IdRa

SCIM provisioning

Push people and groups from IdRa to apps with outbound SCIM, and accept users from HR systems or other IdPs with inbound SCIM.

Outbound: provision to apps

IdRa creates, updates and deactivates accounts in apps that expose a SCIM 2.0 API.

  1. Open the app → Provisioning → SCIM provisioning.
  2. Turn on Enable provisioning, enter the app's SCIM base URL and API token (sent as a Bearer token, stored encrypted), and select Test connection.
  3. Choose the Features: Create users, Update user attributes, Deactivate users, Push groups.
  4. Review the Attribute mappings (SCIM attribute ← IdRa value). Defaults: userName and emails ← email, displayName ← name, name.givenName / name.familyName ← profile.firstName / profile.lastName, title ← profile.title, the enterprise department ← profile.department.

What triggers a push:

  • Assigning the app (directly or through a group) creates the user; an account that already exists in the app (409) is adopted and updated.
  • Profile changes update it; unassignment or deactivation sets active: false.
  • Push groups keeps chosen groups and their membership in sync. Stop pushing a group to delete it in the app.

The People table shows each person's status, last sync and error; Push all re-syncs everyone. Failed calls are retried in the background (up to 8 attempts, backing off to an hour).

Inbound: provision into IdRa

An HR system or another identity provider can manage IdRa people over SCIM.

  1. Directory → Directory Integrations → Inbound SCIM → Add SCIM connection, and give it a name.
  2. Copy the SCIM bearer token (shown once, valid one year) and the base URL:
https://<your IdRa address>/api/auth/scim/v2

Supported resources: /Users, /Groups, /Schemas, /ResourceTypes and /ServiceProviderConfig.

People created or deactivated over SCIM behave like changes made in the console: group rules, outbound provisioning and event hooks run, and deactivation ends their sessions and tokens. Reactivating over SCIM only reverses a deactivation SCIM made.

New token issues another token (older ones keep working until revoked); Revoke cuts a token off.

curl -H "Authorization: Bearer $SCIM_TOKEN" \
  "https://idra.example.com/api/auth/scim/v2/Users?count=10"

Inbound SCIM groups are stored by the SCIM endpoint but aren't turned into IdRa groups. Use group rules on attributes your HR system sends instead.

Federation (inbound identity providers)

To let people sign in with another IdP instead of provisioning them, see Security → Identity Providers on the Users page.

SAML 2.0 single sign-on

Connect SAML service providers to IdRa for SP- or IdP-initiated single sign-on, and see what is and isn't supported.

Identity providers

Let people sign in with an external IdP or a social account, and decide who it can sign in as.

On this page

Outbound: provision to appsInbound: provision into IdRaFederation (inbound identity providers)