Skip to content

SCIM - System for Cross-Domain Identity Management

SCIM is a specification created to easily manage users and groups between different services and applications. A common schema is used for a User or a Group, which allows services to pass their data without having to think about how the information is stored in your own service. By provisioning with SCIM, you can simply set up the mapping of your attributes to SCIM-attributes, which then will be mapped to attributes in the IFS database, and also create new Users and Groups if they do not already exist.

Purpose

SCIM in IFS Cloud uses one-way communication. This means that only the external Identity provider sends information that creates, updates or deletes user and group information. Changes made to users within IFS Cloud will not trigger an update to the external Identity provider. The purpose of SCIM in IFS cloud is simple user management.

IMPORTANT: As described above, if a user is synced with an external Identity Provider, their details should only be updated through the external Identity Provider, not on IFS Cloud Web. If changes are made on IFS Cloud Web, they will be overwritten by the user details from the external Identity provider during the next synchronization.

SCIM Standard

For updated and detailed information about the SCIM standard please visit this page.

Usage

SCIM 2.0 uses REST API for all operations.

User Operations

Group Operations

All data passed to the Create and Update endpoints must be encoded as a SCIM object in JSON. Resources stored in attributes that are not mapped to an IFS attribute will not be stored.

Attribute Mapping

This mapping table is to be used by Administrators when configuring a new Provisioning Service. The SCIM Attribute maps to certain fields of the IFS Cloud database. When first creating a new User through provisioning, a unique Identity will be created. This Id is used as a unique identified for the new User, and will be generated based on the values of the SCIM attributes name.givenName and name.familyName. Some Identity Managers will have all of these attributes by default, but in some cases a manual attribute mapper will need to be added. As an example, which can be seen in the configuration example for Okta, a attribute mapper for name.formatted has to be added.

The SCIM Attributes username, name.formatted, and displayName are mandatory, must be mapped, and have a value set from the external Identity Manager to successfully sync new users.

User Attribute Mapping

SCIM AttributeIFS DB AttributeIFS DB Character Limit
userNamefnd_user.web_user2000
name.formattedperson_info.name100
name.familyNameperson_info.last_name100
name.givenNameperson_info.first_name100
name.middleNameperson_info.middle_name100
displayNamefnd_user.description2000
titleperson_info.title100
addresses[type eq "work"].formattedperson_info_address.addressN/A (default 'work')
addresses[type eq "work"].streetAddressperson_info_address.address135
addresses[type eq "work"].localityperson_info_address.city35
addresses[type eq "work"].regionperson_info_address.state35
addresses[type eq "work"].postalCodeperson_info_address.zip_code35
addresses[type eq "work"].countryperson_info_address.country35 (ISO-3166 / Country)
emails[type eq "work"].valuecomm_method.value, fnd_user_property.value200
emails.typecomm_method.method_id_db, fnd_user_property.nameN/A (default 'work')
phoneNumbers[type eq "work"].valuecomm_method.value200
phoneNumbers.typecomm_method.method_id_dbN/A (default 'work')
   

Note: Addresses, emails and phonenumbers will have the default type 'work' when syncing a new User. The type provided will have to be 'work'.

Handling Addresses

Previously, address mappings were in the format of addresses.formatted. If a user's person address is provisioned from the external Identity Provider, the mapping should now follow the new format as above (e.g., addresses[type eq "work"].formatted).

If an address mapping is created on the external Identity Provider side, another work type address should not be added from IFS Cloud Web. If done, the address type added on IFS Cloud Web will be replaced by the existing address on the external Identity Provider side.

Group Attribute Mapping

This table shows the mapping of SCIM attributes and how they map to the IFS Cloud Database. When first creating a new Group through provisioning, a unique UserGroupId will be created which is used to identify and map the provisioned Groups from the Identity Management Service to IFS. The SCIM attribute displayName also needs to be unique and duplicates are not allowed. When provisioning a group with a name that already exists, IFS will return that group as part of the SCIM-response to the Identity Management Service.

SCIM AttributeIFS DB AttributeIFS DB Character Limit
displayNameuser_group.name200