Integrating SailPoint with SCIM 2.0

The SCIM (System for Cross-Domain Identity Management) standard defines a schema and API to create, read, update, and delete identity and identity-related information on other systems. This standard creates a common language, by which a client system can communicate with many different servers in the same way.

This guide is designed to give specific information about the requirements and field definitions needed to configure a working instance of a SCIM 2.0 connector.

Supported Features

Using this connector, you can manage any SCIM 2.0 compliant target system. The SCIM 2.0 connector supports the following features:

• Load accounts
• *Provisioning
• *Password management
• *Access certifications (certification of entitlements connected to accounts)
• Addition of groups and entitlements
• Delete accounts

For more information on features, refer to Source Features.

The SCIM 2.0 connector supports multiple group objects such as group. Depending on the managed system to which you are connecting, you can configure entitlements and roles. You must add a new group schema and update the existing account schema using APIs. For more information, refer to listSchema API and createSchema API.

Method: POST
Uri: beta/sources/<source-id>/schemas
JSON Payload:
{
    "name": "Role",
    "nativeObjectType": "Role",
    "identityAttribute": "Id",
    "displayAttribute": "Name",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
{
    "name": "Id",
    "type": "STRING",
    "schema": null,
    "description": "Role Id.",
    "isMulti": false,
    "isEntitlement": false,
    "isGroup": false
},
{
    "name": "Name",
    "type": "STRING",
    "schema": null,
    "description": "Role name.",
    "isMulti": false,
    "isEntitlement": false,
    "isGroup": false
}
…
…
]
}

<Schema displayAttribute="Name" identityAttribute="Id" nativeObjectType="Role" objectType="Role">
    <AttributeDefinition name="Id" type="string">
        <Description>Role Id.</Description>
    </AttributeDefinition>
    <AttributeDefinition name="Name" type="string">
        <Description>Role name.</Description>
    </AttributeDefinition>
</Schema>

API Throttling

The SCIM 2.0 connector supports API throttling. The following headers are supported for throttling, per the SCIM standards:

• x-rate-limit-remaining
• x-rate-limit-limit
• x-rate-limit-reset
• x-rate-limit-retry-after-seconds

To update the maximum API call threshold percentage, configure the following attribute to check the x-rate-limit-reset header after the threshold. The default value is 100.

PATCH {apiUrl}/v3/sources/{sourceId}

[
 {
  "op": "add",
  "path": "/connectorAttributes/maxApiCallsThresholdPercentage",
  "value": "100"
 }
]

For Relax and Non Relax Configuration

If any target system does not send the response headers in SCIM 2.0 specification, the following parameters can be used to update the entry.

PATCH {apiUrl}/v3/sources/{sourceId}
[
 {
  "op": "add",
  "path": "/connectorAttributes/rateLimitHeaders",
  "value": {
   "limitHeader": "rate-limit-limit",
   "remainingHeader": "rate-limit-remaining",
   "limitResetHeader": "rate-limit-reset",
   "retryAfterHeader": "rate-limit-retry-after-seconds"
  }
 }
]

Password Management

Prerequisites

• Purchase the Password Management feature
• Work with SailPoint Services to implement the feature for your environment

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Supported Managed System

The SCIM 2.0 connector only supports SCIM 2.0 compliant / non-compliant managed systems; it does not support SCIM 1.1 or SCIM 1.0 compliant target systems.

Prerequisites

• A SCIM 2.0 compliant target system should be up and running.
• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.

• The SailPoint SCIM 2.0 connector requires the following endpoints with a valid response for connector execution:

  Note

  Not applicable if Non-compliant Server? is enabled.

  • /ServiceProviderConfig
  • /ResourceTypes
  • /Schemas
  • /ResourceTypes/User
  • /Schemas/urn:ietf:params:scim:schemas:core:2.0:User

Required Permissions

The service account used for the SCIM 2.0 connector should have permission to execute the following operations:

• get all users
• add user
• modify user

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.