SCIM

Overview⁠

SCIM, short for System for Cross-domain Identity Management, lets your identity provider add and remove workspace members for you. It can also put people in teams based on the groups they belong to in your identity provider.

SCIM is part of the Enterprise plan. It attaches to an SSO connection, so your workspace needs one first. SAML and access control explains how to get a connection.

Only the workspace owner can set up or change SCIM. Other workspace admins can open Settings → Security and read the configuration. Members and guests cannot open that page.

Configure⁠

Create the directory⁠

1. Open Settings → Security and find your connection under Authentication methods. Its badge reads SCIM not configured.
2. Open the ... menu on the connection and choose Configure SCIM.
3. In the Configure SCIM directory dialog, enter a Directory name and an Identity provider identifier, for example okta. Select Configure.
4. Attia opens Save your SCIM credentials with an Endpoint URL and an API key. Copy both into your identity provider before you close the dialog, then select I saved these.

The API key is shown once. If you close the dialog without saving it, rotate the key to get a new one.

After this, the connection row shows a SCIM endpoint line with the URL, and the badge shows the state of the directory: SCIM active or SCIM disabled.

Rotate the API key⁠

Open the ... menu on the connection and choose Rotate SCIM API key. Attia opens the credentials dialog again with a new key, also shown once. Put the new key into your identity provider.

Workspace role⁠

People your identity provider adds through SCIM join the workspace as members. The Workspace role row under the connection says so: SCIM users join as Member.

You cannot map an identity provider group to the admin or guest role.

Map groups to teams⁠

SCIM in Attia does not create teams. You map a group value from your identity provider to a team that already exists, and Attia adds the people who carry that value to the team.

Both steps happen in the Group to team row under the connection.

Choose the attribute⁠

First tell Attia which SCIM attribute carries your group values.

1. Enter the SCIM attribute path your identity provider sends, for example urn:example:groups. A path can be up to 512 characters.
2. Select Configure team mapping.

The attribute must be a list of text values, and each value can be up to 255 bytes long. Once it is set, the row shows the attribute key Attia created for the directory and a sync status: Idle, Syncing, Needs retry or Deleting….

Add a mapping⁠

1. Type the IdP group value, for example engineering.
2. Pick a Team. Archived and retired teams are not offered.
3. Select Add team mapping.

Each mapping appears as its own row, the group value followed by the team. A new mapping also applies to people your identity provider has already provisioned, so you do not have to push them again.

A workspace can map up to 10 SCIM directories to teams.

What SCIM manages in a team⁠

Attia keeps track of which team memberships SCIM created, and treats them differently from the ones a person added.

• A membership SCIM created is managed from your identity provider. If you try to change or remove it in Attia, Attia refuses and tells you to change the IdP group or the SCIM team mapping instead.
• A membership someone added by hand stays theirs. SCIM never takes it over and never removes it.
• When your identity provider removes a person from the workspace, Attia clears the team memberships SCIM gave them.

Remove a mapping⁠

Select Remove on the mapping row. Attia shows what will happen before you confirm: People assigned only through this mapping will be removed from this team. Manual team memberships stay. Confirm with Remove mapping, or back out with Cancel.

Turn SCIM off⁠

Disable a directory⁠

Open the ... menu on the connection and choose Disable SCIM. The badge changes to SCIM disabled. People keep the team memberships SCIM already gave them, and SCIM grants no new ones while the directory is off. Enable SCIM in the same menu turns it back on.

Remove a directory⁠

Open the ... menu and choose Remove SCIM directory, then confirm with Remove directory. This stops provisioning and invalidates the API key. Attia also retires the directory's team mappings and removes the team memberships it provisioned. Memberships added by hand stay.

Finish a cleanup⁠

If a directory is deleted at the provider while Attia still holds its team mappings, the page keeps a row for it, titled SCIM directory and the directory's id. Select Finish cleanup on that row to remove the team memberships it provisioned.

If the workspace leaves the Enterprise plan⁠

When the plan no longer includes SCIM, Attia disables the workspace's SCIM directories and freezes their team mappings. Nothing is deleted.

Audit log⁠

Attia records SCIM changes in the workspace audit log. That covers requests to create, enable, disable or remove a directory and to rotate its key, each mapping added or removed, and each time SCIM changes who is in a team.