Skip to content

Provisioning members with SCIM

SCIM (System for Cross-domain Identity Management) is a standard that lets your identity provider, such as Okta, create and deactivate people in other tools. When you use SCIM 2.0 with Elaichi, a person who is added or deactivated in your directory is added or suspended in Elaichi. You do not need to send an invite to each new person.

Where to find it: Settings → SSO and SCIM, then SCIM provisioning and Group role mappings

Before you start

Requirement Details
Permission Manage SSO (sso:manage). View SSO (sso:view) lets you see the page but not change it.
Plan Gold or Black. SCIM has the same plan limit as SSO.
Verified domain SCIM can only provision people whose email address is at a verified domain of this organization. An address at any other domain is refused.

In the app, Elaichi asks you to confirm it’s you when you create a SCIM token or create or change a group role mapping. Only a person at a browser can create or revoke a SCIM token. An API token cannot.

What SCIM syncs

Resource What happens
Users Your identity provider creates and updates members. When it deactivates a user, Elaichi suspends that member.
Groups Groups appear in Elaichi after your identity provider provisions them.
Group role mappings You choose one Elaichi role for each SCIM group.

SCIM does not manage connections, toolboxes, or access to your organization’s MCP endpoint. When someone leaves, also review what they owned. See Transferring and offboarding.

Connect your identity provider

  1. Open Settings → SSO and SCIM and go to SCIM provisioning.
  2. Copy the SCIM 2.0 base URL.
  3. Click Create SCIM token. Give it a name that matches your provider, such as Okta SCIM.
  4. Confirm it’s you if Elaichi asks.
  5. Copy the bearer token. Elaichi shows it only once.
  6. Tick the box that says you stored it, then click Done.
  7. In your identity provider, create a SCIM application. Enter the base URL, use the bearer token to sign in, and assign users and groups.

The token list shows each token’s name, creation date, and last use. You will see Last used change after your provider connects.

Warning

Anyone with a SCIM token can add and change members and groups in this organization. Keep it as safe as a production secret.

Revoke a SCIM token

  1. In the token list, open the row menu for the token.
  2. Choose Revoke and confirm.

Your identity provider loses SCIM access right away. You cannot undo this. To restore provisioning, create a new token and put it in your provider.

Map groups to roles

A group role mapping gives every member of a SCIM group one Elaichi role. The diagram shows the path in words first: your identity provider sends users and groups to Elaichi, Elaichi lists the groups, you map each group to a role, and the role sets what the member can do.

SCIM group → Elaichi role 
flowchart LR
  IdP["Identity provider"] -->|"SCIM Users + Groups"| Elaichi["Elaichi"]
  Elaichi --> Groups["SCIM groups"]
  Groups --> Mapping["Group role mappings"]
  Mapping --> Roles["Built-in or custom role"]
  Roles --> Member["Member's permissions"]
  1. Wait for your identity provider to send its groups. They then appear under Group role mappings.
  2. For each group, click one role (built-in or custom).
  3. To remove a mapping, click the selected role again.

You will see the role highlighted for that group.

Rules for mappings:

  • A member holds exactly one role. While a mapping applies, the mapped role replaces the member’s role. It does not add to it.
  • A group with no role selected gives no role.
  • You cannot map Org Owner to a group. Roles that hold permissions you do not hold yourself are greyed out.
  • When you remove a mapping, its members go back to the default role for new members.
  • Each group has a member count. Click it to see the people in the group.

If the group list is empty, check that your SCIM application has groups assigned and has synced at least once.

Deactivate a person

When your identity provider deactivates or deletes a user through SCIM, Elaichi suspends that person’s membership in this organization. The person loses access to the organization. Elaichi keeps the membership record, so you can reactivate the user in your identity provider. The person’s Elaichi account stays if they belong to other organizations.

Suspension also ends the person’s connected-app approvals. If you reactivate the person, they must approve each connected app again.

Info

Connections that the person owned may still need attention. See Transferring and offboarding.

What to know