One Identity Manager as SCIM 2.0 service provider
One Identity Manager provides an interface corresponding to the System for Cross-domain Identity Management (SCIM) 2.0. The interface enables the import and export of One Identity Manager objects by a SCIM client. For example, the interface can be used to:
-
Import identity, department, cost center, and location data from an HR system
-
Import user account and group data from a cloud system
-
Match custom target systems that have a SCIM V2.0 client
-
Provision information about identities through a standardized interface for further processing in third-party systems
The SCIM 2.0 service provider for One Identity Manager is provided as a plugin for the API Server and you can select it when you install the API Server. Further configuration of the SCIM plugin itself is not necessary. You can check in the API Server administration portal if the SCIM plugin was installed and activated successfully. For more information on installing an API Server, see the One Identity Manager Installation Guide.
Detailed information about this topic
Endpoints and base URL
NOTE: The providers and endpoints supplied with the interface are fixed and cannot be configured.
The SCIM 2.0 interface can be found in the API Server installation directory under the fixed subdirectory /ApiServer/scim/v2. The base URL is formed as follows:
<http | https>://[<subdomain | server name>.]<domain name>/ApiServer/scim/v2
There are other fixed endpoints. The endpoints are called without any further URL parameters.
-
/ServiceProviderConfig
The endpoint provides information about the options implemented in the service provider, such as the authentication types on offer. The endpoint can be accessed without authentication.
-
/Schemas
The return structure of the endpoint defines all data objects and their properties supported by the provider.
Related topics
SCIM plugin features
The return structure of the /ServiceproviderConfig endpoint defines, among other things, the features that are supported by the SCIM plugin.
-
patch: When transferring changes, only single operations on object properties are transferred, not the complete object to be changed.
-
filter: This supports filtering of objects immediately on request or in patch operations.
Authenticating SCIM clients
An authenticationSchemes list is included in the structure returned by the /ServiceproviderConfig endpoint. The list publishes the possible authentication and authorization methods with which the SCIM plugin can be used.
Supported are:
-
HTTP Basic access authentication
-
NTLM Authentication and Kerberos
-
OAuth 2.0 client authorization
Related topics
