SCIM

OpenIAM provides a out of the box SCIM connector to simplify integration with applications which support the SCIM standard for user life cycle management. A default "Managed System" configuration has been provided to simplify the configuration process. This configuration has been part of the out of the box (OTB) configuration since version 4.1.8.

Unless you are familiar with OpenIAM, we recommend that you leverage the OTB configuration and modify it to suit your needs.

The steps provided below, assume that you are creating a new configuration and not leveraging the existing configuration.

Connector Registration

Before you can use the SCIM connector, ensure that the connector has been registered with the OpenIAM application. Normally, the SCIM connector is installed as part of the installation process. You can validate the connector has registered by doing the following:

  • Goto the Webconsole -> Provisioning -> Connectors
  • Search for SCIM

You should see an entry in the list. If you don't, then follow the step below to register the connector

  • Goto the Webconsole -> Provisioning -> Connectors
  • Click on Create new connector as shown in the image below

SCIM connector registration queue

Complete the form as described in the table below

Field nameDescriptionRecommended Value
Connector NameName of the connector. The can be any user friendly nameSCIM Connector
Metadata GroupingConnectors are part ofa metadata group which is used internallyConnector Type
Metadata Type nameThe metadata type is used to define attributes and configurationScim Connector
Connector QueueName of the RabbitMQ message queue which will be used by the connector to communicate with the other OpenIAM ServicesSCIM_Connector_1
  • Next define the configuration parameters which will be used by the connector by using the Connector configuration menu on the sidebar. The following options should be enabled for the SCIM connector
Parameter NameIs required
Add object rule
Delete object rule
Modify object rule
Password rule
Test connection object rule
Search object rule
Resume object rule
Suspend object rule
Object primary key for userY

Add the following Custom Fields:

Custom field NameField type
AUTH_TYPECombo box
TOKENText field
SCIM_VERSIONCombo box
TOKEN_TYPECombo box

Define the Managed System Configuration

After the connector has been registered, you will need to define a Managed System configuration. The managed system configuration will:

  • Tell the connector how to connect to the end application using SCIM
  • Determine which attributes will be Managed by OpenIAM during the provisioning / de-provisioning process

To configure a managed system, do the following:

  • Goto Webconsole -> Provisioning -> Managed System
  • Click on Create Managed System

Complete the form as described below.

Field nameDescriptionValue
ConnectorThis is the name of the connector as described above during the registration processSCIM Connector
Managed system nameDescriptive name to represent this configuration[ User defined ]
ActiveCheckbox to indicate if this configuration is active. If its unchecked, the connector will not communicate with the end application
Host URLURL of the SCIM interface on the end application: eg. https://api.atlassian.com/scim/directory/[ tenant id]
Login IDIf the Authentication type is Token, Login Id is not needed as this will be replaced by the authentication token0001
PasswordIf the Authentication type is Token, Password is not needed as this will be replaced by the authentication token
Authentication typeIndicates the type of authenticationToken
TokenValue of the authentication tokenToken
SCIM VersionVersion of the SCIM interface being used by the target application1.0 or 2.0
Token TypeType of authentication token being usedBearer

Examples

The images below show how to configure the SCIM connector for two popular SaaS solutions: Slack and Atlassian. The tokens have been blurred out for security reasons

Slack

SCIM connector Slack

Atlassian

SCIM connector Atlassian configuration