Skip to content

Integrating SailPoint with SCIM 1.1

The SCIM (System for Cross-Domain Identity Management) standard defines a schema and API to create, read, and update the identity and identity-related information on other systems.

This standard creates a common language, by which a client system can communicate with many different servers in the same way. SaaS providers (such as Salesforce) and other software vendors are beginning to adopt this standard, and are exposing their identity management interfaces through SCIM.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of an SCIM 1.1 source. SCIM 1.1 source can be used to connect to any target system supporting the SCIM 1.1 interface.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SailPoint SCIM 1.1 connector supports the following features:

Note

Before you can use any item above marked with an asterisk (*), SailPoint must activate the feature for your site.

  • Load accounts
  • *Provision accounts
  • *Password management
  • *Access certifications (certification of entitlements connected to accounts)
  • Discover schemas
  • Delete accounts

For more information on features, refer to Source Features.

Note

The Discover Schema feature in the source will work if the target system supports discover schema. With this feature, you can get the account schema defined in the target system. Go to Import Data > Account Schema and select Discover on the source UI.

Supporting Facebook Workplace

The SCIM 1.1 source supports the Facebook Workplace managed system.

For Facebook Workplace, the default source profile for SCIM 1.1 source must be updated with following two attributes:

  • formattedName (Type string, Enabled, Mapped to any name attribute)
  • active (Type boolean, Enabled, default value - true)

Supporting Group Hierarchy

The SCIM 1.1 source supports group hierarchy for the managed systems which support the SCIM 1.1 interface.

Supporting Group Entitlements

Group Entitlements enable SailPoint to aggregate additional details of these entitlement types from the managed system. These objects have separate schema-defining attribute list. The aggregation task fetches these objects as additional details when they're run for that Group Entitlement type.

Feature Groups
Aggregation ✔
Read group hierarchy ✔

Password Management

Purchase of the Password Management feature and Services engagement to implement the feature for your environment.

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

  • The password policy defined in SailPoint applies to accounts on this source.
  • If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Prerequisites

Administrator Permissions

The service account used for SCIM 1.1 source must have the permissions for the following operations:

  • get all users
  • add user
  • modify user
  • delete user

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.