just-In-Time (JIT) provisioning so that users assigned Lucidchart access in Okta who do not have a Lucidchart account will have an account created for them upon their first login.

Note: For this provisioning to work you must have domain control enabled.

You can set up Just-In-Time provisioning in the License settings section of your Lucid admin panel.

If you would like all users to come onto your Lucidchart account with full-edit licenses, choose the following settings:
- Under the “Access eligibility” section, select Eligible for full access.
- Under “Customized eligibility criteria”, select Instant access.
If you want all users to come in as limited-access users, under the “Access eligibility” section select Only eligible for limited access.
- Your users will still be able to request full-edit licenses. Depending on the “When a user requests a license” setting, you can have licenses be automatically granted to users upon their request, or you can have the requests turn into pending requests in your user list.

Note: We strongly recommend that you have a custom request dialog if you have users requesting licenses from an admin.

Add user attributes via Just-in-Time (JIT) provisioning

JIT provisioning uses the SAML protocol to create a Lucid user when someone assigned Lucidchart access in your Okta instance logs in to Lucid for the first time. You can also configure SAML to send over additional attributes to Lucid for these users, such as the user's first name, last name, and email address.

Note: License values cannot be sent to Lucid via JIT provisioning. This means you can’t update, delete, or deactivate a user using JIT provisioning in Lucid since it only works during a user's first login. Any update, deletion, or deactivation must be done manually from the user management page of the Lucid admin panel.

Follow these steps to configure first name, last name, and email attributes:

Log into your Okta account.
Navigate to the Lucid app in Okta
Select the Sign on tab.
In the upper-right corner of the Sign On section, select Edit.
Click the arrow to the left of “Attributes (Optional)” to expand the menu.
Configure a user’s first name:
- Add a title to the name field. This value doesn’t have to match the Value dropdown section.
- In the name format field, select Unspecified from the drop-down list.
- Click on the drop-down menu beneath “Value”.
- Select user.firstName from the dropdown.
To add another field click Add Another.
Repeat the instructions from steps 8-9 for last name and email with the specified name field and value field expressed below:
- To add a user’s last name:
  - Add a title to the name field.
  - Select user.lastName from the Value field’s dropdown
- To add a user’s email:
  - Add a title to the email name field.
  - Select user.email from the Value field dropdown
After adding the user attributes described in these steps, you can expect your Okta page to look like this:
Scroll to the bottom of this inner window.
Click Save.

Now, when a user signs in for the first time and creates their Lucid account, they will have their first name, last name, and email address values properly set up.

Configure SCIM for the Lucid Suite in Okta

To create users before their first log-in through Okta, set up the Lucid SCIM integration by following the steps below.

Note: The instructions in this article for setting up SCIM are relevant if you are setting up SCIM for the first time on your Lucid Enterprise account. If you were already using SCIM prior to October 22nd, 2024, you need to migrate to the new organizational groups experience, refer to our Okta migration article for instructions.

Before configuring SCIM, please do the following in your Lucid account:

Confirm that you are on an Enterprise account with an up-to-date pricing plan. To upgrade, contact sales.
Contact your Lucid Customer Success Manager or contact support to request that SCIM be enabled for your account.
Make sure that auto-upgrade is enabled in your Licensing settings. You will be unable to generate a bearer token to configure SCIM if this setting is not enabled. You may want to turn off auto-upgrade after generating a bearer token to prevent unwanted licensing during the configuration process.

Once you have followed the pre-configuration steps listed above, you can configure SCIM for the Lucid Suite in Okta by generating a bearer token in Lucid and then using it in Okta.

Generate a bearer token in Lucid

Log in to Lucid as an account owner or account admin.
Select Admin from the menu to the left.
Select App integration in the left-hand navigation menu.
On the SCIM tile, select Settings.
Click Generate token.
- If Generate Token is not clickable, ensure the “Automatically upgrade account when no more licenses are available” option is checked in your License settings and try again.
Copy the bearer token.

Configure integration and use bearer token in Okta

Log into Okta as an admin.
Open the Admin UI.
Go to your Provisioning tab.
Click Configure API Integration.
Check the box next to "Enable API Integration".
- A text field will appear where you can add you code that was generated by Lucid.
Paste the bearer token generated by Lucid into the API token field.
Click Save.

