Legacy SCIM User Provisioning

Note:

In OneTrust's Legacy SCIM Integration, only provisioning of users was supported. As of OneTrust 6.29, OneTrust encourages updating to the enhanced SCIM Integration. In addition to existing User Provisioning functionality available with the Legacy SCIM Integration, the enhanced SCIM Integration offers Site Admins the ability to utilize Group Provisioning to provision user groups in the OneTrust Platform. Group Provisioning also allows Site Admins to manage access for users by provisioning them to one or more user groups. Legacy SCIM Integration users can update their integration to use the enhanced SCIM Integration with Group Provisioning feature by completing the To enable the enhanced SCIM Integration with Group Provisioning procedure below.

OneTrust supports cross-domain identity management through the SCIM 2.0 specification. System for Cross-Domain Identity Management (SCIM) is an open specification to help facilitate the automated management of user identities and groups in cloud applications using RESTful APIs. This allows organizations to manage and update user information across domains and applications.

OneTrust's Legacy SCIM Integration leverages the Organization and Role attributes to describe subsets of users. Each OneTrust user will fall into a group that is a combination of both an organization and an assigned role.

Note:

OneTrust offers technical documentation about API integrations and calls through its Developer Portal. For more information, see Developer Portal Access.



Prerequisites: Things to Know

Prior to enabling SCIM, please review the information below.

Welcome Emails

Attention:

The Welcome Email (Directory User) email template is enabled by default in the OneTrust Platform. When SCIM is enabled, this template may send welcome notifications to all users provisioned at that time.

If your organization is not ready for users to receive these notifications, review and disable the Welcome Email (Directory User) template prior to enabling SCIM. Email templates can be disabled by completing the following procedure:

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select Email and branding > Email branding & templates. The Email branding and templates screen appears.

  3. Navigate to the Templates tab.

  4. Click the name of the template you want to disable. The Template details screen appears.

  5. Enable the Disable notifications > Email notifications setting. This will prevent the selected email notification template from being sent from the organization and all organizations below.

    Note:

    If a child organization has activated any of the Disable notifications settings or the Override setting within an email template, the child organization will no longer inherit the disable email template configuration set by the parent organization, even if the settings within the child organization are later deactivated. The email template within the child organization would then need to be manually disabled moving forward, if necessary.

To enable the enhanced SCIM Integration with Group Provisioning

Existing accounts that enabled Legacy SCIM User Provisioning prior to OneTrust 6.29 can enable the enhanced SCIM Integration with Group Provisioning by clicking the Enable button on the banner that appears on the User Provisioning screen.

If you'd like to enable the enhanced SCIM Integration with Group Provisioning, please complete following procedure. Then proceed with referencing SCIM User & Group Provisioning for documentation on the enhanced SCIM Integration. Otherwise, skip this procedure and proceed to To configure SCIM in OneTrust using the Legacy SCIM Integration.

CAUTION:

The enhanced SCIM Integration utilizes SCIM V3 APIs. Once you enable the enhanced SCIM Integration, SCIM V2 APIs will no longer return the same responses. Please keep this mind if you have custom integrations that rely on SCIM V2 APIs.

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select User Management > User Provisioning. The User Provisioning screen appears with a banner at the top of the screen.


  3. Click the Enable button on the banner. The Enable Enhanced SCIM Integration modal appears.
    Note:

    By enabling the enhanced SCIM Integration, the SCIM Base URL will be updated to V3. While it is not necessary to update the SCIM Base URL in your IdP, OneTrust recommends updating the SCIM Base URL to avoid any confusion in the future. However, SCIM Integration will continue to function regardless of whether this update is made.



  4. Click the Confirm button.

To configure SCIM in OneTrust using the Legacy SCIM Integration

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select User Management > User Provisioning. The User Provisioning screen appears.


  3. In the SCIM Base URL field, click the Copy URL button to copy the SCIM Base URL to your computer's clipboard.
    Note:

    You will need to provide the SCIM Base URL during the IdP configuration process. For more information, see the IDP Configuration section below.

  4. In the Organization field, select the default organizational group to which users should be assigned on creation through SCIM.
  5. In the Role field, select the default role to which users should be assigned on creation through SCIM.
    Note:

    External roles, such as Data Subject and Invited, cannot be selected in this field.

  6. Click the Save button.

To test connection in IdP

In order to test the connection in your IdP, you will need to either generate OAuth 2.0 client credentials or API keys with the SCIM scope using the Client Credentials screen or API Keys screen, respectively. For more information, see Managing OAuth 2.0 Client Credentials or Managing OAuth 2.0 API Keys.

Client Credentials Method

  1. Copy and paste the SCIM Base URL, Client ID, and Client Secret into your IdP.
    Note:

    Some IdPs may require that the access token be entered directly instead of the Client ID and Client Secret. For more information on generating an access token, see the To generate a token procedure in Managing OAuth 2.0 Client Credentials.

  2. Test the connection in your IdP.

API Keys Method

  1. Copy and paste the SCIM Base URL and API key into your IdP.
    Note:

    For more information, see Managing OAuth 2.0 API Keys.

  2. Test the connection in your IdP.

User and Group Attribute Mapping

OneTrust's implementation of SCIM utilizes a combination of standard and custom attributes to describe Users and Groups. The following tables describe the mapping of the attributes to the OneTrust access management properties.

User Attribute Mapping

SCIM Attribute Name

Description

Standard SCIM Attribute?

id

Unique and permanent identifier of the user within the application.

Value is assigned by the application during the creation of a user account.

Yes

externalId

Unique identifier assigned with the IAM system to an identity.

Yes

active

Status of the user account.

Yes

emails.work.value

Email address of the user.

Note:

The email address of the user cannot be changed.

Yes

userName

Email address of the user.

Yes

name.givenName

Given name (first name) of the user.

Yes

name.familyName

Family name (last name) of the user.

Yes

userType

Denotes the relationship of the user to the organization (Internal or External).

Yes

employeeNumber

User's employee ID.

Yes

division

Division with which the user is associated.

Yes

department

Department with which the user is associated.

Yes

manager

Email address of the user's manager.

Yes

Group Attribute Mapping

SCIM Attribute Name

Description

Standard SCIM Attribute?

id

The unique identifier of a group in the application.

Yes

displayName

The name of the user's role.

Yes

oneTrustGroup.description

The role and the organization that forms the group.

No

members

All valid users for organization/user combination.

Yes