# SCIM provisioning (https://docs.idra.zone/docs/admin/scim)

Push people and groups from IdRa to apps with outbound SCIM, and accept users from HR systems or other IdPs with inbound SCIM.

## Outbound: provision to apps

IdRa creates, updates and deactivates accounts in apps that expose a SCIM 2.0 API.

1. Open the app → **Provisioning** → **SCIM provisioning**.
2. Turn on **Enable provisioning**, enter the app's **SCIM base URL** and **API token** (sent as a Bearer token, stored encrypted), and select **Test connection**.
3. Choose the **Features**: Create users, Update user attributes, Deactivate users, Push groups.
4. Review the **Attribute mappings** (SCIM attribute ← IdRa value). Defaults: `userName` and `emails` ← email, `displayName` ← name, `name.givenName` / `name.familyName` ← `profile.firstName` / `profile.lastName`, `title` ← `profile.title`, the enterprise `department` ← `profile.department`.

What triggers a push:

- Assigning the app (directly or through a group) creates the user; an account that already exists in the app (409) is adopted and updated.
- Profile changes update it; unassignment or deactivation sets `active: false`.
- **Push groups** keeps chosen groups and their membership in sync. Stop pushing a group to delete it in the app.

The **People** table shows each person's status, last sync and error; **Push all** re-syncs everyone. Failed calls are retried in the background (up to 8 attempts, backing off to an hour).

## Inbound: provision into IdRa

An HR system or another identity provider can manage IdRa people over SCIM.

1. **Directory → Directory Integrations → Inbound SCIM → Add SCIM connection**, and give it a name.
2. Copy the **SCIM bearer token** (shown once, valid one year) and the base URL:

```
https://<your IdRa address>/api/auth/scim/v2
```

Supported resources: `/Users`, `/Groups`, `/Schemas`, `/ResourceTypes` and `/ServiceProviderConfig`.

People created or deactivated over SCIM behave like changes made in the console: group rules, outbound provisioning and event hooks run, and deactivation ends their sessions and tokens. Reactivating over SCIM only reverses a deactivation SCIM made.

**New token** issues another token (older ones keep working until revoked); **Revoke** cuts a token off.

```sh
curl -H "Authorization: Bearer $SCIM_TOKEN" \
  "https://idra.example.com/api/auth/scim/v2/Users?count=10"
```

  Inbound SCIM groups are stored by the SCIM endpoint but aren't turned into IdRa groups. Use
  [group rules](https://docs.idra.zone/docs/admin/groups#group-rules) on attributes your HR system sends instead.

## Federation (inbound identity providers)

To let people sign in with another IdP instead of provisioning them, see **Security → Identity Providers** on the [Users](https://docs.idra.zone/docs/admin/users#identity-providers) page.