SCIM 2.0 Provisioning

Nauthera implements SCIM 2.0 (RFC 7643/7644), allowing enterprise identity providers and directories to push user and group lifecycle events automatically — no manual user management required.

Available on: Business and Enterprise tiers.

Supported identity providers:

• Okta
• Microsoft Entra ID (Azure AD)
• OneLogin
• Any SCIM 2.0-compatible directory

#Supported Operations

Supported SCIM operations: GET, POST, PUT, PATCH, DELETE.

#Base URL

All SCIM endpoints are available under /scim/v2/:

https://auth.example.com/scim/v2/Users
https://auth.example.com/scim/v2/Groups
https://auth.example.com/scim/v2/ServiceProviderConfig
https://auth.example.com/scim/v2/ResourceTypes
https://auth.example.com/scim/v2/Schemas

#Authentication

SCIM endpoints authenticate via a Bearer JWT. The token must:

1. Have the admin scope.
2. Belong to a user who is a member of the admins group.

Obtain a long-lived admin token for your provisioning service account using the standard OAuth2 client_credentials grant, then configure it as the Bearer token in your directory's SCIM settings.

# Issue an admin token for the SCIM provisioning service account
curl -X POST https://auth.example.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=scim-provisioner&client_secret=$SECRET&scope=admin"

Important: The service account user must be in the admins group in Nauthera. Tokens without the admin scope or from users not in admins will receive 403 Forbidden.

#Configuring Okta

1. In Okta Admin, navigate to Applications → Your App → Provisioning.
2. Enable SCIM provisioning.
3. Set:
   • SCIM connector base URL: https://auth.example.com/scim/v2
   • Unique identifier field: userName
   • Supported provisioning actions: Push New Users, Push Profile Updates, Push Groups, Deactivate Users
   • Authentication mode: HTTP Header
   • Authorization: Bearer <your-service-account-token>
4. Click Test Connector Configuration to verify.

#Configuring Microsoft Entra ID

1. In Entra ID, navigate to Enterprise Applications → Your App → Provisioning.
2. Set Provisioning Mode to Automatic.
3. Under Admin Credentials:
   • Tenant URL: https://auth.example.com/scim/v2
   • Secret Token: <your-service-account-token>
4. Click Test Connection, then Save.
5. Under Mappings, verify the attribute mappings match your user schema.

#User Attributes

Nauthera maps SCIM user attributes to internal user fields:

#Group Sync

Groups created via SCIM are automatically available for use in AuthPolicy claim mappings and RBAC rules. Group membership is kept in sync — when a user is removed from a group in your directory, they are removed from the corresponding Nauthera group within the next provisioning cycle.

#Discovery Endpoints

The standard SCIM discovery endpoints are available without authentication:

# Service provider capabilities
curl https://auth.example.com/scim/v2/ServiceProviderConfig
 
# Supported resource types
curl https://auth.example.com/scim/v2/ResourceTypes
 
# Schema definitions
curl https://auth.example.com/scim/v2/Schemas

#Related

• User Management — manual user management via the admin API
• AuthPolicy reference — use groups in claim mappings and access policies
• Groups & RBAC — manage group membership