How provisioning relates to assignment
Provisioning acts on the app’s effective users and groups, the users who have access through group assignment. Assignment decides who; provisioning turns that into real accounts. See Assigning access for how the effective set is built.Enable provisioning
Provisioning is configured per application, in the app’s draft. Once enabled, you point Iru at the app’s SCIM endpoint and choose which events to send.1
Turn on provisioning
Enable SCIM provisioning for the application.
2
Connect to the app
Provide the app’s SCIM base URL and the bearer token Iru should
authenticate with. Get both from the application you are provisioning into.
3
Choose how to match existing accounts
If the app already has accounts, set Match user on to Username or
Email so Iru reuses those accounts instead of creating duplicates. In
User Adoption, set User lookup to List all or One at a time.
List all is the default. Use One at a time when the app cannot
return every user.
4
Pick the events to send
Enable the operations you want Iru to perform: create users, update
users, and delete users. For removals, you choose separately what
happens when someone is unassigned from the app versus removed from the
directory (see below).
5
Map the attributes sent
The app’s mapping includes a provisioning view, so you control which
profile attributes Iru sends to the app when it creates or updates an
account.
6
Publish and activate
Set the draft as current and keep the app active. Provisioning runs while the
app is active and pauses when it is deactivated.
Provisioning sends accounts only for users who are assigned. If no one is
assigned yet, grant access first; see
Assigning access.
Look up users and groups
These settings are on each application. Use One at a time for an app that cannot list every user or every group, such as Google Cloud Identity. Choose Username for Match user on when the app searches users only by username.
List all and One at a time read the app differently. Both User lookup
and Group lookup use these values.
On Downstream Groups, One at a time still searches for an existing group
by name, so you can adopt it.
User lookup covers user reads. Group lookup covers group reads.
Update groups in the app
Iru uses Group update method when it updates a group and when it creates a group that is already linked. Choose PATCH when the app refuses PUT, such as Google Cloud Identity. With PATCH, Iru sends group attribute and membership changes as PATCH requests. A new group is created with no members, and its members are added after that. In the app’s mapping, a group row named members controls how each member is sent. You can turn membership management off there.What happens when access is removed
Removal has two triggers, and you choose what Iru does to the app account for each one independently:- Unassigned from the app: the user stays in your directory but is no longer in a group assigned to the app.
- Removed from the directory: the user’s directory record is deleted entirely.
These results do not depend on the action you picked above.
A common setup is Deactivate when someone is unassigned (so access can be
restored quickly) and Delete when someone is removed from the directory. Use
Do nothing for apps where you would rather clean up accounts by hand.
Group-linked provisioning
In addition to accounts, Iru can push groups to apps that support SCIM groups, so group structure is mirrored in the app. You choose which groups to push:- Application role groups: the groups tied to the app’s roles, or
- Selected groups: a specific set of groups you pick.
Run a sync manually
Iru syncs automatically as access changes, but you can force a sync when you need a change reflected right away (for example after fixing a configuration issue.Force user sync
From the app’s effective users, trigger a sync for a specific user to
re-send their account state to the app.
Force group sync
From the app’s effective groups, trigger a sync for a specific group to
re-send its membership to the app.
Review provisioning history
The application’s provisioning history shows each sync run and its outcome, so you can confirm what Iru sent and troubleshoot anything that failed. Each run summarizes how many records succeeded, are pending or waiting, or failed, broken out by application, users, and groups. Recent runs refresh on their own while they are still in progress. When something does not go through, a processing errors view lists the affected user or group, the operation attempted, and the error returned by the app; the detail you need to fix the cause and re-sync.Where to go next
Assigning access
Control who is provisioned by managing assignments and group membership.
Groups
Build the groups you push to apps and link to their groups.
Directory Sync
Bring users into the directory from your HR system (the inbound side).
Applications overview
Review the app, protocol, and version model.