OneLogin - Configuring SCIM User Provisioning

In this article, you will learn how to set up SCIM using OneLogin as the identity provider.

allows you to provision users to the Staffbase platform using an identity provider. Learn more.

• You have access to the OneLogin Administration.
• You have super user privilege in OneLogin.
  Learn more.
• You have an existing SSO/SAML configuration in OneLogin in order to configure it for the Staffbase platform.
• You have the SCIM endpoint URL for your Staffbase platform. The URL has the following format: https://<your-domain>/scim
• You have generated an API token with administrative access via the Staffbase Studio.

You need to extend your existing App in OneLogin for Staffbase to add SCIM provisioning.

1. In OneLogin, go to Administration.

2. Click Applications > Applications.

3. Select your existing application for the Staffbase SSO/SAML configuration by filtering the overview and clicking on the name.

4. Under Configuration, navigate to API and provide the following details, and click Save:

• API Status: Click Enable to turn on the option.
• SCIM Base URL: Enter the SCIM endpoint URL for your Staffbase platform.
  For example, the URL uses the following format: https://<your-domain>/scim
• SCIM Bearer Token: Enter the API token generated from the Staffbase Studio.
• SCIM JSON Template: Enter the following template, which contains the minimum information required by Staffbase, such as externalId, Firstname, Lastname, and Email

{
  "schemas": [
    "urn:scim:schemas:core:2.0",
    "urn:scim:schemas:extension:enterprise:2.0"
  ],
  "externalId": "{$user.id}",
  "name": {
    "familyName": "{$user.lastname}",
    "givenName": "{$user.firstname}"
  },
  "emails": [
    {
      "value": "{$user.email}",
      "type": "work",
      "primary": true
    }
  ]
}

5. Under Provisioning, provide the following details, and click Save:

• Enable provisioning: Click Enable to turn on the option.
• When users are deleted in OneLogin, or the user’s app access is removed, perform the below action: Select Delete.
• When user accounts are suspended in OneLogin, perform the following action:: Select Suspend.
• For production: Disable the following options: -Create user
  • Delete user
  • Update user
• For testing: Enable the following options:
  • Create user
  • Delete user
  • Update user
    When these options are enabled, actions need to be approved under Users.

The mapping is defined in the JSON template in step 4 above. To add additional custom attributes, see OneLogin - Creating Custom Attributes for SCIM User Provisioning.

• OneLogin - SCIM Provisioner with SAML (SCIM v2 Enterprise)
• OneLogin - Overview of SCIM