SCIM Directory Integration with OneLogin

About SCIM Directory Integration with OneLogin

SCIM Directory Integration with OneLogin in Iru Endpoint allows you to set up SCIM-based user directory synchronization between OneLogin and Iru Endpoint, enabling automatic user and group provisioning and deprovisioning.

How It Works

The SCIM integration creates a secure connection between OneLogin and Iru Endpoint, enabling automatic synchronization of user and group data. When users or groups are added, modified, or removed in OneLogin, these changes are automatically reflected in Iru Endpoint through the SCIM protocol.

Prerequisites

Be sure to review the supported user and group attributes listed in the SCIM Directory Integration article.

Iru Endpoint
OneLogin

Get the SCIM Token and API URL

Complete these steps in Iru Endpoint first. You will need the SCIM access token and API URL when configuring OneLogin. For full details, see the SCIM Directory Integration article.

Open Integrations

In Iru Endpoint, click your name at the bottom of the left navigation, then select Integrations.

Screenshot of the account menu with Integrations option highlighted

Discover Integrations

Click Discover integrations in the upper-right of the Integrations page.

Add SCIM Protocol

On the SCIM protocol tile, click Add and configure.

Add new integration page with SCIM protocol tile and Add and configure button

Start Configuration

Click Get started.

Name the Integration

Enter a unique name for the SCIM integration.

Generate Authentication Token

Click Generate token. The SCIM integration uses an HTTP authorization header with a Bearer Token.

Configure a SCIM user integration screen with name field and Generate token button

Copy the Token

Click Copy token. The token will not be visible again after you click Done. Store it securely, as you will need it in the OneLogin tab.

Confirm and Complete Setup

Confirm that you have copied the token by checking the box, then click Done. You will return to the Integrations page.

Copy token and configure with your identity provider dialog with Copy token button

Access Integration Details

Click the ellipsis on the SCIM directory integration you created.

View Details

Select View Details.

Copy API URL

Copy the SCIM API URL (e.g. https://subdomain.api.iru.com/api/v1/scim). Your identity provider will require this. The URL displayed in your tenant may still show the api.kandji.io domain. The api.kandji.io version of the SCIM API URL will also work for this purpose.

Close Details

Click Close.

View user integration details modal with SCIM API URL and copy button

Switch to OneLogin Tab

Keep the token and API URL available, then switch to the OneLogin tab to create and configure the SCIM app integration.

Complete the Iru Endpoint tab first to obtain the SCIM token and API URL. You will enter these in the steps below.

Creating the SCIM Integration in OneLogin

Access OneLogin Admin Console

Log into your OneLogin admin console. (example: https://accuhive.onelogin.com/admin2)

Navigate to Applications

In the top navigation, hover over Applications.

Open Applications Menu

Click Applications in the dropdown menu.

OneLogin top navigation with Applications menu

Add New Application

Near the top-right, click Add App.

OneLogin Applications page with Add App button

Search for SCIM Provisioner

In the text field, enter SCIM Provisioner with SAML (SCIM v2 Enterprise).

Select SCIM Provisioner

Click on SCIM Provisioner with SAML (SCIM v2 Enterprise).

OneLogin Add App search with SCIM Provisioner with SAML option

Configuring SCIM Settings

Once in the SCIM Provisioner with SAML (SCIM v2 Enterprise) application, use the following steps to configure the SCIM settings. The following steps include provisioning users and groups (roles).

Application Information

Update Display Name

(optional) Update the app Display Name to something like Iru Endpoint SCIM Provisioner

Configure Portal Visibility

(optional) Choose whether to make the app visible in the OneLogin portal.

Add Application Icon

(optional) Add an icon.

Add Description

(optional) Add a description.

Save Configuration

After completing the basic configuration, click Save.

OneLogin SCIM app basic configuration with Display Name and Save

Parameters

Navigate to Parameters

Navigate to the Parameters page.

Add New Parameter

Click the add (+) button on the right.

OneLogin Parameters page with add parameter button

Enter Field Name

Enter email.value into the Field name.

OneLogin new parameter with email.value field name

Save Parameter

Click Save.

Configure Parameter Value

Select Email from the Value dropdown.

OneLogin email.value parameter with Email value selected

Save Configuration

Click Save.

Configuration

Navigate to Configuration

Navigate to the Configuration page.

