Setup Guide: OneLogin SCIM Provisioning | Axero Documentation

This guide explains how to configure automated user provisioning between OneLogin and Axero using SCIM (System for Cross-domain Identity Management). This setup automates creating, updating, and deactivating user accounts for your intranet.

Overview

• Preparation
• Step 1: Set Up SCIM Integration
• Step 2: Configure SCIM Data Mappings in Axero
• Step 3: Test the Integration
• Troubleshooting

Preparation

Before you begin, please ensure you have:

• Administrator access to your OneLogin portal
• Site Administrator access to your Axero site
• Completed the initial SAML SSO setup for OneLogin within Axero
• A test user account in OneLogin for verification

This process typically takes 20-30 minutes to complete.

Step 1: Set Up SCIM Integration

1. In your Axero site, go to Control Panel > System > Single Sign On.
   
2. Reveal the SCIM User Provisioning section and copy the Bearer token.
   
3. In OneLogin, go to the Configuration tab of your Axero application.
4. Paste the bearer token from Step 2 into the SCIM Bearer Token field.
   
5. Copy and paste the following into the SCIM JSON Template field. Replace the highlighted placeholders with your Axero site URL:

   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User", "urn:scim:your-axero-site.com:custom:schema"],
     "userName": "{$parameters.scimusername}",
     "name": {
       "familyName": "{$user.lastname}",
       "givenName": "{$user.firstname}",
       "formatted": "{$user.display_name}"
     },
     "emails": [
       {
         "value": "{$user.email}",
         "type": "work",
         "primary": true
       }
     ],
     "urn:scim:your-axero-site.com:custom:schema": {
       "CustomFields": [
         {
           "key": "FirstName",
           "value": "{$parameters.FirstName}"
         },
         {
           "key": "LastName",
           "value": "{$parameters.LastName}"
         },
         {
           "key": "Email",
           "value": "{$parameters.Email}"
         },
         {
           "key": "ProfilePhoto",
           "value": "{$parameters.ProfilePhoto}"
         },
         {
           "key": "Phone",
           "value": "{$parameters.Phone}"
         },
         {
           "key": "ManagerEmail",
           "value": "{$parameters.ManagerEmail}"
         },
         {
           "key": "Company",
           "value": "{$parameters.Company}"
         },
         {
           "key": "Department",
           "value": "{$parameters.Department}"
         },
         {
           "key": "Title",
           "value": "{$parameters.Title}"
         },
         {
           "key": "HireDate",
           "value": "{$parameters.HireDate}"
         }
       ]
     }
   }

   Copy
6. Under API Status, select Enable and click Save.
   
7. Go to the Provisioning tab.
8. Select Enable provisioning.
9. Deselect "Require admin approval" for create, delete, and update users if you do not want to manually approve these actions in OneLogin.
10. Click Save.
    
11. Go to the Parameters tab.
12. For each custom parameter that you would like to update automatically:
    1. Select the parameter.
    2. Select "Include in User Provisioning".
    3. Click Save.
       
13. Select the scimusername parameter.
    1. Select Email name part from the Value dropdown.
       
    2. Click Save.
14. Click Save.
    
    
    

Step 2: Configure SCIM Data Mappings in Axero

1. In your Axero site, go to Control Panel > System > System Properties.
2. Enable the following SCIM system properties:
   1. Set SCIMCustomAttributesEnabled = true
   2. Set SCIMCustomAttributesURNSchema = urn:scim:your-axero-site.com:custom:schema (Replace the highlighted placeholder with your Axero site URL. Do not include the http:// or https://)
      
3. Go to Control Panel > System > Single Sign On.
4. Click the Data Mapping tab and select SCIM from the dropdown.
   
5. Delete existing mappings by clicking the trash icon next to each one.
6. Click Add and configure any of the following mappings that you want to sync automatically:

   Property Name	Field
   FirstName	First name
   LastName	Last name
   Email	Email
   ProfilePhoto	Profile photo
   Phone	Phone
   ManagerEmail	Reports to
   Company	Company
   Department	Department
   Title	Occupation
   HireDate	Hire date

   Note: Capitalization matters here. Each Property Name has to match the matching key in the template above exactly, including upper and lower case, or the value arrives and is ignored. The same is true of the schema address you set as SCIMCustomAttributesURNSchema: it has to be character-for-character identical to the one in the template.

   Note: A start date is not part of the standard OneLogin user profile. Include the HireDate row only if you have a OneLogin custom user field holding it. Otherwise remove that entry from the template as well.

   Note: The ProfilePhoto mapping stores whatever OneLogin sends and does not copy the image into Axero. If the value is a web address, it has to stay reachable without a sign-in or the picture will not appear on the profile. The SAML sign-in does keep its own copy, so sites that want Axero to hold the image should map ProfilePhoto on the SAML side as well, and expect the picture to appear on the person's second sign-in rather than the first.

7. Add any additional attribute mappings that match your SAML configuration.
8. Click Update to save your changes.
   

Step 3: Test the Integration

1. In OneLogin, go to Users and select or create a test user.
2. Click Applications and assign the Axero application to this user.
3. Wait 2-3 minutes for provisioning to complete.
4. Verify in Axero that:
   • The user account was created with the correct attributes.
   • Updating the user's information in OneLogin syncs to Axero.
   • Removing the application from the user in OneLogin either deactivates or deletes their Axero account, depending on the setting described below.

Troubleshooting

• Provisioning Issues: If provisioning fails for a user, go to the Users tab in OneLogin, select the user, scroll down, and click Reset login.
• Existing Axero Users: Users already in Axero won't be provisioned. Add them manually to the OneLogin application.
• Switching from SAML to SCIM: For users previously provisioned via SAML, reset their logins in OneLogin to enable SCIM provisioning.
• Deactivate or delete: Unassigning someone from the OneLogin application produces one of two results in Axero, and which one you get depends on how the OneLogin application is set to handle removals. If OneLogin sends a suspend or disable, Axero marks the account inactive and the account and its content stay in place. If OneLogin sends a delete, Axero removes the account outright. Decide which behavior you want in OneLogin before you assign real people, because the two are not equally reversible.
• Before you allow deletes: When an account is deleted this way, the content that person created has to go somewhere. Choose the owner it should transfer to first, on Control Panel > System > Single Sign On, in the SCIM User Provisioning section, using Reassign content from deleted users to. Re-adding the person to the OneLogin application later does not bring back the deleted account or return the content that was transferred away.
• Deactivating people added another way: Only accounts that this connection created or has since matched can be deactivated through it. An Axero account that has never been touched by the OneLogin connection is unaffected by changes in OneLogin.
• Sync Time: Changes between systems typically take 2-3 minutes. If changes haven't propagated after 5 minutes, check your configuration.

Related pages

• OneLogin (what SCIM adds over sign-in alone)
• Setup Guide: OneLogin SAML SSO (the sign-in setup this builds on)
• System Properties (the two SCIM properties named above)