SCIM 2.0 Directory Sync
The SCIM 2.0 contract for your customers
RealmSSO ships the SCIM 2.0 Users and Groups contract — standard schemas, patch, and bearer-token auth — and provisions into Keycloak when autoProvision is on (default). autoDeprovision and groupSync stay off until you enable them; /docs/scim describes the defaults in full.
Why SCIM 2.0 Directory Sync?
Everything you need for enterprise-grade identity federation.
SCIM 2.0 Contract
Standard SCIM 2.0 Users and Groups endpoints (RFC 7643/7644) with correct schemas, patch support, and a ServiceProviderConfig that advertises capabilities to your customers’ IdP.
Bearer-Token Auth
Per-account bearer tokens; every request is authenticated by looking up the SHA-256 hash of the presented token against the enabled SCIM config.
Sync Auditing
Every SCIM request records an observability event (provisioned / updated / deprovisioned, and their group equivalents) as it arrives, with status tracking.
Keycloak Provisioning
When autoProvision is enabled (the default), SCIM user creates and updates upsert directory users in the account’s Keycloak realm. autoDeprovision and groupSync default to false — deactivating a directory user or mirroring groups requires turning those flags on. See /docs/scim for the exact defaults and behaviour.
Config Flags Honoured
The autoProvision / autoDeprovision / groupSync flags and attribute mapping are modelled per account and enforced on the write path — they are not scaffolding waiting for a later milestone.
Ready to get started?
Deploy RealmSSO on your infrastructure and give your customers the enterprise SSO experience they expect.