Integrate CXone Mpower and IdP with SCIM

You can integrate your CXone Mpower system with any IdP for use with SCIM. If you're integrating with Okta using the app registration method, use the instructions on the Okta integration page. The steps on this page will also enable you to integrate with Okta.

Generate Access Keys

This process requires you to set up an access key. This means creating a new role and employee profile dedicated to the authentication.

1. In CXone Mpower, click the app selector and select Admin.

2. Add a new role for the access key.

   1. Go to Security > Roles and Permissions.

   2. Click New Role.

   3. Give the role a descriptive name. For the use case described previously, you might call it SCIM Access Key.

   4. Click the Permissions tab. Select the Admin tab on the left and enable the Employees Create and Edit permissions. The View permission will be automatically enabled.

   5. Click Save & Activate.

3. Create a new employee profile for the access key:

   1. Click the app selector and select Admin.

   2. Click Employees.

   3. Click Create Employee.

   4. Give the employee profile an email address you own so that you can activate the employee account later.

   5. Give the employee profile a descriptive first and last name. For example, SCIM AccessKey.

   6. In the Primary Role drop-down, assign the employee to the role you just created.

   7. In the Attributes drop-down, clear all checkboxes so you aren't charged for the account.

   8. Click the Security tab and select a Login Authenticator.

   9. Click Create.

4. In the Employees table, find and click the new employee profile you created to open it.

5. Click the Security tab.

6. Under Access Keys, click Add access key.

7. Copy the Access Key ID and paste it somewhere you can save it.

8. Click (SHOW SECRET KEY).

9. Copy the Secret Access Key and paste it where you want to save it. If you ever lose the secret key, you'll need to create and share a new one.

10. Click Save.

11. In the Employees table, click Invite next to the new employee profile you created.

12. When you receive the account activation email, follow the instructions in the email to activate the account.

13. Share the access key only with users you want to use the service.

Generate a Bearer Token

When you generate a bearer token, you must select a user profile to attach it to. Any changes made using this token will be credited to this user. You can grant separate tokens to each user you want to be able to make changes using SCIM, or you can have multiple users share one token. When you create a bearer token, you can only see the token once for security purposes. The token is scoped specifically and exclusively for SCIM APIs. It doesn't grant access to any other APIs or services.

1. In CXone Mpower, click the app selector and select Admin. Go to Tenant Configuration > Account Settings.

2. Scroll down to the SCIM Token section.

3. From the User drop-down, select the user profile you want to be able to use the bearer token. Click Generate.

4. Hover over Show Token and click Copy.

5. Save the token somewhere safe. You won't be able to retrieve the token again after you leave this page.

6. Click Save.

Set the SCIM Settings

1. Open your IdP application. Use these guidelines to set up the integration:

   • The base URL for the connection differs based on region. It follows this format: https://(region)nice-incontact.com/scim/v2. For example, the base URL for the NA1 region is https://na1.nice-incontact.com/scim/v2. If you are using a bearer token, the URL must also include /oauth before /scim. For example, https://na1.nice-incontact.com/oauth/scim/v2.

   • The unique identifier for CXone Mpower users is the username.

   • The IdP needs to support pushing new users and pushing updates to existing users, updating user attributes, and deactivating users.

   • The authentication type is OAuth 2.

   • The access token endpoint URI is:

     • https://cxone.niceincontact.com/auth/token for standard configurations.

     • https://cxone-gov.niceincontact.com/auth/token for FedRAMP configurations.

   • The authorization endpoint URL is: 

     • https://cxone.niceincontact.com/auth/authorize?scope=openid for standard configurations.

     • https://cxone-gov.niceincontact.com/auth/authorize?scope=openid for FedRAMP configurations.

2. Where required, enter the access key ID and secret access key pair and bearer token you saved earlier.

3. Save your settings.

4. Follow your IdP's instructions for initiating authentication with CXone Mpower.