Organisation administration · Public
Configure SCIM provisioning
Configure a generic SCIM 2.0 directory, authorize it securely, and control user provisioning from IAM.
SCIM provisioning sends enterprise membership data from Skyfallen ONE to a compatible directory. ONE creates and updates remote users, and can deactivate accounts after their ONE membership is removed.
This is an outbound provisioning connection: ONE is the identity provider and SCIM client; the connected service is the SCIM resource server.
Prerequisites
If SSO → SCIM provisioning is missing from IAM, open Organisation and review Platform settings, or contact your Skyfallen Account Manager.
scim:manage allows someone to create, edit, authorize, and remove connectors. scim:provision separately controls manual synchronization.
| Requirement | Details |
|---|---|
| Organisation type | Enterprise |
| Organisation toggle | SCIM application management enabled by Skyfallen |
| Configure permission | scim:manage on your membership |
| Run-sync permission | scim:provision on your membership |
| Member data | Every provisioned member needs a primary email address |
Open SCIM provisioning
- Sign in at iam.skyfallen.one.
- Switch to the enterprise organisation you manage.
- Open SSO → SCIM provisioning.
- Select Add SCIM app.
Choose a provider
For Apple Business, follow Configure Apple Business. That guide covers OpenID Connect, SSF, SAML, and SCIM setup together.
| Provider | Use it when | Authentication |
|---|---|---|
| Apple Business | Synchronizing ONE members to Apple Business Manager | OAuth 2.0; see the Apple Business guide |
| Generic SCIM 2.0 | Connecting another standards-compliant SCIM resource server | OAuth 2.0 authorization code or bearer token |
Configure a generic SCIM provider
OAuth 2.0
- Select Generic SCIM 2.0.
- Enter the provider’s SCIM connector base URL.
- Choose OAuth 2.0.
- Enter the provider’s authorization URL and token URL.
- Enter the OAuth client ID and client secret.
- Select the client authentication method required by the provider: HTTP Basic or request body.
- Save the connector.
- Add the connector’s callback URL to the provider’s OAuth application.
- Select Authorize, approve access at the provider, and return to ONE.
- Select Sync.
Bearer token
- Select Generic SCIM 2.0.
- Enter the SCIM connector base URL.
- Choose Bearer token.
- Paste a token with permission to list, create, update, and deactivate users.
- Save the connector.
- Select Sync.
OAuth client secrets, access tokens, refresh tokens, and bearer tokens are encrypted at rest and are never returned to the browser after saving.
| Field | Required | Notes |
|---|---|---|
| Application name | Yes | Name shown only to ONE administrators |
| Description | No | Administrative context for the connector |
| Provider | Yes | Generic SCIM 2.0, or Apple Business per the dedicated guide |
| SCIM connector base URL | Yes | Root URL containing the provider’s /Users resource |
| Authentication | Yes | OAuth 2.0 or bearer token |
| Authorization URL | OAuth only | Browser endpoint for authorization-code flow |
| Token URL | OAuth only | Endpoint used to exchange and refresh tokens |
| Client ID and secret | OAuth only | Credentials generated by the connected provider |
| Bearer token | Bearer only | Static provider credential |
| Scheduled provisioning | No | Includes the connector in the hourly task |
| Deactivate removed users | No | Sets remote active to false; does not delete the remote account |
Attribute mapping
ONE searches for an existing remote user by externalId before creating one. Do not change this identifier in the provider.
| ONE source | SCIM attribute |
|---|---|
| Membership ID | externalId and enterprise employeeNumber |
| Primary email | userName and primary work email |
| First and last name | name.givenName, name.familyName, and displayName |
| Phone | Primary work phone, when present |
| Organisation legal name or name | Enterprise organization |
| Active membership | active: true |
| ONE permissions | Generic-provider entitlements only |
Synchronization lifecycle
Each connector is locked during synchronization so overlapping manual and scheduled runs cannot provision the same directory simultaneously.
| Situation | ONE action |
|---|---|
| Member has not been provisioned | Search by externalId, then create if absent |
| Member already exists | Replace the SCIM User representation |
| Membership was removed | Send a SCIM PATCH setting active to false, when deactivation is enabled |
| OAuth access token expires | Refresh it automatically using the stored refresh token |
| Provider rejects a request | Stop the run and display the latest safe error on the connector |
| Action | Where | Notes |
|---|---|---|
| Run now | Connector actions → Sync | Requires scim:provision |
| Edit configuration | Connector actions → Edit | Leave a stored secret blank to retain it |
| Reauthorize OAuth | Connector actions → Authorize | Required after replacing an OAuth client secret or revoking access |
| Pause scheduled runs | Clear scheduled provisioning | Keeps the connector and credentials |
| Remove connector | Connector actions → Remove | Deletes ONE’s connector and sync records; it does not delete remote users |
| Problem | Resolution |
|---|---|
| Connector is not visible | Confirm Enterprise type, the SCIM organisation toggle, and scim:manage |
| Authorization is rejected | Confirm the client ID, client secret, callback URL, and exact authorization/token URLs |
| Sync says authorization is required | Authorize OAuth again, or replace the bearer token |
| A duplicate remote user appears | Confirm the provider preserves and filters externalId exactly |
| Removed users remain active | Enable deactivation and run another sync |
Permission summary
Full definitions are in Organisation permissions reference.
| Permission | Who needs it | Purpose |
|---|---|---|
scim:manage |
IAM administrators | Create, edit, authorize, pause, and remove connectors |
scim:provision |
Directory operators | Start an immediate synchronization |