SCIM Provisioning with OAuth 2.0 Client Credentials – Missing Capabilities in Custom Integration

[sudarsun]

Hi Team,

I’m currently working on setting up an app integration for SCIM provisioning, where I intend to use OAuth 2.0 with the Client Credentials grant type.

While reviewing the app catalog, I came across the following pre-built integrations:

• SCIM 2.0 Test App (Basic Auth)
• SCIM 2.0 Test App (Header Auth)
• SCIM 2.0 Test App (OAuth Bearer Token)

However, these options do not meet my requirements, as I would like to avoid using Basic Authentication or a long lived Bearer Token flow.

As an alternative, I created a custom app integration using SAML 2.0. With this setup, I was able to successfully enable SCIM provisioning and configure OAuth 2.0 with the Client Credentials grant type.

However, I’m encountering some limitations in the provisioning settings:

• Under “To App” settings → Provisioning to App, I only see the “Create Users” option.
  I am also interested in enabling additional capabilities mentioned below, which appear to be available in the pre-built integrations from the app catalog

  • Update User Attributes
  • Deactivate Users
  • Sync Password

• Additionally, under Attribute Mappings, the “Apply on” column only supports Create. The “Create and update” option is disabled.

Could you please help clarify whether this is a limitation of custom SAML + SCIM integrations, or if there is a way to enable these additional provisioning capabilities?

I would appreciate your guidance on this. Thank you in advance

[andrea]

Can you share what you see on the Provisioning tab for your custom SAML app? For a SAML app I have that I added Provisioning to, I see all the provisioning options available: Create Users, Update User Attributes, Deactivate Users, and Sync User Password

With the provisioning options properly enabled (e.g. Create Users and Update User Attribute), you should see the option to set the attribute mapping on the “To App” tab to “Create and update,” but I don’t believe that option will be available until the provisioning options are already enabled

[sudarsun]

For the new SAML Integration app that I created, this is what I see. (Note that I used dummy values for all SAML settings as I’m interested to try out only SCIM)

Please let me know if you need more details. Is there a pre-built app for SCIM with OAuth 2.0 Client Credentials flow that I can use from the catalog?

[andrea]

Hmm… I’m curious if the options are missing if you create a new app. Do you see the same options for any new SAML app you create, or do you only see a problem with this specific app?

[sudarsun]

It turns out to be a configuration thing. After I’ve enabled additional options here, they started to appear. Thank you for your support!

[andrea]

Awesome! Glad you got it working!