SCIM provisioning — auto-create users from Entra or Okta

SCIM provisioning

Keystone exposes a SCIM 2.0 endpoint (RFC 7643/7644) so your identity provider — Microsoft Entra ID or Okta — can automatically create, update, and deactivate Keystone users without anyone re-keying them. Provisioned staff also get a linked People (HR) record automatically, the same as SSO and the Wonde sync.

Manage it under Admin → Integrations → SCIM provisioning (/admin/scim).

Google Workspace can’t point at a custom SCIM endpoint — its provisioning only targets apps in Google’s own catalogue. For Google trusts, use Google SSO + the Google directory sync instead (see the Google integration article).

The endpoint

Base URL	https://<your-keystone>/scim/v2
Users	https://<your-keystone>/scim/v2/Users
Groups	https://<your-keystone>/scim/v2/Groups

The exact URLs for your install are shown on the /admin/scim page. Discovery endpoints (/ServiceProviderConfig, /ResourceTypes, /Schemas) are also served for IdPs that query them.

Per-trust binding (important)

The endpoint URL is the same for every trust. A connector names which trust it provisions through its credential, not the URL — because Entra and Okta can’t send a custom workspace header.

So: when you create a token or OAuth client in /admin/scim, you pick the trust it provisions, and it is pinned to that trust. A credential can never reach another trust’s users, and it can’t be re-pointed. To provision a second trust, issue a second credential against it.

Authentication — two options

1. Bearer token (simplest)

1. On /admin/scim, choose Generate token, name it, pick the trust, and Create.
2. Copy the token immediately (it’s shown once).
3. In your IdP’s provisioning config, paste the Base URL as the Tenant URL and the token as the Secret Token.

Fully supported for “non-gallery” / custom SCIM apps, which is how trusts connect today.

2. OAuth 2.0 client credentials (more secure / gallery)

Short-lived, auto-refreshing tokens with no long-lived secret to circulate. This is the method required for the Microsoft Entra application gallery.

1. On /admin/scim, under OAuth clients, choose Create client, pick the trust, and Create.
2. Copy the Client ID and Secret (shown once).
3. In the IdP, configure the client-credentials grant with:
   • Token URL — https://<your-keystone>/scim/oauth/token
   • Client ID and Client Secret from step 2

The connector exchanges these for a 1-hour bearer token (grant_type=client_credentials, body or HTTP Basic) and uses it on SCIM requests.

What syncs

Users — create, update, and deactivate:

• userName is the login identity (matched case-insensitively).
• name.givenName / name.familyName / name.formatted, displayName, the emails array, and the enterprise extension (department, employeeNumber) round-trip as sent.
• Deactivation: setting active=false, or a DELETE, soft-deactivates the user (the row is retained and still returned on read, per Microsoft’s guidance); the linked Person is deactivated and given a leaving date.
• A duplicate userName create returns 409.

Groups — create, rename, delete, and membership (add/remove members via PATCH). Groups map to Keystone roles, scoped to the trust; internal platform roles aren’t exposed via SCIM.

People records — every provisioned staff user gets a linked Person (HR) record, so they appear in People with the right name, email and active state.

Microsoft Entra setup (custom app, today)

1. Entra admin centre → Enterprise applications → New application → Create your own application → “Integrate any other application you don’t find in the gallery”.
2. Open the app → Provisioning → Automatic.
3. Set Tenant URL to the Base URL and Secret Token to a token from /admin/scim (or configure the OAuth client-credentials option).
4. Test Connection, then Save.
5. Under Users and groups, assign the users/groups to provision, and turn provisioning On.

Entra syncs about every 40 minutes.

Okta setup

Okta speaks the same SCIM profile: create an app integration with Provisioning → SCIM, set the SCIM connector base URL and HTTP Header / OAuth auth to a Keystone token or OAuth client, then enable Create/Update/Deactivate.

Gallery listing

Appearing as a pre-integrated app in the Entra gallery (so trusts can add Keystone by name) is a separate Microsoft submission/partnership process. The technical prerequisite — the OAuth 2.0 client-credentials grant above — is in place, and the endpoint passes Microsoft’s SCIM validator.