How does SCIM work?

Avatar
Laura CARBO

Info

More information about user provisioning and user authentication with Spacewell Asset can be found via the general User provisioning and authentication article.

General

The System for Cross-domain Identity Management (SCIM) is an open standard designed to simplify the management of user identities across multiple platforms. It defines a standardized schema and a RESTful API for performing CRUD (Create, Read, Update, Delete) operations on user and group resources. SCIM is widely used to automate user provisioning and deprovisioning in cloud-based applications.

The SCIM protocol allows full control over which information is shared with Spacewell (for example: which users or groups are synchronized, and which attributes for these users are included).

The protocol pushes data from Azure (Entra ID) to the Integration Platform, which then creates, updates, or deletes the corresponding user in Asset (the Axxerion backend)..

image-20260227-120255.png

High level flow User Provisioning

User Provisioning: Automatically create, update, or delete user accounts in connected applications.

  1. Users exist in the Azure Directory
  2. Create an application in Azure
  3. In Azure, configure and map the User and Group attributes that need to be shared with Spacewell
  4. In the integration platform, map the shared User and Group Azure attributes to Axxerion objects
  5. Assign users directly if no group mapping is required, or add users to the appropriate groups and then assign those groups to the configured application in Azure
  6. Enable provisioning in the Azure AD (Entra ID) application
  7. Azure runs the SCIM provisioning cycle every 40 minutes. During each cycle, Azure checks for new users, attribute changes, or deletions. If any changes are found, Azure sends the appropriate SCIM requests to Spacewell:

    1. Create request: A Create request is sent when Azure finds a user who is in scope but does not yet exist in Spacewell. Azure sends a SCIM POST /Users request with the mapped attributes to create the user.

      1. The Integration Platform sets the SCIM “id” field with the Axxerion SystemUser database ID. Azure stores this ID internally and uses it for all future PATCH and DELETE operations to ensure updates go to the correct user.

    2. Update request: An Update request is triggered when Azure detects that a mapped attribute (from the provisioning mappings) has changed. Azure sends a SCIM PATCH /Users/{id} request with only the modified attributes.

      1. Do NOT manually archive users in Axxerion: If a user is disabled in Azure, SCIM also disables the user in Axxerion. Later, if the customer re‑enables the user in Azure, Azure sends a SCIM Update (PATCH) request. Archival of users in Axxerion takes place based on deletion on Azure side, see below.

    3. Delete request: Deletion on the Azure side -> the user in Axxerion is archived

      1. If a customer permanently deletes a user in Azure, SCIM sends a Delete request, and Axxerion archives the user.

      2. Anonymize archived users: If required, there is an anonymization script in Axxerion that will anonymize archived users.

Info

When a user is soft deleted directly in Microsoft Entra ID before disabling the account, provisioning skips the user and Microsoft don't send disable request to IPAAS, so the user in Asset will remain active.

Info

It’s possible to restore disabled users.

It’s not possible to restore deleted (archived) users.

See Configuration guides SCIM for concrete steps on how to set up SCIM for your project

How about making changes to user data on Axxerion side?

Info

Mandatory fields/primary fields should not be updated on Axxerion side because when using SCIM, we consider Azure to be the single source of truth.

Other fields can be updated in Axxerion. As azure is not aware of a change, there will be no push of changes. But if and when Azure sends an update (possibly for another field), then Axxerion object data will again match Azure data, and any changes made on Axxerion side will be overwritten.

High level flow Group Management

Group Management: Manage group memberships and permissions.

When a user is assigned to a group in Azure, and this group is mapped to an Axxerion profile in the Integration Platform, the user will be assigned to the relevant Axxerion profile.

In relation to this, we recognize following actions:

  • Group addition
  • Group deletion/removal
  • Member addition
  • Member deletion (from group)

How about assigning Axxerion profiles to users in Axxerion?

Integration will not touch any profile assignments if they were established before the initial group  member addition.

Good to know

  • SCIM interface tackles users and groups sequentially (one by one)
  • No limit on nr of users

    • with a larger list of users or changes: ingestion time will increase

  • Cycle runs every 40min

Articles in this section