The Okta System for Cross-domain Identity Management (SCIM) template features a default roles attribute that lists roles in an array format.

Administrators configure multi-value roles for role-based access in downstream applications by creating custom claim attributes and mapping them to the SCIM application to generate the following JSON output containing the licensed user and group administrator roles.

"urn:ietf:params:scim:schemas:core:2.0:User": {
        "roles": [
            {
                "type": "LICENSED_USER",
                "value": "LICENSED_USER"
            },
            {
                "type": "GROUP_ADMIN",
                "value": "GROUP_ADMIN"
            }
        ],
      },

• Okta Identity Engine (OIE)
• Okta Classic Engine
• System for Cross-domain Identity Management (SCIM) Cloud Provisioning

What steps add multi-value roles in a SCIM cloud integration?

Create a custom claim attribute in the Okta user profile, configure a custom attribute on the SCIM application, and map the attributes to test the downstream provisioning.

1. Navigate to Profile Editor and select User (default) to create a custom claim attribute in the Okta user profile.
   
2. Navigate to Profile Editor and select the SCIM application to create a custom attribute.
3. Add roles.^[type=='LICENSED_USER'].value for the external user and urn:ietf:params:scim:schemas:core:2.0:User for the external namespace.
    
4. Navigate to Mappings and select Okta User to SCIM App to map the attribute from Okta to the SCIM application.
5. Map the attribute using the (user.licensedUser == 'true') ? 'LICENSED_USER' :'' expression and save the mappings.
   
6. Set the attribute in the user profile to true and select the Preview tool under Mappings to verify that the attribute maps correctly.
   
   
7. Verify that the attribute sends downstream to the SCIM application correctly.
   

NOTE: Ensure that the downstream application sends both type and value as a response back to Okta. Okta requires these values, specifically type, to perform a look-up on roles when updating or deleting roles.

Related References

• How to Pass multi-value attributes
• SCIM FAQ