SCIM Provisioning Setup Guide
This guide outlines how to enable System for Cross-domain Identity Management (SCIM) to automate user provisioning and deprovisioning between your Identity Provider (IdP) and our application.
1. Retrieve API Credentials
To establish a connection, you first need to generate a unique SCIM endpoint and Bearer token.
- Navigate to Settings > Identity & Access.
- Locate the Provisioning via Identity Provider (SCIM) section.
- Copy the SCIM Base URL and API Token.
:::info Note: Keep your API token secure. It will not be displayed again once you leave the page.
:::
2. Role Mapping and Permissions
To ensure users are assigned the correct permissions upon synchronization, you must configure roles within your IdP that correspond to our system's access levels.
| IdP Role Value | Application Access Level |
|---|---|
owner | Owner role in your organization |
member | Member role in your organization |
3. Attribute Mapping (Schema Configuration)
For roles to sync correctly, you must map the user’s role attribute in your IdP (such as Okta, Azure AD, or OneLogin) to our specific custom schema extension.
Required Mapping Target: urn:ietf:params:scim:schemas:extension:cobalt:2.0:User:role