Once the Lucid and Okta connection is established, you can select the integration points you would like to enable for SCIM and start using the SCIM connection to create users and assign licenses to them. See the sections below for further information.

Learn more: Improve team collaboration and tool recommendations in Lucid by setting up optional field mappings for title and department. To see the steps, read our Okta SCIM field mappings community post.

Set up an All users group

Follow these steps to set up an All users group in Okta.

Navigate to the “Assignments” tab of the Lucid application in Okta.
Click Assign from the top-left of the Assignments page.
From the dropdown options, select Assign to Groups.
From the “Filters” menu on the left-hand side, click Groups.
Search for your “All users” group.
- Having an All users group (which will most likely have a different name for your company) is important as it is typically used to assign all users at your company to this Okta application. This is what enables them to sign in and see the chiclets within the main Okta applications page.
Click Assign.

Note: Each user on your account should belong to the “All Users” group, regardless of which push group they may belong to following the license and delicense push group creation done in the next section.

Assign license and delicense groups via group push

Group Push in Okta allows admins to push groups from Okta to Lucid and manage Lucid organizational groups through Okta. These Okta push groups are also used to license and delicense users in Lucid.

To create new push groups that work with Lucid organizational groups, follow these steps:

Select the Push Groups tab from the menu at the top of the Lucid app page in Okta.
Click + Push Groups.
From the dropdown options, select Find groups by name.
We recommend customizing the following groups:
- A “Lucid Suite Licensed User” group: This group will be used to assign a user a license in Lucid based on their membership to the group.
  - Users assigned to this group cannot also be assigned to any other limited-access, read-only, or delicensing group since it is used to grant a license to a user.
- A “Lucid Suite Limited Access” group: This group will be used to delicense users from the Licensed User group to free up licenses for others to use.
  - Users assigned to this group cannot also be assigned to the “Licensed User” group since it is used to remove a license from a user.
Click Save & Add Another if you need to add another group.
Click Save when you’ve added your last group.

Note: A user can belong to only one organizational group and as a result, only one push group at a time. But you can have as many license and delicense user groups as you need.

View Okta push groups as organizational groups in Lucid

At this stage of the process, we recommend double-checking you see the expected Okta push groups as organizational groups in Lucid, which confirms the migration was successful. To access the organizational groups page in Lucid, follow these steps:

Navigate to the Lucid admin panel.
Select Groups from the left-hand navigation menu.
From the dropdown menu, click Organizational groups.

You can expect to see your Okta push groups as organizational groups on this page of the Lucid admin panel.

lucid-suite-scim-user-groups-visible-as-organizational-groups-in-lucid.png

Assign roles to users with SCIM

To define a user's role, you will use the strings "Team Admin" and "Billing Admin." To apply both admin roles to a user, you will need to assign multiple roles to the users or groups rather than a single role with a concatenated string.

Note: The strings above must match the capitalization expressed for these user roles. Keep in mind that in the Lucid admin panel, the team admin role has been renamed to account admin.

FAQ

What happens to documents when I delicense a user via SCIM?

When you delicense or delete a user via SCIM, you must transfer their documents to another user on your Enterprise account.
By default, the account owner will be the recipient of the documents that are automatically transferred upon delicensing or deleting a user. You can change the recipient of the transferred documents by navigating to the SCIM integration settings in the Lucid admin panel and selecting Modify default owner to the right-hand side of the email address. See the screenshot below for reference.

Clicking Modify default owner redirects you to the “Compliance settings” page of the admin panel where you can change who the default document owner on your account is. Refer to Lucid admin panel: Compliance settings article for additional details.

change-recipient-of-documents-when-deleting-or-delicensing-users-via-SCIM.png

Does JIT provisioning handle updates, deletions, and deactivations of users in Lucid?

No. JIT provisioning cannot update, delete, or deactivate a user in Lucid since it only works during a user's first login. That means any update, deletion, or deactivation must be done manually in the Lucid Admin Panel.

If you want to update users and allow for automation of deletes or deactivating users, you should use SCIM instead of Just-In-Time provisioning.

Resources

To learn more about this feature or to ask additional questions, explore the additional resources below. These resources are available in English only.

Community post

Instructions to update IdP metadata certificate (renew SSO cert)

Give feedback on this article

Have feedback about this article? Tell us about your experience here.

Related articles