Skip to content

Synkzone SCIM

Overview

The SCIM component lets your organization's identity provider (IdP) automatically create and deactivate users and groups in Synkzone. It implements the SCIM 2.0 standard (RFC 7643 and RFC 7644), so any SCIM-compliant IdP can manage access without manual work or custom integrations.

What it does

  • Creates users in Synkzone when they are assigned to the app in the IdP.
  • Deactivates users when they are unassigned or offboarded, so access is revoked promptly.
  • Manages groups and their memberships, where groups can be given zone memberships in Synkzone.

The IdP remains the source of truth. Changes made in the IdP flow to Synkzone, not the other way around.

Synkzone users

The Synkzone users are largely immutable. This means that once created some attributes such as UserId, email address and RealName cannot be modified by any administrator in the organization (and thus not by the SCIM system). Due to security requirements, only the user themselves are allowed to make changes. The UserId cannot be changed at all after creation of the user.

Synkzone Groups

A Synkzone Group contains of one or several group administrators and members. When creating and managing groups using SCIM, the user that provided the token for management will become the manager of the group in Synkzone. Only the users that are managers will be able to handle memberships in the group.

How it works

  1. Configuration: An operator enables and deploys SCIM in Synkzone and generates an authentication token. An administrator of the Synkzone organization creates a token to allow SCIM to make changes in the organization.
  2. Connection: The operator enters these in the IdP's provisioning settings.
  3. Synchronization: When users or groups change, the IdP sends HTTPS requests to the SCIM endpoints. The component validates the request, applies the change, and returns a SCIM-formatted response.
  4. Result: Synkzone reflects the current state of users and groups defined in the IdP.

Supported endpoints

Endpoint Methods Purpose
/scim/Users GET, POST, DELETE Manage user accounts
/scim/Groups GET, POST, PUT, PATCH, DELETE Manage groups and memberships
/scim/Schemas, /ResourceTypes GET Describe supported schemas and resource types
/scim/v2/ServiceProviderConfig GET Describe supported SCIM features

Limitations

  • Users created manually in the application are not managed by SCIM.
  • Update of user attributes, e.g. name, email address, is not reflected to the Synkzone user.
    • After creation of the user, only the user itself can do changes to email address and external user name.
    • The user id can never change.
    • Removal/deactivation of a user in the IdP results in a deactivated Synkzone user.

Getting started

Suggested setup to enable SCIM in a Synkzone Organization:

  1. Create tokens (see Tokens)
  2. Decide on configuration for SCIM properties (see Properties)
  3. Deploy Synkzone SCIM component
  4. Configure application (see an example in Entra ID configuration)
  5. Verify provision from your IdP
  6. Verify sign in using your IdP