SCIM provisioning for user management

SCIM provisioning (Enterprise)

System for Cross‑domain Identity Management (SCIM) allows automatic user provisioning and de‑provisioning from your identity provider to Certorix.

Supported SCIM features

• Create users when assigned in IdP (e.g., Okta, Azure AD)
• Update user attributes (name, email)
• Deactivate users when removed from IdP (revokes access)
• Group mapping (assign roles based on IdP groups)

Enabling SCIM

1. Go to Company Settings → SCIM tab.
2. Click Enable SCIM.
3. Copy the SCIM base URL: https://certorix.com/api/scim/v2
4. Copy the Bearer token (generated automatically). This token is the SCIM secret.
5. In your IdP (Okta, Azure AD), create a new SCIM app using the base URL and bearer token.
6. Configure attribute mapping (see below).
7. Test connection.
8. Save.

Attribute mappings

Map these SCIM attributes to Certorix fields:

• userName → email (used for login)
• emails[0].value → email (alternate)
• name.givenName → firstName
• name.familyName → lastName
• active → status (true = active, false = deactivated)

Group mapping (role assignment)

1. In Certorix SCIM settings, define group mappings:
2. Example: IdP group 'Certorix Admins' → Certorix role 'Admin'
3. Example: IdP group 'Certorix Editors' → Certorix role 'Editor'
4. Up to 10 group mappings allowed.

When a user is assigned to a group in the IdP, Certorix automatically assigns the corresponding role. If a user belongs to multiple mapped groups, the highest privilege role is assigned (Admin > Editor > Viewer > custom).

De‑provisioning behavior

When a user is deactivated in the IdP (removed from app assignment or account disabled):

• Certorix sets the user status to 'Inactive' within 1 hour.
• Inactive users cannot log in.
• Their API tokens are revoked.
• Their audit log entries remain.
• Their created trees/facts remain (ownership unchanged).
• Admins can manually reactivate a SCIM‑managed user if needed.

SCIM logs

All SCIM operations are logged in the audit log with action type 'scim.user.created', 'scim.user.updated', 'scim.user.deactivated'.