Skip to main content

SCIM

Supported versions Supported versions

This connectivity package provides support for managing resources in any system that supports the SCIM 2.0 standard. The connector is based on the REST connector. See the REST section for the full description of tabs, fields, and configuration options. SCIM 2.0 connectivity supports both identity data and access rights.

Supported objects and operations​

In a provisioning context, the SCIM connector works the same way as the generic REST connector. By default, the SCIM 2.0 connectivity can perform the following operations:

ResourcePossible operations
UsersCreate, read, update, delete
GroupsCreate, read, update, delete
Add or remove users assignments

Minimum required permissions​

You need to have access to the SCIM 2.0 API, including relevant permissions.

Implementation notes​

Familiarize with the SCIM 2.0 standard, SCIM core schema, and the protocol specification:

  • General information on SCIM 2.0, see this link.
  • Overview, definitions, concepts and requirements, see this link.
  • Information on the SCIM core schema, see this link.
  • Information on the SCIM protocol specification, see this link.

SCIM 2.0 RFC 7643 defines attribute names as case-insensitive at the protocol level. The SCIM connector is built on the REST connector, which uses a case-sensitive JSONPath library to parse responses and resolve reference lookups. This means property names must be specified using the exact casing. A casing mismatch causes the connector to discard a valid response as a failed lookup.

Reusing the default attribute set across multiple systems​

The SCIM template provides a default attribute set (SCIM User) with a default set of attributes. When you onboard a system using the SCIM template, Omada Identity applies the template's default attribute list to it. This is an expected behavior of template-driven onboarding.

important

If you customize the SCIM User attribute set, that customization is shared by every system currently using that attribute set. Onboarding any new system from the SCIM template while it still targets the shared SCIM User attribute set resets that attribute set back to its template defaults (which means that this action removes your customizations).

Network requirements​

The following ports need to be open in firewalls:

Port numberProtocol
443HTTPS

Prerequisites​

To collect data from SCIM 2.0, construct a URL that contains the address of the SCIM server and the entity name that you want to collect. For example: https://mywebsite.com/scim/users