Enter SCIM API URL

In the SCIM Base URL field, paste the SCIM API URL you copied from the Iru Endpoint tab (e.g. https://subdomain.api.iru.com/api/v1/scim). The api.kandji.io version of the SCIM API URL will also work for this purpose.

Enter Bearer Token

In the SCIM Bearer Token field, paste the token you obtained in the Iru Endpoint tab.

Enable API Connection

Click Enable to turn on the API Connection.

Save Configuration

Click Save.

OneLogin Configuration page with SCIM Base URL and Bearer Token fields

Provisioning

Access Provisioning Page

Go to the Provisioning page.

Enable Provisioning

Select the box to Enable provisioning.

Configure User Operations

Uncheck the boxes next to Create user, Delete user, and Update user.

Set Deletion Policy

For the option When users are deleted in OneLogin, or the user’s app access is removed…, choose Delete.

Set Suspension Policy

For the option When user accounts are suspended in OneLogin…, choose Suspend.

Save Configuration

Now, in the top-right, click Save to keep the initial configuration.

OneLogin Provisioning page with Enable provisioning and user operations

Provisioning Users and Roles to Iru Endpoint

Use the following steps to send users and OneLogin roles to Iru Endpoint via the SCIM integration.

OneLogin roles are synonymous to groups in Iru Endpoint, and are assigned to the SCIM configuration. When users are assigned to roles in OneLogin, they are then pushed to Iru Endpoint. Additionally, any roles assigned to the SCIM app are pushed to Iru Endpoint as groups.

Creating a Role

Navigate to Users

In the top navigation, hover over Users.

Access Roles

In the dropdown menu, click Roles.

Create New Role

Click New Role.

Name the Role

Give the Role a name.

Assign Apps to Role

Select the apps that should be assigned to the role. In this case, we selected the SCIM app.

Save Role

Click Save.

Assigning Users to the Role

Access Created Role

Click back into the role that was just created.

Navigate to Users

Click Users.

Create New Mapping

Under Users Added Automatically, click New Mapping.

Name the Mapping

Give the Mapping a name.

Configure Conditions

Create the conditions that meet your needs. For this example, choose Group membership as the criteria, but you can use other criteria like department.

Select Role Action

Under Actions, choose the role that should be applied.

Save Mapping

Click Save.

OneLogin only allows a user to be member of one group, so you can think of OneLogin groups like an attribute that describes the user similar to department or location. Use OneLogin roles if a user needs to be a member of more than one “group”.

For more information on Group provisioning, please see OneLogin’s documentation here.

If desired, users can also be added to the SCIM apps manually from each user’s record.

Adding a Rule to the SCIM App

Use the steps below to push one or more roles (Iru Endpoint groups) to Iru Endpoint in the OneLogin SCIM app.

Access Rules

In the SCIM app, click Rules.

Add New Rule

Click Add Rule.

Name the Rule

Give the rule a name.

Configure Action

Under Actions, choose Set Groups in from the first dropdown.

Select Mapping Source

Select Map from OneLogin.

Configure Role Mapping

In the For each field, choose role from the dropdown.

Set Role Value

In the with value that matches field, enter the SCIM Role to push to Iru Endpoint as a group.

Save Rule

Click Save.

Pushing Updates

Syncing: User and group syncing is one-way, meaning the SCIM app will send user information to Iru Endpoint only when there is new or updated information to be sent. For this reason, a “Sync Now” option is not needed in the Iru Endpoint web app.

If the SCIM app is updated in OneLogin, you will need to save the change and then use the Reapply entitlement mappings.

Access More Actions

Hover over the More Actions menu.

Reapply Entitlement Mappings

Click on the Reapply entitlement mappings option.

​About SCIM Directory Integration with OneLogin

​How It Works

​Prerequisites

​Get the SCIM Token and API URL

​Creating the SCIM Integration in OneLogin

​Configuring SCIM Settings

​Application Information

​Parameters

​Configuration

​Provisioning

​Provisioning Users and Roles to Iru Endpoint

​Creating a Role

​Assigning Users to the Role

​Adding a Rule to the SCIM App

​Pushing Updates

About SCIM Directory Integration with OneLogin

How It Works

Prerequisites

Get the SCIM Token and API URL

Creating the SCIM Integration in OneLogin

Configuring SCIM Settings

Application Information

Parameters

Configuration

Provisioning

Provisioning Users and Roles to Iru Endpoint

Creating a Role

Assigning Users to the Role

Adding a Rule to the SCIM App

Pushing Updates