Product · Connect your customers
SCIM 2.0 Directory Sync
Users and groups from your customer’s directory
RealmSSO offers SCIM 2.0 Users and Groups endpoints. Your customer’s IdP pushes users into the customer’s realm. Group sync is off by default. Not yet tested against Okta or Entra ID.
- Customer’s IdPpushes users and groups
- SCIM 2.0
- SCIM 2.0 API/api/scim/v2token kept as a hash
- auto-provision on
- Customer’s realmusers created, no passwordgroup sync: off by defaultdelete deprovision: off by default
The endpoints
The SCIM base path is /api/scim/v2 on the API host. Each row names its limit.
Users and Groups
The endpoints serve Users and Groups, with list, get, create, replace, patch and delete. They also serve /ServiceProviderConfig and /Schemas. There is no /ResourceTypes, no Bulk and no sorting.
Two filters
GET /Users accepts two filters: userName eq and email eq. It ignores any other filter. GET /Groups ignores filters. A page returns at most 200 results.
Patch requests
A patch with a capitalised operation name, such as Replace, is rejected. A replace operation without a path is ignored. To remove a group member, send the path members and name the member in the value. A filtered member path is ignored. Not yet tested against Okta or Entra ID.
Token
Your customer chooses the SCIM token. It needs at least 32 characters. RealmSSO stores only its SHA-256 hash. An account has one token, and a new token replaces the old one at once. The IT admin sets it in the Admin Portal.
Events
Each SCIM write that RealmSSO processes records an event, whether it succeeds or fails. A request refused before processing, for example for a bad token or an invalid body, records nothing. A read records nothing.
What changes in the realm
RealmSSO keeps a directory record of each SCIM user and group. The account’s SCIM settings decide what also changes in the realm. With the defaults, user creates, updates and deactivations reach the realm. Deletes and groups do not.
Create a user
A SCIM create writes a directory record. With auto-provision on, which is the default, it also creates or updates the user in the customer’s realm. A realm is the separate sign-in space RealmSSO makes for each account. The user has no password. Not yet tested: a user that SCIM created and who then signs in through SSO.
Deactivate a user
Setting active to false disables the user in the realm and ends their sessions. This happens when auto-provision is on, which is the default. It does not need auto-deprovision. If ending the sessions fails, RealmSSO only logs the failure.
Delete a user
A SCIM delete removes the directory record. It disables the user in the realm only when auto-deprovision is on. Auto-deprovision is off by default.
Groups
Group sync is off by default. When it is on, RealmSSO creates, renames and deletes realm groups and syncs their members. A directory record is written either way.
Who sets the switches
Auto-deprovision, group sync and attribute mapping are set through the Admin Portal API only. No screen sets them, and the dashboard has no setting for them. The Admin Portal screen only turns SCIM on and sets its token.
Talk to the people who build it.
We run RealmSSO for you. Tell us which identity providers your customers use and how many customers you have, and we will tell you what fits today.