# OAuth Authentication for SCIM Provisioning **URL:** \ **Category:** SCIM\ **Created:** [November 16, 2018, 9:25pm UTC](https://devforum.okta.com/t/oauth-authentication-for-scim-provisioning/3389 "2018-11-16T21:25:06Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dcardozo](https://avatars.discourse-cdn.com/v4/letter/d/3be4f8/32.png) [@dcardozo](https://devforum.okta.com/u/dcardozo)\ **Post date:** [November 16, 2018, 9:25pm UTC](https://devforum.okta.com/t/oauth-authentication-for-scim-provisioning/3389/1 "2018-11-16T21:25:06Z")
Hello, The Authentication section of the SCIM Provisioning [documentation](https://developer.okta.com/standards/SCIM/#authentication) contains the following regarding OAuth 2.0 Authorization Code Grant Flow: > After a user successfully authorizes Okta using OAuth 2.0, the authorization server of your app will redirect the user back to Okta with either an authorization code or access token. [RFC 6749 - Authorization Code Grant](https://tools.ietf.org/html/rfc6749#section-4.1) indicates the client (i.e. Okta) passes the authorization code and authenticate in order to get the access code: > (D) The client requests an access token from the authorization > server’s token endpoint by including the authorization code > received in the previous step. When making the request, the > client authenticates with the authorization server. The client > includes the redirection URI used to obtain the authorization > code for verification. If my authorization server returns an authorization code to Okta 1. How would Okta authenticate with my authorization server when requesting the access token? What credentials are required between Okta (client) and my authorization server? 2. Are refresh tokens supported when using OAuth 2.0 for SCIM provisioning? Thank you in advance for your time, David. ---
**Author:** ![dcardozo](https://avatars.discourse-cdn.com/v4/letter/d/3be4f8/32.png) [@dcardozo](https://devforum.okta.com/u/dcardozo)\ **Post date:** [November 30, 2018, 9:14pm UTC](https://devforum.okta.com/t/oauth-authentication-for-scim-provisioning/3389/2 "2018-11-30T21:14:24Z")
In my original posting above, is Okta acting as an [OAuth client](https://tools.ietf.org/html/rfc6749#section-1.1)? If true, how does Okta authenticate with my own authorization server? Thanks, David. ---
**Author:** ![pradab](https://avatars.discourse-cdn.com/v4/letter/p/dec6dc/32.png) [@pradab](https://devforum.okta.com/u/pradab)\ **Post date:** [October 17, 2019, 7:25am UTC](https://devforum.okta.com/t/oauth-authentication-for-scim-provisioning/3389/3 "2019-10-17T07:25:26Z")
Hi David, Did you manage to get the answers of the questions? If yes, also how would OKTA manage the expiry of Access Token provided? ---
**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\ **Post date:** [October 18, 2019, 1:27am UTC](https://devforum.okta.com/t/oauth-authentication-for-scim-provisioning/3389/4 "2019-10-18T01:27:41Z")
Hi @dcardozo @pradab 1. How would Okta authenticate with my authorization server when requesting the access token? What credentials are required between Okta (client) and my authorization server? When using “SCIM 2.0 Test App (OAuth Bearer Token)”, you will need to manually specify the access token. Okta will use the JWT as authorization header for each call that it performs to your SCIM server. If you are integrating the application in Okta Integration Network (OIN) through [oinmanager.okta.com](http://oinmanager.okta.com), you will need to provide a client ID and client secret. Using this details, Okta will perform an authorization code flow with your authorization server and retrieve an access token that will be used to further communicate with the SCIM server. This Okta administrator will see this process under Provisioning tab as "Sign in with ". 1. Are refresh tokens supported when using OAuth 2.0 for SCIM provisioning? If the application is integrated in OIN, then yes, refresh tokens are supported in order to retrieve a new access token automatically and prevent interrupting the provisioning flow. ---
**Author:** ![ksarmanov](https://avatars.discourse-cdn.com/v4/letter/k/f17d59/32.png) [@ksarmanov](https://devforum.okta.com/u/ksarmanov)\ **Post date:** [February 10, 2020, 12:08pm UTC](https://devforum.okta.com/t/oauth-authentication-for-scim-provisioning/3389/5 "2020-02-10T12:08:37Z")
Hi @dragos Does server need to provide **Client ID** and **Client Secret** per OKTA tenant or will it be used for all tenants in OKTA? Thanks ---
**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\ **Post date:** [February 26, 2020, 6:29am UTC](https://devforum.okta.com/t/oauth-authentication-for-scim-provisioning/3389/6 "2020-02-26T06:29:24Z")
Hi @ksarmanov This depends on how you will deploy the configuration for your application. Ideally, the best solution would be to have separate client IDs and client secrets per tenant and for the mutual customer to authenticate and get authorized by the authorization server on your side in order to pass the bearer token to Okta. This would be in short how the Sign In with _App_ feature works. ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [January 24, 2024, 7:41pm UTC](https://devforum.okta.com/t/oauth-authentication-for-scim-provisioning/3389/7 "2024-01-24T19:41:19Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.