Integrating Lucid with Okta enables your users to authenticate using SAML single sign-on through Okta. Furthermore, our SCIM integration allows admins to create users and provision and deprovision users within Okta itself, without having to sign in to Lucid. The following tutorial walks through the process of integrating Okta with Lucid. You will need admin privileges in both Okta and Lucid to complete this integration.

This integration is only available to Enterprise accounts. See the Upgrade your Lucid account article for instructions to upgrade.

Configure the SAML integration for Lucid

Follow the below instructions exactly regardless of whether you are using Lucidchart, Lucidspark, or both.

In Okta:

Browse the Okta Integrations Network and search “Lucid”.
- After you have added the Lucid app to Okta, you can configure the SAML integration so that end users on your Okta instance can authenticate using SAML sign-on through Okta. Use the Lucid app shown below for all new features and updates.
In the General Settings section of the Lucid app in Okta, select which Lucid apps you would like to display (Lucidchart and/or Lucidspark). Each will appear in your users app gallery to facilitate IDP initiated sign on.
In the Sign On tab of Okta, click Edit in the top right corner.
Select SAML 2.0 as the sign on method.
Enter your SAML domain name under Advanced Sign on Settings.
- Be sure to enter just your domain (rather than a full URL). For example, if your Sign in URL is https://lucid.app/saml/sso/helpcenterdemo.com, you can enter helpcenterdemo.com.
To access the Okta metadata, navigate to SAML Signing Certificates.
Click Actions.
Select View IDP metadata.
Download the metadata by right clicking on the tab that opens up and select Save As, and save as an XML file.
- This XML file (metadata) contains instructions that Lucid will need to communicate with Okta. You will upload the saved file to Lucid.

In Lucid:

Select Admin.
Click Security in the left-hand menu.
From the dropdown, select Authentication.
Select Configure to the right of the “Allow SAML authentication” option to navigate to your SAML Activation page in Lucid. You will not be able to enable SAML until you have populated your domain and uploaded metadata.
Under "Lucidchart Sign in URL," enter your Domain name.
- This must match what you entered in the Sign On section in Okta. Ensure the domain you are using is not already in use, which will cause the XML file to not upload properly.
Click Save Changes.
Scroll down on the SAML Activation page of Lucid and click Add Identity Provider to upload the XML file you downloaded from Okta.
- The metadata will populate the following fields:
Click Test SAML Connection to verify that Lucid is properly communicating with Okta.
- The connection will only work if the Lucid app has been assigned to your test user in Okta. You can assign the app to users in the Assignments section of the app page.
Navigate back to the Authentication page.
Check the box next to "Allow SAML authentication".
Click Save changes.

Note: You can select the Default Authentication method in Lucid, after you have checked the methods that you would like to allow as sign in options above. Users will be prompted to sign in using the default authentication you set up in the Authentication page.

Create users upon login with SAML

Once you have configured SAML with Okta for your Lucidchart account, you can set up Just-In-Time provisioning so that users assigned Lucidchart access in Okta who do not have a Lucidchart account will have an account created for them upon their first log in.

Note: For this provisioning to work you must have domain control enabled.

You can set up Just-In-Time provisioning in the License settings section of your Lucid admin panel.

If you would like all users to come onto your Lucidchart team with full-edit licenses, set the setting for “When a new user joins a team” to "Automatically grant license."
If you want all users to come in as limited-access users, set the setting for "When a new user joins a team"" to “Do not automatically grant.” Your users will then be able to request full-edit licenses. Depending on the “When a user requests a license” setting, you can have licenses be automatically granted to users upon their request, or you can have the requests turn into pending requests in your user list.

Note: We strongly recommend that you have a custom request dialog if you have users requesting licenses from an admin.

Configure License settings to assign licenses from Okta

If you want to assign licenses from Okta rather than within Lucid, you will need to configure your Lucidchart, Lucidspark, and Lucidscale settings in a specific way. Please go to your License settings and set up your settings as follows:

When a new user joins a team = Do not automatically grant license
When a user requests a license = Do not automatically grant license

Configure SCIM for the Lucid Suite in Okta

If you would like to create Lucidchart, Lucidspark, and Lucidscale users before their first log-in (and determine their license type) through Okta, you can set up the Lucid SCIM integration.

Before configuring SCIM, please do the following:

Confirm that you are on an Enterprise account with an up-to-date pricing plan. To upgrade, please see our pricing page.
Contact your Lucid Customer Success Manager or contact support to request that SCIM be enabled for your account.
Make sure that auto-upgrade is enabled in your Licensing settings. You will be unable to generate a bearer token to configure SCIM if this setting is not enabled. You may want to turn off auto-upgrade after generating a bearer token to prevent unwanted licensing during the configuration process.

Once you have followed the pre-configuration steps listed above, you can configure SCIM for the Lucid Suite in Okta by following these steps:

In Okta, go to your Provisioning tab and click Configure API Integration, and check the box next to "Enable API Integration". A text field will appear that you will populate with a code generated by Lucidchart (see next step).
Open Lucid in a new window and select Admin.
Select App integration in the left-hand menu.
Select the SCIM tile.
Click Generate token.
- Lucid will populate the "Bearer Token" text field with a unique code for you to share with Okta.
  
