SCIM 2.0 Provisioning

SCIM (System for Cross-domain Identity Management) is a standardized protocol (RFC 7643/7644) that allows an external identity provider (IdP) to push user lifecycle events — create, update, disable, delete — to Auris automatically. Instead of administrators manually managing users in two systems, the IdP becomes the source of truth and Auris reflects its state in near real-time.

Auris implements SCIM 2.0 and is compatible with any IdP that supports the standard, including Okta, Microsoft Azure AD (Entra ID), OneLogin, JumpCloud, Google Workspace (via third-party SCIM bridge), and Ping Identity.

How SCIM Works

When SCIM is configured, the IdP acts as the SCIM client and Auris acts as the SCIM server (service provider).

The typical lifecycle:

1. A new employee is added in Okta (or another IdP).
2. Okta sends a POST /scim/v2/Users request to Auris with the employee’s attributes.
3. Auris creates the user in both its database and the underlying Keycloak realm.
4. When the employee is disabled in Okta (e.g., after resignation), Okta sends a PATCH /scim/v2/Users/[id] with "active": false.
5. Auris disables the user and invalidates all active sessions.
6. When the employee record is deleted in Okta, Okta sends DELETE /scim/v2/Users/[id].
7. Auris soft-deletes the user.

This keeps Auris synchronized without any manual administrator intervention.

Setting Up a SCIM Connection

{
  "name": "Okta Production",
  "keycloakRealm": "your-realm"
}

SCIM Endpoints

All SCIM endpoints are mounted under /scim/v2. They require a Bearer token that corresponds to an active SCIM connection. Standard SCIM Content-Type: application/scim+json is supported.

Attribute Mapping

By default, Auris applies standard SCIM-to-Auris attribute mappings. You can customize these mappings per connection in the Console Mappings tab.

Default Mappings

Custom Mappings

Custom attribute mappings allow you to map non-standard SCIM attributes to Auris user fields. For example, if your IdP sends urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department and you want to store it in metadata.department.

{
  "scimAttribute": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department",
  "aurisAttribute": "metadata.department",
  "direction": "INBOUND",
  "isActive": true
}

Mapping directions:

Filter Support

Auris implements RFC 7644 §3.4.2.2 SCIM filtering. Most IdPs use filters to look up users before creating or updating them.

Supported operators:

Example filters:

# Find user by email
/scim/v2/Users?filter=emails eq "[email protected]"

# Find by userName
/scim/v2/Users?filter=userName eq "alice"

# Find active users in a department (with enterprise schema extension)
/scim/v2/Users?filter=active eq true and urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department eq "engineering"

Filters support and/or combinators and parentheses for grouping. Dot-notation attribute paths (e.g., name.givenName) are resolved correctly.

Sync Statistics

The Console provides a breakdown of SCIM sync activity per connection, viewable in the Stats tab of each connection detail page.

Response:

{
  "periods": {
    "24h": { "created": 12, "updated": 8, "deleted": 1, "errors": 0 },
    "7d":  { "created": 45, "updated": 33, "deleted": 4, "errors": 2 },
    "30d": { "created": 180, "updated": 112, "deleted": 9, "errors": 5 }
  }
}

Bulk Operations

The SCIM Bulk endpoint allows an IdP to send up to 100 operations in a single HTTP request. This reduces network overhead during large provisioning events (e.g., an organization-wide directory sync).

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:BulkRequest"],
  "Operations": [
    {
      "method": "POST",
      "path": "/Users",
      "bulkId": "bulk-1",
      "data": {
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "userName": "[email protected]",
        "name": { "givenName": "New", "familyName": "User" },
        "emails": [{ "value": "[email protected]", "primary": true }]
      }
    },
    {
      "method": "PATCH",
      "path": "/Users/scim-ext-id-123",
      "data": {
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
        "Operations": [{ "op": "replace", "path": "active", "value": false }]
      }
    }
  ]
}

Bulk response:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:BulkResponse"],
  "Operations": [
    { "method": "POST", "bulkId": "bulk-1", "status": { "code": 201 } },
    { "method": "PATCH", "location": "/scim/v2/Users/scim-ext-id-123", "status": { "code": 200 } }
  ]
}

Required Permissions

Related Pages

• Managing Users — Manual user management via API and Console
• User Import & Export — One-time bulk import from CSV or JSON
• Organizations: Enterprise SSO — Per-organization SSO for B2B customers
• Console: SCIM Connections — Full Console walkthrough