Loading…
Topic
SCIM
4 posts about SCIM. Every summary links to the original.
- 4 posts
- 2 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Introducing SCIM Provisioning in ClickHouse Cloud
ClickHouse Cloud introduces SCIM 2.0 provisioning, making the identity provider the single source of truth for user membership and role assignments. Previously, SAML SSO handled authentication but left user invites and role updates as manual tasks, creating security risks. SCIM provisioning automatically syncs user create, update, and delete operations from the IdP using standard SCIM 2.0 endpoints, maps IdP groups to custom ClickHouse roles via stable external IDs, supports up to two API keys for rotation, and provides audit logging for all provisioning actions. The feature requires an active SAML connection, is limited to verified domain SSO users, excludes system roles like Admin, and revokes all keys if SAML is disabled. It is generally available for Enterprise and BYOC organizations, validated with Okta and Microsoft Entra ID, and eliminates manual invite and deprovisioning tasks.
Take User Provisioning to the Next Level with Entitlements
This workshop extends a React and Express.js Todo application’s SCIM-based user provisioning to include entitlements such as roles, licensing, and permissions for enterprise B2B SaaS use. Starting from completed SCIM workshop code, it adds a /Roles endpoint, database-backed roles, SCIM schemas and resource types, and TypeScript implementations that conform to SCIM responses and user resources. The walkthrough connects the API to an Okta SCIM application, discovers schemas and characteristics, and demonstrates synchronizing existing entitlements and assigning a custom is_tall characteristic to a user. It also discusses multi-tenant designs, where organization-specific roles can be addressed through an API key in the Authorization header, while recommending OAuth for production.
How to Manage User Lifecycle with .NET and SCIM
Managing users across multiple systems can be slow, error-prone, difficult to synchronize, and a security risk, so the tutorial uses SCIM to standardize lifecycle operations. It builds a .NET 8 SCIM server with RESTful CRUD endpoints for the User resource, backed by Entity Framework Core and SQLite, and seeds sample users and emails for testing. Swagger UI is used to inspect and exercise the API, while Okta acts as the SCIM client and identity provider after OAuth-protected endpoints and provisioning are configured. The walkthrough tests importing users, syncing assignments, deprovisioning by setting active to false, reprovisioning by setting it to true, and propagating profile changes; however, the original Okta CLI instructions no longer work exactly as written after the May 2025 plan and tooling changes.
Enterprise
This workshop shows SaaS developers how to add SCIM provisioning to an application so enterprise customers can manage users across systems, including people who have not yet logged in. It builds SCIM server functionality into a React and Express Todo application, connects it to an Okta client, and tests lifecycle operations such as importing, updating, deprovisioning, and reprovisioning users. The implementation follows SCIM 2.0 with JSON-based REST endpoints for creating, retrieving, filtering, updating, and deleting users, plus bearer-token authentication, SCIM content-type headers, logging, and soft deletion. It also explains production considerations, including unique identifiers and mapping each request’s API token to the correct organization for multitenancy. The completed application supports OIDC authentication alongside SCIM provisioning.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.