SCIM 2.0

Description

The SCIM 2.0 connector uses the System for Cross-domain Identity Management (SCIM 2.0) standard REST API (RFC 7642–7644) to discover user accounts and groups from any SCIM-compliant identity provider. Authentication uses a Bearer token supplied in the Authorization header — this may be a static API key or an OAuth 2.0 access token depending on the provider. Pagination follows the SCIM 2.0 specification: startIndex, totalResults, and itemsPerPage response fields are used to walk through large result sets in pages of 100.

System Type Classification

Field	Value
System Type	Directory Service
Default Scan Priority	10 (scanned first)

Version Support

OrbisID Edition	Supported
Community	No
Pro	Yes
Enterprise	Yes

Supported Protocol

Protocol	Port	Notes
SCIM 2.0 REST API (HTTPS)	443 TCP	Bearer token authentication

What OrbisID Discovers

Data	Source
User accounts	GET {baseUrl}/Users (all users, paginated)
User status (active/inactive)	active field on each SCIM User resource
Display name	displayName, name.formatted, or name.givenName + name.familyName
Primary email	First primary: true entry in the emails array
External ID	externalId field — links to source HR/IdM system if present
Groups	GET {baseUrl}/Groups (all groups, paginated)
Group memberships	members array on each SCIM Group resource
Privileged groups	Groups whose name contains admin, privilege, superuser, or root

Connection Requirements

Bearer Token

OrbisID authenticates to the SCIM provider using a Bearer token. How you obtain the token depends on the provider:

Provider pattern	How to obtain the token
Static API key	Generated once in the IdP admin console and stored permanently
OAuth 2.0 access token	Obtained via client credentials grant; must be refreshed before expiry

info

OrbisID stores the token in the encrypted credential and presents it on every scan request. If your provider issues short-lived OAuth tokens, generate a long-lived token or a service account API key instead, and refresh the credential in OrbisID before it expires.

Minimum permissions required on the SCIM service account / token:

• Read Users — list all user resources at /Users
• Read Groups — list all group resources at /Groups

Credential Mapping

OrbisID Field	SCIM Value
credential.password	Bearer token (OAuth access token or static API key)
credential.username	(Optional) Leave blank or use a reference label
system.hostname	Full SCIM 2.0 base URL (e.g., https://idp.example.com/scim/v2)

note

The Hostname field must contain the full SCIM base URL including the scheme (https://) and any path prefix. OrbisID appends /Users and /Groups to this value to construct the endpoint URLs.

System Attributes

The following optional attributes can be set on the target system record to adjust scanner behaviour:

Attribute key	Type	Default	Description
scimUsernameAttribute	String	userName	Custom SCIM attribute to use as the OrbisID account name. Leave unset to use the standard userName field.
scimDiscoverGroups	Boolean	true	Set to false to skip group discovery. Useful when the SCIM provider does not implement the /Groups endpoint.

Network Requirements

The OrbisID server (or On-Premise Agent) must have outbound HTTPS access on port 443 to the SCIM provider's base URL.

Configuration Steps

1. Obtain a Bearer token or API key from your SCIM identity provider with read access to users and groups
2. Create a Credential in OrbisID:
   • Username: (optional, e.g., scim-service-account for reference)
   • Password: The Bearer token or API key value
3. Navigate to Systems → Add System
4. Fill in the fields:

Field	Value
Name	Descriptive name (e.g., SCIM – idp.example.com)
Hostname	Full SCIM base URL (e.g., https://idp.example.com/scim/v2)
OS Type	SCIM 2.0
System Type	Directory Service
Credential	The Bearer token credential

5. (Optional) Add system attributes for advanced configuration:
   • Set scimUsernameAttribute if your provider uses a non-standard attribute for account names
   • Set scimDiscoverGroups to false if group discovery is not needed or unsupported
6. Click Test Connection — OrbisID issues a GET /Users?count=1&startIndex=1 probe and verifies that the response contains the SCIM schemas field
7. Click Save

Common SCIM Provider Examples

The SCIM 2.0 connector works with any RFC-compliant SCIM provider. The following examples show the typical base URL pattern for common providers:

Provider	Typical SCIM Base URL pattern
Microsoft Entra ID (Azure AD)	https://graph.microsoft.com/v1.0/... (use the Azure AD connector instead)
Okta	https://<domain>.okta.com/scim/v2
OneLogin	https://api.onelogin.com/scim/v2
JumpCloud	https://scim.jumpcloud.com/1/
Custom IdP	Provider-specific — consult your IdP documentation

tip

If OrbisID has a native connector for your provider (e.g., Okta, Ping Identity), prefer using that connector over SCIM 2.0 — native connectors retrieve more data and use provider-specific authentication flows.

Troubleshooting

Symptom	Likely Cause	Resolution
SCIM authentication failed – check the Bearer token	Invalid or expired Bearer token	Regenerate or refresh the Bearer token in your IdP and update the OrbisID credential
SCIM access denied – the Bearer token lacks required read permissions	Token does not have read access to /Users or /Groups	Verify that the service account or token scope includes read access to users and groups
SCIM API error 404	Incorrect base URL	Confirm the SCIM base URL; check whether the provider uses /scim/v2, /v2, or another path prefix
Empty response from SCIM /Users endpoint	Provider returned an empty body	Check that the base URL is correct and that the endpoint returns a valid SCIM ListResponse
No groups discovered	Provider does not implement /Groups	Set scimDiscoverGroups to false in system attributes to suppress group discovery errors
Accounts show no display name	Provider does not populate displayName or name fields	OrbisID falls back to userName or email; no action required
Connection test passes but scan returns 0 users	Token has permission to probe but not to list	Confirm the token scope includes full user listing, not just a count endpoint