SCIM Provisioning Integration on AuthOS Docs | Auth Operating System API and SDK Guides

SCIM Concepts and Shared Setup

Mon, 01 Jan 0001 00:00:00 +0000

AuthOS SCIM is Beta. The examples describe implemented paths, not certification or guaranteed interoperability with every identity-provider release.

What is SCIM?

SCIM (System for Cross-domain Identity Management) is an industry-standard protocol for automating user lifecycle management. With SCIM, your identity provider (IdP) can:

Automatic Provisioning: Create users when added to the directory
Profile Sync: Update user information when changed in the IdP
Deprovisioning: Deactivate or remove users when they leave
Group Management: Synchronize group memberships across systems

Prerequisites

Before setting up SCIM provisioning:

Configure SCIM with Okta

Mon, 01 Jan 0001 00:00:00 +0000

This Beta recipe reflects the documented provider flow but is not evidence of certification or interoperability with every provider release. Test it in a non-production tenant before rollout.

Okta Integration

1. Create SCIM Token

Follow Step 1 above to generate a SCIM token.

2. Configure Okta Application

Log into Okta Admin Console
Navigate to Applications → Select your application
Click the Provisioning tab
Click Configure API Integration

3. SCIM Connection Settings

Configure the following settings:

Configure SCIM with Microsoft Entra ID

Mon, 01 Jan 0001 00:00:00 +0000

This Beta recipe reflects the documented provider flow but is not evidence of certification or interoperability with every provider release. Test it in a non-production tenant before rollout.

Microsoft Entra ID Integration

1. Create SCIM Token

Follow Step 1 above to generate a SCIM token.

2. Configure Azure AD Provisioning

Log into Azure Portal
Navigate to Azure Active Directory → Enterprise Applications
Select your application
Click Provisioning in the left sidebar
Click Get started

3. Provisioning Configuration

Set the following:

Configure SCIM with OneLogin

Mon, 01 Jan 0001 00:00:00 +0000

This Beta recipe reflects the documented provider flow but is not evidence of certification or interoperability with every provider release. Test it in a non-production tenant before rollout.

OneLogin Integration

1. Create SCIM Token

Follow Step 1 above to generate a SCIM token.

2. Configure OneLogin Application

Log into OneLogin Admin Portal
Navigate to Applications → Select your application
Click the Provisioning tab
Click Enable provisioning

3. SCIM Configuration

Configure the following:

Validate SCIM Provisioning

Mon, 01 Jan 0001 00:00:00 +0000

Run these checks in staging after completing one provider recipe. Successful smoke tests do not establish SCIM compliance or general provider interoperability.

Step 3: Verify Provisioning

After configuring your identity provider, verify that provisioning works correctly.

Manual Verification

Check User Creation

// List all users in the organization
const users = await sso.organizations.listUsers('acme-corp');

// Check if a specific user exists
const specificUser = users.find(u => u.email === 'newuser@example.com');
console.log('User provisioned:', specificUser ? 'Yes' : 'No');

Monitor SCIM Token Usage

// List SCIM tokens to check last usage
const { tokens } = await sso.organizations.scim.listTokens('acme-corp');

tokens.forEach(token => {
  console.log(`Token: ${token.prefix}`);
  console.log(`Last used: ${token.last_used_at || 'Never'}`);
  console.log(`Expires: ${token.expires_at || 'Never'}`);
});

Testing Scenarios

Test 1: User Creation

Add a new user to your IdP
Assign them to the SSO application
Wait for sync cycle (1-40 minutes depending on IdP)
Verify user exists in AuthOS

Test 2: User Update

Change a user’s email or name in IdP
Wait for sync
Verify the change reflects in AuthOS

Test 3: User Deactivation

Suspend or remove a user from the application in IdP
Wait for sync
Verify user is deactivated (not deleted) in AuthOS

// Check user's active status
const user = await sso.organizations.getUser('acme-corp', 'user-id');
console.log('User active:', user.deleted_at === null);

Test 4: Group Membership

Create a group in IdP and assign users
Assign the group to the SSO application
Verify all group members are provisioned

Monitoring Best Practices

Track Token Usage

// Monitor SCIM token usage weekly
async function auditScimTokens(orgSlug: string) {
  const { tokens } = await sso.organizations.scim.listTokens(orgSlug);

  for (const token of tokens) {
    const daysSinceUsed = token.last_used_at
      ? Math.floor((Date.now() - new Date(token.last_used_at).getTime()) / (1000 * 60 * 60 * 24))
      : Infinity;

    if (daysSinceUsed > 7) {
      console.warn(`Token ${token.prefix} not used in ${daysSinceUsed} days`);
    }

    if (token.expires_at) {
      const daysUntilExpiry = Math.floor((new Date(token.expires_at).getTime() - Date.now()) / (1000 * 60 * 60 * 24));
      if (daysUntilExpiry < 30) {
        console.warn(`Token ${token.prefix} expires in ${daysUntilExpiry} days`);
      }
    }
  }
}

Monitor Provisioning Events

Review organization audit logs for SCIM activity:

Troubleshoot SCIM Provisioning

Mon, 01 Jan 0001 00:00:00 +0000

Start with the identity provider’s provisioning log and correlate failures with AuthOS organization and token activity. Do not expose a SCIM bearer token in logs, screenshots, or support messages.

Monitoring and Troubleshooting

Common Issues

Issue: “Invalid SCIM token” Error

Symptoms: IdP reports authentication failure

Solutions:

Verify token was copied completely (including scim_live_ prefix)
Check token hasn’t expired
Ensure token belongs to the correct organization
Verify HTTPS is used (HTTP will fail authentication)

Issue: Users Not Provisioning

Symptoms: Users assigned in IdP but not appearing in AuthOS