Chat now with support
Chat with Support

Active Roles 8.1.5 - Synchronization Service Administration Guide

Synchronization Service overview Deploying Synchronization Service Deploying Synchronization Service for use with AWS Managed Microsoft AD Getting started Connections to external data systems
External data systems supported with built-in connectors
Working with Active Directory Working with an AD LDS (ADAM) instance Working with Skype for Business Server Working with Oracle Database Working with Oracle Database user accounts Working with Exchange Server Working with Active Roles Working with One Identity Manager Working with a delimited text file Working with Microsoft SQL Server Working with Micro Focus NetIQ Directory Working with Salesforce Working with ServiceNow Working with Oracle Unified Directory Working with an LDAP directory service Working with an OpenLDAP directory service Working with IBM DB2 Working with IBM AS/400 Working with IBM RACF Working with MySQL database Working with an OLE DB-compliant relational database Working with SharePoint Working with Microsoft 365 Working with Microsoft Azure Active Directory Configuring data synchronization with the SCIM Connector Configuring data synchronization with the Generic SCIM Connector
Using connectors installed remotely Creating a connection Renaming a connection Deleting a connection Modifying synchronization scope for a connection Using connection handlers Specifying password synchronization settings for a connection
Synchronizing identity data Mapping objects Automated password synchronization Synchronization history Scenarios of use Developing PowerShell scripts for attribute synchronization rules Using PowerShell script to transform passwords

Configuring data synchronization with the SCIM Connector

With the SCIM Connector, you can configure inbound data synchronization connections for the following SCIM-based One Identity Starling Connect connectors:

  • PingOne

  • Workday HR

NOTE: Consider the following when planning to configure a connection with the SCIM Connector:

  • The SCIM Connector is tested to support the Starling Connect PingOne and Workday HR connectors. To configure a connection for import-based workflows to the SCIM 2.0-based SuccessFactors HR 8.0 or ServiceNow 2.0 Starling connectors, use the Generic SCIM Connector instead. For more information, see Configuring data synchronization with the Generic SCIM Connector.

  • The SCIM Connector supports only the standard schema of the SCIM protocol. It does not support extended schemas, and therefore cannot handle user-made custom attributes.

For the list of Active Roles Synchronization Service connector features that the SCIM Connector supports or does not support, see the following table.

Table 101: SCIM Connector – Supported features

Feature

Supported

Bidirectional synchronization

Specifies whether you can both read and write data in the connected data system.

No

Delta processing mode

Specifies whether the connection can process only the data that has changed in the connected data system since the last synchronization operation. This reduces the overall synchronization duration.

No

Password synchronization

Specifies whether you can synchronize user passwords from an Active Directory (AD) domain to the connected data system.

No

Secure Sockets Layer (SSL) data encryption

Specifies whether the connector can use SSL to encrypt data transmitted between Active Roles Synchronization Service and the connected data system.

Yes

For more information on the SCIM protocol, see the official SCIM site, or the following IETF RFC documents:

  • IETF RFC-7642: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements

  • IETF RFC-7643: System for Cross-domain Identity Management: Core Schema

  • IETF RFC-7644: System for Cross-domain Identity Management: Protocol

Objects and operations supported by the SCIM Connector

This section lists the data objects supported by the SCIM Connector, along with the data operations you can perform on those objects via the SCIM Connector.

Table 102: Supported objects and operations for SCIM v2.0

Object

Read

Create

Delete

Update

Core user

 Yes Yes Yes Yes

Group

 Yes Yes Yes Yes

Enterprise

Yes

 Yes Yes Yes
Table 103: Supported objects and operations for SCIM v1.1

Object

Read

Create

Delete

Update

User

 Yes Yes Yes Yes

Group

 Yes Yes Yes Yes

Creating a SCIM connection with the SCIM Connector

You can configure an Active Roles Synchronization Service connection to the PingOne and Workday HR connectors of Starling Connect with the SCIM Connector.

To configure a connection to a Starling Connect connector with the SCIM Connector

  1. In the Synchronization Service Console, open the Connections tab.

  2. Click Add connection, then use the following options:

    • Connection name: Type a descriptive name for the connection.

    • Use the specified connector: Select SCIM Connector.

  3. Click Next.

  4. On the Specify connection settings page, under SCIM settings, configure the following connection options:

    • SCIM version: Select the SCIM protocol version to use for the connection. The SCIM Connector supports protocol versions V2 and V1.1.

    • SCIM URL: Specify the the base URL of the Starling Connect connector to which you want to connect.

    • Authentication type: Select the authentication type. The SCIM Connector supports Basic, OAuth and API Key-based authentication. The contents of the Authentication parameters section are populated dynamically based on the authentication type you select in this setting.

  5. Under Authentication parameters, configure the applicable options:

    • If you use Basic authentication, provide a valid User name and Password.

      NOTE: The PingOne connector of Starling uses the API key as the User name and the API token as the Password.

    • If you use OAuth authentication, configure the settings applicable to the selected Grant type.

      Table 104: SCIM Connector OAuth authentication settings

      Grant type

      Setting

      Description

      password

      Token URL

      Specify the URL of the token.

      User name

      Specify the user name.

      Password

      Specify the password.

      Client ID

      Specify the client ID used for login.

      Client secret

      Specify the client secret.

      client_credentials

      Token URL

      Specify the URL of the token.

      Client ID

      Specify the client ID used for login.

      Client secret

      Specify the client secret.

      Bearer_Token

      Bearer token

      Specify the bearer token for the connection.

      NOTE: Connections using a bearer token have a time-limit, specified by the token provider. Once this time limit is reached, the connection ends. To establish a new connection session, you must create a new bearer token.

    • If you use API Key authentication, specify the API Key and Token for the connection.

  6. (Optional) To connect to the Workday HR connector of Starling with the configured SCIM Connector, select Load workday schema. Selecting this option will result in the configured SCIM Connector using the Workday schema instead of the standard SCIM schema.

    NOTE: Select Load workday schema only if you want to connect to the Workday HR connector of Starling. Attempting to connect to the PingOne connector with this setting enabled will result in the SCIM Connector failing to synchronize data.

  7. (Optional) To configure additional authentication parameters (such as a region ID or organization ID) for the SCIM Connector, click Add additional parameters. Then, use the Additional authentication parameters settings to specify additional Plain text parameters or Masked parameters. To save the parameters, click OK.

  8. To verify that the specified settings are correct, click Test Connection.

  9. To create the connection, click Finish.

Viewing or modifying the settings of a SCIM Connector

You can view or modify an existing connection based on the SCIM Connector with Active Roles Synchronization Service. Modifying a SCIM Connector is typically required if any change occurs in the SCIM-based Starling Connect connectors to which the Active Roles Synchronization Service connection was originally configured.

To view or modify an existing SCIM Connector connection

  1. In the Synchronization Service Console, open the Connections tab.

  2. Click Connection settings below the existing SCIM connection you want to modify.

  3. On the Connection Settings tab, click the Specify connection settings item to expand it and update the required settings.

    For more information on the available settings, see Creating a SCIM connection with the SCIM Connector.

  4. To apply your changes, click Save.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating