⚑ Prerequisite: Superuser access.
This article explains how to proceed in order to apply the SCIM protocol.
Once the SCIM integration is activated, your IT department will be able to control directly from your identity management system:
- The creation, modification and deactivation of users;
- The access level of these users by assigning them projects and profiles (both are groups in the SCIM protocol).
Configuration in Borealis
1. From the Main menu, go to Users > Authentication settings:
2. Choose SCIM on the left. In the box, click on the pencil to edit:
3. Check the box, to enable the SCIM provisioning and click Save:
4. These two pieces of information will appear at the bottom of the page:
- The confirmation that the SCIM provisioning is enabled;
- The provisioning URL in the banner with an authentication token. This token must be copied immediately, as these values will be required when configuring the Identity Management service.
ⓘ Note: If the token is lost, you need to disable SCIM provisioning and enable it again. A new token will then be provided. This also means the previous one will be disabled, so any integration set up previously using the previous token will stop working.
Configuration in Identity Management Service
Go to your Identity Management service (for example, Entra ID - Microsoft Azure Active Directory) and follow the instructions to complete the setup. These instructions may differ based on your Identity Management Service.
-
Configure Connectivity
- Enter
- Tenant URL (SCIM Base URL)
- Secret Token
- Select Test Connection to verify communication between Microsoft Entra ID and the application.
- Save the configuration.
- Enter
-
Assign Users and Groups
- Open the Identity Management Service.
- Select Users and groups.
- Choose Add user/group.
-
Assign the users and groups that should be provisioned to the application.
Microsoft Entra ID
-
Configure Attribute Mappings
- Open the Identity Management Service.
- Select Attribute mapping.
- Add the mappings for user/group.
- Assign Matching precedence to your attributes. Matching precedence determines the order in which Microsoft Entra ID checks user attributes to find an existing account in the target application, helping prevent duplicate accounts.
| Mapped SCIM attribute | Microsoft Entra ID Attribute | Matching precedence |
| userName | userPrincipalName | 1 |
| name.givenName | givenName | |
| name.familyName | surName | |
| emails[type eq "work"].value | ||
| manager | manager | |
| active | isSoftDeleted (computed value not stored on user) |
Mapped SCIM attribute |
Microsoft Entra ID Attribute | Matching precedence |
| externalId | objectId | 1 |
| displayName | displayName | |
| members | members |
ⓘ Note:
1. The above mapping may differ based on your Identity Management Service.
2. Group objectID represents SCIM Unique Identifier in Borealis.
-
Enable Provisioning
Before enabling automatic provisioning, use Provision on demand to test your attribute mappings and verify that users can be successfully provisioned to the application.
Once testing is complete, enable automatic provisioning:
- Open the Identity Management Service.
- Select Provisioning.
- Select Provisioning Mode as Automatic.
- Set Provisioning Status to On.
- Save the configuration.
ⓘ Note: Microsoft Entra ID will begin scheduling synchronization jobs to provision users and groups.
List of Supported Operations
Endpoint |
Operation |
Details |
| /Users | GET |
GET /Users : Retrieve the complete list of users GET /Users/{id} : Retrieve the user with the corresponding ID GET /Users?filter=userName eq “XXXXXXX” :Retrieve the user with the corresponding userName |
| /Users | POST | Create a new user |
| /Users | DELETE | DELETE /Users/{id} : Delete the user with the corresponding ID |
| /Users | PUT/PATCH | PATCH or PUT /Users/{id} : Update the user with the corresponding ID |
| /Groups | GET |
GET /Groups : Retrieve the complete list of groups GET /Groups/{id} : Retrieve the group with the corresponding ID.
|
| /Groups | PATCH | PATCH /Groups/{id} : Use the add or remove operations to add members to the group or remove users from it. |
| /ServiceProviderConfig | GET | Retrieve the configuration |
| /ResourceTypes | GET | Retrieve the list of supported resource types |
| /Schemas | GET | Retrieve the list of schemas |
ⓘ Note: All profiles and all project access will be Groups in terms of SCIM.
So, for example, these are groups:
• SE - Data Entry
• Transmission line (Read-only)
• Transmission line (Full access)
Want to know more? Check out the articles about Profiles and projects and how to create custom profiles.