Authdog

Enterprise guide

User Provisioning & SCIM

SCIM provisioning lets a customer's identity provider drive user and group lifecycle in Authdog. This guide generates a provisioning token, wires the IdP to the SCIM 2.0 service, maps groups to roles, and tests deprovisioning.

Prerequisites

  • An Authdog Enterprise plan with a selected project and environment.
  • Administrator access to Provisioning → SCIM in the console.
  • Administrator access to a SCIM-capable IdP.
  • A test user and test group in the IdP.
  • RBAC roles already defined when group-to-role mapping is required.

SCIM configuration is environment-specific. Start in development or staging with identities that cannot reach production data.

Implementation

1. Generate the provisioning token

Open the environment's SCIM provisioning page and copy the SCIM Base URL (service path /v1/scim/v2, the environment is resolved from the bearer token). Select Generate token, name it after the customer and IdP, and copy the full adscim_ token immediately, it's shown only once.

2. Configure the IdP

Set the tenant/base URL to the SCIM Base URL, authentication to bearer token, and paste the adscim_ token. Enable only the User and Group operations you need. Start with core identity fields both systems support, run a test sync, and inspect the resulting profile before adding more attributes.

3. Test users and groups

Assign one test user and group to the IdP provisioning app and trigger sync. In Authdog, verify the user and group appear with expected identity fields, the group has the test user as a member, and the token's Last used value updates.

4. Map groups to roles

Under Group → Role Mapping, match by Group name (case-insensitive) or External ID (exact), then choose the role to grant. If the group already exists, select Re-apply to existing groups. Mappings are additive, they don't remove existing manual assignments.

5. Test deprovisioning

Deactivate the test user upstream and trigger sync. Confirm the Authdog user is suspended or deleted, new sign-ins are blocked, and sessions stop validating. Also remove the user from the test group and verify access changes accordingly.

6. Operate tokens

Use separate, clearly named tokens per integration and monitor Last used to spot idle ones. Rotation replaces the secret immediately with no grace period, coordinate the Authdog and IdP update tightly. Revocation permanently marks a token inactive.

Security considerations

  • Treat SCIM tokens as privileged secrets that can modify users and groups.
  • Never place tokens in browser code, tickets, chat, or logs.
  • Use non-production identities for initial sync and destructive lifecycle tests.
  • Rotate only with an immediate IdP update plan, old credentials stop working at rotation.
  • Review direct role assignments, additive group mapping won't remove them.

Validation checklist

  • IdP uses the Base URL for the intended environment.
  • Bearer token begins with adscim_ and is stored only in the IdP.
  • Test user and group appear with expected identity fields.
  • Token Last used updates after sync.
  • Group mapping grants the intended role.
  • Upstream deactivation blocks user access.
  • Token rotation and emergency revocation are documented.

Troubleshooting

IdP reports unauthorized: confirm bearer formatting, token status, environment, and whether it was rotated or revoked.

Sync succeeds but no user appears: check the IdP assignment and provisioning logs, then confirm environment and Last used timestamp.

Group exists but role is missing: compare mapping type and value; re-apply rules for pre-existing groups.

Next steps