SCIM provisioning

Enable SCIM_ENABLED=true with Postgres or SQL Server and EDITOR_USERS_DB=true. Apply database migrations first. The service root is https://api.example.com/scim/v2. Provisioning credentials always belong to one tenant.

Create an API key with scope: "scim" in the tenant’s API-key console or POST /admin/api-keys/. Copy the one-time secret into the identity provider’s bearer-token setting. Rotate and revoke it through the existing API-key API. For a single-tenant installation only, SCIM_BEARER_TOKEN is an alternative bound to default; it cannot be used in multi-tenant mode or reuse an API key or signing secret. Unsafe shortcut configuration fails at startup.

The API accepts application/scim+json and JSON. Discovery endpoints are ServiceProviderConfig, ResourceTypes and Schemas. Users and Groups support list, create, get, replace, patch and delete. Lists use SCIM’s Resources, totalResults, startIndex (one based) and itemsPerPage, rather than the ordinary API envelope. count=0 returns only the count; maximum page size is 200. Filters support quoted equality joined with and: users accept userName, externalId and id; groups accept displayName, externalId and id. Unsupported filters produce 400 invalidFilter. These protocol endpoints are deliberately excluded from SDK parity because identity providers call them directly.

The supported user profile contains userName, externalId, displayName, active, name and emails. Password provisioning, bulk operations, sorting and ETags are unsupported. User group membership is read-only and managed through Groups. Usernames are normalized to lowercase and unique within a tenant. External IDs are unique within a tenant. Responses omit tenant identifiers, login keys and internal identity links.

PATCH accepts pathless object updates, individual user attributes, name subattributes, group member arrays, and members[value eq "user-id"] removal paths. A request is atomic: a failed later operation or foreign member rolls back the entire resource mutation and its audit event. Group membership never crosses a tenant boundary.

SCIM_DELETE_MODE=deactivate is the default. Deactivation records a timestamp and session-revocation floor while preserving attribution. Existing editor tokens are rejected within the registry TTL (normally ten seconds); a local provisioning write refreshes its own registry immediately. Personal-key minting and SSO login reject inactive accounts with 403 account_deactivated. Reactivation preserves the revocation floor. SCIM_DELETE_MODE=delete permanently removes the user and its memberships.

Group names participate in the existing group role bindings. An optional group extension, urn:pulp:params:scim:schemas:extension:2.0:Group, accepts mappedRole: "admin" | "editor" | null; the highest mapped role supplies the stored base role, otherwise viewer. Prefer explicit role bindings for folder grants. User and group changes generate redacted user_lifecycle audit entries with source: "scim".

Microsoft Entra

Configure a custom provisioning integration with the SCIM service root and the tenant-scoped secret. Map the directory login name to userName, the stable directory object identifier to externalId, and account enablement to active. Include the supported name and email fields. Configure group membership provisioning only for the groups the tenant should receive. Microsoft’s SCIM endpoint guide describes the provisioning requests and mappings.

For environment OIDC login, set OIDC_CLAIM_SCIM_LINK=oid when externalId contains the Entra object ID. For a tenant provider, set config.claims.scimLink to the matching claim. The value must match the provisioned external ID exactly. Prefer stable external IDs; email linking requires explicit OIDC_LINK_BY_EMAIL=true and a unique tenant-local match.

Okta

Add SCIM provisioning to the application integration, use the service root, and configure HTTP bearer authentication with the scoped secret. Map the stable identity value used by the login provider to externalId; the default OIDC link claim is sub. Assign the intended users and groups to the integration. See Okta’s SCIM integration instructions.

Run a canary create, attribute update, group add/remove, deactivation and reactivation before assigning the full directory. Entra’s SCIM Validator and Okta’s vendor suite remain pending; local native-database and protocol checks are recorded in the Wave 76 report. The error body is the RFC 7644 Error schema with string status, detail and optional scimType, an intentional exception to the regular API error envelope. See RFC 7644.

OIDC email linking also requires the verified email_verified=true claim; SAML email values come from the signed assertion.