SCIM 2.0

The SCIM 2.0 connector enables automatic provisioning of users and groups from your Identity Provider (IdP) into Big ACL’s Policy Information Point (PIP).

Overview

SCIM (System for Cross-domain Identity Management) is an open standard that allows Identity Providers like Azure AD/Entra ID, Okta, or Ping Identity to automatically synchronize user and group data with Big ACL.

Supported operations:

• Create, update, and delete users
• Create, update, and delete groups
• Manage group memberships

Getting Started

Step 1: Create the Connector

1. Navigate to Settings > Connectors
2. Click New Connector
3. Select SCIM 2.0 from the Identity Provider category
4. Enter a name for your connector (e.g., “Azure AD Provisioning”)
5. Click Save

Step 2: Configure Attribute Mappings

Before activating the connector, you must configure how SCIM attributes map to your Big ACL entities.

1. Go to the Mappings tab
2. Configure User Mappings:
   • Select the target EntityClass for users (e.g., “Employee”)
   • Click Add Mapping to map SCIM attributes to entity fields
3. Optionally configure Group Mappings following the same process

Mapping Types

Type	Description
Simple value	Maps the SCIM attribute directly to the field
Reference	Resolves the value to an existing entity reference
List of references	Maps an array of values to entity references (e.g., group members)

Common SCIM Attributes

User (Core Schema):

• userName - Unique identifier
• name.givenName - First name
• name.familyName - Last name
• emails[primary].value - Primary email
• active - Account status

User (Enterprise Extension):

• employeeNumber - Employee ID
• department - Department name
• manager.value - Manager reference

Group:

• displayName - Group name
• members[].value - Member references

Step 3: Generate Access Token

1. Go to the Configuration tab
2. Click Generate Token
3. Copy the token immediately - it will only be shown once
4. Store the token securely

Warning: If you lose the token, you’ll need to generate a new one and update your IdP configuration.

Step 4: Activate the Connector

1. Open the connector menu (three dots icon)
2. Click Activate

The connector is now ready to receive SCIM requests from your Identity Provider.

Identity Provider Configuration

Use the following values to configure SCIM provisioning in your IdP:

Setting	Value
Tenant URL	https://api.big-acl.com/scim/v2/{tenant-id}
Authentication	Bearer Token
Token	The token generated in Step 3

Azure AD / Entra ID

1. Go to Enterprise Applications > Your App > Provisioning
2. Set Provisioning Mode to Automatic
3. Enter the Tenant URL and Secret Token
4. Click Test Connection then Save
5. Configure attribute mappings as needed
6. Turn Provisioning Status to On

Okta

1. Go to Applications > Your App > Provisioning
2. Click Configure API Integration
3. Enter the SCIM Base URL and API Token
4. Enable the provisioning features you need
5. Configure attribute mappings in the To App section

Managing the Connector

Rotate Token

If you suspect the token has been compromised:

1. Go to the Configuration tab
2. Click Rotate Token
3. Confirm the action
4. Update your IdP with the new token

Note: The previous token is immediately invalidated. Your IdP will fail to connect until updated.

Deactivate Connector

To temporarily stop provisioning:

1. Open the connector menu
2. Click Deactivate

The SCIM endpoint will reject all requests until reactivated.

Delete Connector

To permanently remove the connector:

1. Open the connector menu
2. Click Delete
3. Type DELETE to confirm

Note: Provisioned entities (users/groups) will NOT be deleted. Only the connector configuration and mappings are removed.

Monitoring

Operations History

The History tab shows all SCIM operations received by the connector:

• Filter by operation type (Create, Update, Delete, Search)
• Filter by resource type (User, Group)
• Filter by status (Success, Error)
• Click on an error row to see details

Troubleshooting

Connection Test Fails

• Verify the Tenant URL is correct
• Ensure the token is entered without extra spaces
• Check that the connector is activated

Users/Groups Not Syncing

• Verify attribute mappings are configured
• Check the History tab for errors
• Ensure the IdP provisioning is enabled and users are in scope

401 Unauthorized Errors

• The token may have been rotated or revoked
• Generate a new token and update your IdP

404 Not Found Errors

• The target EntityClass may have been deleted
• Verify your mappings reference existing classes

Reference

Supported SCIM Endpoints

Method	Endpoint	Description
GET	/Users	List/search users
GET	/Users/{id}	Get user by ID
POST	/Users	Create user
PUT	/Users/{id}	Replace user
PATCH	/Users/{id}	Update user
DELETE	/Users/{id}	Delete user
GET	/Groups	List/search groups
GET	/Groups/{id}	Get group by ID
POST	/Groups	Create group
PUT	/Groups/{id}	Replace group
PATCH	/Groups/{id}	Update group
DELETE	/Groups/{id}	Delete group

Supported SCIM Schemas

• urn:ietf:params:scim:schemas:core:2.0:User
• urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
• urn:ietf:params:scim:schemas:core:2.0:Group