SCIM

The SCIM provider is a generic client for any identity system that exposes a standard SCIM 2.0 admin API (Okta, Azure AD, a homegrown IdP, etc.), instead of a vendor-specific management API. If your provider isn’t one of AUMS’s dedicated integrations but speaks SCIM, use this provider to manage it.

Feature availability

Feature	Support
User management	✅ Full (SCIM /Users)
Organizations	⚠️ Groups only, requires the SCIM /Groups endpoint
Audit logs	❌ Not supported (no audit log resource in SCIM)

Caution

SCIM (RFC 7642/7643/7644) does not define an audit log resource or an invitation resource. Organization member management works through group membership; invitations are not available for this provider.

Setup

1. Get SCIM credentials from your identity provider

   Most SCIM service providers issue a base URL (e.g. https://idp.example.com/scim/v2) and a bearer token scoped for provisioning. Create one from your IdP’s admin console (look for “SCIM provisioning” or “SCIM API token”).

   Testing locally, or building against your own SCIM server? Run cerberauth/scimply, a RFC 7642/7643/7644-compliant SCIM 2.0 server library for Go with an in-memory backend — it spins up a spec-compliant /Users and /Groups API in a few lines, so you can develop and test the AUMS SCIM provider without a real IdP.

2. Set environment variables

   PROVIDER=scim
   SCIM_BASE_URL=https://idp.example.com/scim/v2
   SCIM_BEARER_TOKEN=your-scim-bearer-token

   Optional:

   SCIM_GROUPS_ENABLED=true   # set to false if the service provider does not expose /Groups (default: true)

Note

SCIM_BASE_URL must point at the root of the SCIM 2.0 API — the provider appends /Users and /Groups to it. Requests are sent with an Authorization: Bearer <SCIM_BEARER_TOKEN> header and application/scim+json content type, per RFC 7644 §2.

Organizations

AUMS maps organizations onto the SCIM core Group resource (urn:ietf:params:scim:schemas:core:2.0:Group):

AUMS operation	SCIM API call
List orgs	GET /Groups
Create org	POST /Groups
Update org	PATCH /Groups/{id} (displayName)
Delete org	DELETE /Groups/{id}
List members	GET /Groups/{id} (members)
Add member	PATCH /Groups/{id} (add on members)
Remove member	PATCH /Groups/{id} (remove on members)

Set SCIM_GROUPS_ENABLED=false if your service provider does not implement /Groups — AUMS will report organizations as unsupported instead of failing at request time.

Note

Organization invitations are not supported for this provider — SCIM has no invitation resource. Add members directly once they exist as SCIM users.

User management notes

• Identifier — AUMS uses the SCIM userName as the email address when no primary email is set; otherwise the primary (or first) entry in emails is used.
• Active state — Blocking a user sets active to false on the SCIM resource.
• Email verification — SCIM’s core User schema has no email verification attribute, so users are always reported as verified.
• Display name — Read from name.formatted, falling back to name.givenName + name.familyName. AUMS writes givenName / familyName on create and update.
• Password — Sent as the SCIM password attribute (write-only) on create and update, when provided.
• Pagination — List results use SCIM’s startIndex / count query parameters and the totalResults field in the response.

OIDC login (optional)

If your SCIM service provider is fronted by an OIDC-compliant IdP, you can protect the AUMS dashboard with it independently of the SCIM connection:

AUTH_CLIENT_OPENID_CONFIGURATION_URL=https://idp.example.com/.well-known/openid-configuration
AUTH_CLIENT_ID=your-oidc-client-id
AUTH_CLIENT_SECRET=your-oidc-client-secret

Add <BASE_URL>/api/auth/callback/oidc to the allowed redirect URIs of your OIDC client.