Skip to content

What is SCIM?

SCIM is an open standard, published as RFC 7643 and RFC 7644, that lets an identity provider create, update and deactivate user accounts in another application automatically over a REST API.

Updated

  • System for Cross-domain Identity Management
The directory adds, deactivates and regroups people. Each change lands in the audit log.

Operations

SCIM, explained

SCIM answers the half of identity management that single sign-on leaves open. Single sign-on decides whether somebody can get in; SCIM decides whether an account exists at all and what attributes it carries. Without it, a joiner has to be added by hand in every application and — the part that matters — a leaver has to be removed by hand in every application.

How Enclessa uses it

Enclessa supports SCIM 2.0 for each organisation, on the Enterprise plan, which includes single sign-on. A SCIM user is a membership of the organisation and a SCIM group is a team, so the directory can add people, deactivate them and keep team membership in step. Deprovisioning ends the membership in that organisation and nothing beyond it; the owner’s membership is never removed by provisioning. Each provisioning change is written to the audit log.