Data Quality user documentation
home/Data quality/Aperture Data Studio/Configuration/Configure SCIM provisioning

Configure SCIM provisioning

Overview

System for Cross-domain Identity Management (SCIM) is an open standard for automating user and group provisioning between an identity provider (IdP) and an application.

With SCIM provisioning, Aperture Data Studio can automatically create, update, and disable user accounts in response to changes made in your organization's identity management platform. This reduces manual administration and helps keep access in Aperture Data Studio synchronized with your organization's directory.

SCIM is typically used with single sign-on (SSO) technologies such as SAML. SSO authenticates users when they sign in, while SCIM manages user lifecycle and access provisioning.

SCIM provisioning supports both push and pull modes. The available provider configuration depends on the selected mode.

Configuration

Complete the following configuration to enable SCIM provisioning between your identity provider and Aperture Data Studio.

Before enabling SCIM provisioning, enable and configure SAML authentication with the appropriate setting. This allows users provisioned by the identity provider to be matched with the correct Aperture Data Studio user accounts.

SCIM integrations can operate in the following modes:

In this mode, Aperture Data Studio exposes a SCIM endpoint. The identity provider acts as the SCIM client and sends user and group changes to Aperture Data Studio.

Okta acts as the SCIM client and sends user and group provisioning changes to Aperture Data Studio via REST API.

Configure the SCIM connection in Okta
  1. In Aperture Data Studio, create a REST API key with the SCIM Provision permission.
  2. In Okta, configure the SCIM connector using the Aperture Data Studio SCIM base URL.
  3. Configure the authorization header using the environment external label and the API key in the following format:
    <Environment external label> <Your API Key>
  4. Test the connection to verify that Okta can communicate with Aperture Data Studio.
Configure SCIM mappings for Okta
  1. In Okta, configure the group as a push group.
  2. In Aperture Data Studio, enable SCIM provisioning for the selected environment.
  3. Add a SCIM mapping using an identity provider group name that exactly matches the corresponding Okta group name.
  4. Select the Aperture Data Studio role and, optionally, the Aperture Data Studio group to assign.

The Okta push group is now associated with the Aperture Data Studio mapping. Subsequent membership changes in Okta are sent to Aperture Data Studio. Aperture Data Studio then provisions or deprovisions the affected users and updates their mapped role and group assignments.

In this mode, Aperture Data Studio acts as the SCIM client and synchronizes users and group changes from the configured SCIM server.

The General provider option allows you to configure SCIM provisioning with any SCIM server that supports the SCIM 2.0 standard with token-based authentication.

  1. In Aperture Data Studio, enable SCIM provisioning for the selected environment and select Pull mode.
  2. Select General provider.
  3. In SCIM server URL, enter the SCIM server URL.
  4. In API token, enter the bearer token or server token required by the SCIM server.
  5. Save the configuration.
  6. Select Sync to retrieve the latest users and groups from the configured SCIM server.
  7. The synchronization runs in the background, and you can view the sync result on the same page.

The synchronization uses the SCIM server URL and API token to authenticate requests to the target SCIM server. Run Sync again whenever you want to retrieve changes from the server. The synchronization result indicates whether users and groups were created, updated, or skipped when no changes are required. If there are any errors, the synchronization result provides details about the error and the affected user or group.

The Microsoft Entra provider option allows you to configure SCIM provisioning with Microsoft Entra. Aperture Data Studio uses OAuth to authenticate with the Microsoft Entra SCIM server and retrieve user and group changes. Before configuring the provider, register an application in Microsoft Entra and obtain the OAuth credentials required to access the SCIM server. Make sure the application has permission to read the users and groups that you want to synchronize.

  1. In Aperture Data Studio, enable SCIM provisioning for the required environment. Next, select Pull mode.
  2. Select Microsoft Entra as the identity provider.
  3. In Tenant ID, enter the identifier of your Microsoft Entra tenant.
  4. In Client ID, enter the application ID of the registered application.
  5. In Client secret, enter the client secret created for the registered application.
  6. Save the configuration.
  7. Select Sync now to retrieve and synchronize the latest users and groups from Microsoft Entra.
  8. The synchronization runs in the background. You can view the sync result on the same page.

During synchronization, Aperture Data Studio uses the tenant ID, client ID, and client secret to obtain an OAuth access token and authenticate requests to the Microsoft Entra SCIM server.

Select Sync now whenever you want to retrieve the latest information from Microsoft Entra. The synchronization results show the numbers of users and groups that were created, updated, unchanged, or skipped. If an error occurs, the results identify the affected user or group and provide information to help resolve the problem.

Configure SCIM mappings

A SCIM mapping associates an identity provider group with an Aperture Data Studio role and, optionally, an Aperture Data Studio group.

Each mapping contains the following elements:

Identity provider group Aperture Data Studio role Aperture Data Studio group (optional)
The exact name of the group in the identity provider. The Aperture Data Studio role assigned to members of this group within the environment. The Aperture Data Studio group assigned to members of this group.
Aperture Data Studio

Configuration