SCIM User & Group Provisioning

Note:

In OneTrust's Legacy SCIM Integration, only provisioning of users was supported. As of OneTrust 6.29, OneTrust encourages updating to the enhanced SCIM Integration. In addition to existing User Provisioning functionality available with the Legacy SCIM Integration, the enhanced SCIM Integration offers Site Admins the ability to utilize Group Provisioning to provision user groups in the OneTrust Platform. Group Provisioning also allows Site Admins to manage access for users by provisioning them to one or more user groups. Legacy SCIM Integration users can update their integration to use the enhanced SCIM Integration with Group Provisioning feature by completing the To enable the enhanced SCIM Integration with Group Provisioning procedure in the Legacy SCIM User Provisioning article.

OneTrust supports cross-domain identity management through the SCIM 2.0 specification. System for Cross-Domain Identity Management (SCIM) is an open specification to help facilitate the automated management of user identities and groups in cloud applications using RESTful APIs. This allows organizations to manage and update user information and group information across domains and applications.

The enhanced SCIM Integration utilizes User Provisioning and Group Provisioning to manage users and groups from your identity provider (IdP). With the enhanced SCIM Integration, Site Admins can manage user access from the IdP and keep user profiles in sync more easily. Site Admins can also leverage the ability to add roles to user groups, simplifying the assignment and removal of additional permissions of users. For more information on User & Group Provisioning, see the following table:

Method

Description

IdP - OneTrust Platform Integration

User Provisioning

Basic provisioning method that can be used to provision users individually.

Once users are successfully provisioned in your IdP, those users will be automatically created within the OneTrust Platform and will be assigned the role and organization configured on the User Provisioning screen.

Group Provisioning

Advanced provisioning method that can be used to bulk provision a group of users at one time. Group Provisioning also creates a user group in the OneTrust Platform.

Once groups are successfully provisioned in your IdP, those groups will be automatically created as user groups in the OneTrust Platform. If you provisioned certain users as members of that group in your IdP, those users will be automatically added as members of the respective user group in the OneTrust Platform.

Note:

For more information on user groups, see Managing User Groups.
Note:

OneTrust offers technical documentation about API integrations and calls through its Developer Portal. For more information, see Developer Portal Access.



Prerequisites: Things to Know

Prior to enabling SCIM, please review the information below.

Welcome Emails

Attention:

The Welcome Email (Directory User) email template is enabled by default in the OneTrust Platform. When SCIM is enabled, this template may send welcome notifications to all users provisioned at that time.

If your organization is not ready for users to receive these notifications, review and disable the Welcome Email (Directory User) template prior to enabling SCIM. Email templates can be disabled by completing the following procedure:

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select Email and branding > Email branding & templates. The Email branding and templates screen appears.

  3. Navigate to the Templates tab.

  4. Click the name of the template you want to disable. The Template details screen appears.

  5. Enable the Disable notifications > Email notifications setting. This will prevent the selected email notification template from being sent from the organization and all organizations below.

    Note:

    If a child organization has activated any of the Disable notifications settings or the Override setting within an email template, the child organization will no longer inherit the disable email template configuration set by the parent organization, even if the settings within the child organization are later deactivated. The email template within the child organization would then need to be manually disabled moving forward, if necessary.

To configure SCIM in OneTrust

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select User Management > User Provisioning. The User Provisioning screen appears.


  3. In the SCIM Base URL field, click the Copy URL button to copy the SCIM Base URL to your computer's clipboard.
    Note:

    You will need to provide the SCIM Base URL during the IdP configuration process. For more information, see IdP Configuration.

  4. In the Organization field, select the default organizational group to which users should be assigned on creation through SCIM.
  5. In the Role field, select the default role to which users should be assigned on creation through SCIM.
    Note:

    External roles, such as Data Subject and Invited, cannot be selected in this field.

  6. Click the Save button.

To test connection in IdP

In order to test the connection in your IdP, you will need to either generate OAuth 2.0 client credentials or API keys with the SCIM scope using the Client Credentials screen or API Keys screen, respectively. For more information, see Managing OAuth 2.0 Client Credentials or Managing OAuth 2.0 API Keys.

Client Credentials Method

  1. Copy and paste the SCIM Base URL, Client ID, and Client Secret into your IdP.
    Note:

    Some IdPs may require that the access token be entered directly instead of the Client ID and Client Secret. For more information on generating an access token, see the To generate a token procedure in Managing OAuth 2.0 Client Credentials .

  2. Test the connection in your IdP.

API Keys Method

  1. Copy and paste the SCIM Base URL and API key into your IdP.
    Note:

    For more information, see Managing OAuth 2.0 API Keys.

  2. Test the connection in your IdP.

User and Group Attribute Mapping

OneTrust's implementation of SCIM utilizes a combination of standard and custom attributes to describe Users and Groups. The following tables describe the mapping of the attributes to the OneTrust access management properties.

User Attribute Mapping

SCIM Attribute Name

Description

Standard SCIM Attribute?

id

Unique and permanent identifier of the user within the application.

This value is assigned by the application during the creation of a user account.

Yes

externalId

Unique identifier assigned with the IAM system to an identity.

Yes

active

Status of the user account.

Yes

emails.work.value

Email address of the user.

Note:

The email address of the user cannot be changed.

Yes

userName

Email address of the user.

Yes

name.givenName

Given name (first name) of the user.

Yes

name.familyName

Family name (last name) of the user.

Yes

userType

Denotes the relationship of the user to the organization (Internal or External).

Yes

employeeNumber

User's employee ID.

Yes

division

Division with which the user is associated.

Yes

department

Department with which the user is associated.

Yes

manager

Email address of the user's manager.

Yes

Group Attribute Mapping

SCIM Attribute Name

Description

Standard SCIM Attribute?

id

Unique identifier of a group in the application.

Yes

displayName

Name of the user's role.

Yes

members

All users that belong to the user group.

Yes