  After this step, you may want to disable the auto-grow setting in your Lucid licensing settings page to prevent unwanted licensing from taking place during the remainder of the configuration process. Once you have confirmed that your SCIM connection points are properly set up, you can re-enable auto-grow for user provisioning and licensing to take place.
Back in Okta, paste the bearer token generated by Lucid into the API token field.
Click Save.

Once the Lucid-Okta connection is established, you can select the integration points you would like to enable for SCIM and start using the SCIM connection to create users and assign licenses to them. See the sections below for further information.

Assign Lucid Suite licenses from Okta

The following steps only apply if you have been migrated to a Lucid Suite Enterprise account.

In order for Okta SCIM to properly update, add, or remove licenses, we recommend that there be only one Lucid Licensed group that determines licenses for both Lucidchart and Lucidspark. If using separate groups for Lucidchart and Lucidspark Licensed users, combine them into one Lucid Suite Licensed group.

Once this has been completed, and your SCIM connection has been made, set up Okta license provisioning by following these steps:

In the “Assignments” tab of the Lucid application in Okta, click Assign.
Select Assign to Groups.
Search the newly created group for all licensed users and click Assign.
Select Edit to customize the provisioning attribute settings for this group and set the Lucidchart_Licensed and Lucidspark_Licensed values to “true” for both.
Click Save.
Ensure that the Lucid Suite licensed group is listed first in priority. With the new Lucid Suite Licensed group in the first priority and all licensed users added to the group any remaining licensed user groups can be unassigned. If you have a limited-access group, that should stay assigned in the second priority.

Assign roles to users with SCIM

To define a user's role, you will use the strings "Team Admin" and "Billing Admin." To specify users as Team & Billing Admins, you will need to assign multiple roles to the users or groups rather than a single role with a concatenated string.

Manage groups with Group Push

Lucid now supports Group Push with Okta, which allows admins to push groups from Okta to Lucid as well as manage groups that were created in Lucid through Okta.

Learn more: For more information on Group Push, see Okta's documentation on Using Group Push and Enhanced Group Push.

If you would like to enable Group Push and your Lucid app is already set up with SCIM, you will have to re-authenticate to Lucid SCIM API. To do this, follow these steps:

Log in to your Okta org as an admin.
Open the Admin UI.
Open your Lucidchart app instance.
Go to the Provisioning tab.
On the Settings section, click Integration.
Click Edit.
Select Test API Credentials.
Click Save.

The new SCIM features should now be enabled for your Lucid app.

Migrate to the new Lucid App

Since we have both a Lucidchart and Lucid app, you will need to know how to migrate to the new Lucid app. To access the new SCIM attributes, even if you are currently using the Lucid app, you have to add a new instance of the Lucid App in your Okta org. If you already have an existing instance of the Lucidchart app or the Lucid app, follow the steps below to migrate from that old instance to a newly updated instance of the Lucid app.

Login to your Okta org as an Admin.
Open the Admin UI.
Click on Add Applications.
Add a new instance of Lucid.
Turn off all provisioning in your old app by disabling "Create Users," "Update User Attributes," and "Deactivate Users."
Configure the new application, including Provisioning - like “Create Users,” Update User Attributes,” and “Deactivate Users.”
- Provisioning should proceed without issues. If there is a “Not Found” on the discovery aspect, those users will need to be removed from the Okta app and re-added to force an External ID re-map.
After SCIM Provisioning has been enabled, go to the Import tab of your new app instance.
Click Import Now.
After the users from Lucid are downloaded, select the users you want created or linked in Okta.
Click Confirm Assignments.
A pop-up will appear asking if you would like to proceed with the assignment confirmation.
Click Confirm.
Go back to your Admin Dashboard.
Open your old app instance.
- This is the previous Lucidchart or Lucid app you added before adding a new one in step 4.
Go to the Provisioning tab.
Select Integration.
Click Edit.
Uncheck the box for “Enable API Integration”.
Click Save.
You must now deactivate and delete your old app instance and begin using the new app you added.

Note: If you were using SAML as the sign-on mode for your old Lucidchart or Lucid app instance, you will need to set up SAML on your new instance in Okta.

FAQ

What happens to documents when I delicense a user via SCIM?

When you delicense or delete a user via SCIM, you must transfer their documents to another user on your Enterprise account. This does not apply when deactivating users.
By default, the Account Owner will be the recipient of the documents that are automatically transferred upon delicensing or deleting a user. You can change the recipient of the transferred documents by navigating to the SCIM integration settings in the Admin Panel and selecting Modify default owner to the right-hand side of the email address. See the screenshot below for reference.

Clicking Modify default owner redirects you to the “Document & Folder Settings” page of the Admin Panel where you can change who the default document owner on your account is. Refer to Lucid admin panel: Documents and folders article for additional details.

change-recipient-of-documents-when-deleting-or-delicensing-users-via-SCIM.png

Related articles