Setup Guide: OneLogin SCIM Provisioning | Axero Documentation

This guide explains how to configure automated user provisioning between OneLogin and Axero using SCIM (System for Cross-domain Identity Management). This setup automates creating, updating, and deactivating user accounts for your intranet.

Overview

• Preparation
• Step 1: Set Up SCIM Integration
• Step 2: Configure SCIM Data Mappings in Axero
• Step 3: Test the Integration
• Troubleshooting

Preparation

Before you begin, please ensure you have:

• Administrator access to your OneLogin portal
• Site Administrator access to your Axero site
• Completed the initial SAML SSO setup for OneLogin within Axero
• A test user account in OneLogin for verification

This process typically takes 20-30 minutes to complete.

Step 1: Set Up SCIM Integration

1. In your Axero site, go to Control Panel > System > Single Sign-On.
   
2. Reveal the SCIM User Provisioning section and copy the Bearer token.
   
3. In OneLogin, go to the Configuration tab of your Axero application.
4. Paste the bearer token from Step 2 into the SCIM Bearer Token field.
   
5. Copy and paste the following into the SCIM JSON Template field. Replace the highlighted placeholders with your Axero site URL:

   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User", "urn:scim:your-axero-site.com:custom:schema"],
     "userName": "{$parameters.scimusername}",
     "name": {
       "familyName": "{$user.lastname}",
       "givenName": "{$user.firstname}",
       "formatted": "{$user.display_name}"
     },
     "emails": [
       {
         "value": "{$user.email}",
         "type": "work",
         "primary": true
       }
     ],
     "urn:scim:your-axero-site.com:custom:schema": {
       "CustomFields": [
         {
           "key": "FirstName",
           "value": "{$parameters.FirstName}"
         },
         {
           "key": "LastName",
           "value": "{$parameters.LastName}"
         },
         {
           "key": "Email",
           "value": "{$parameters.Email}"
         },
         {
           "key": "ProfilePhoto",
           "value": "{$parameters.ProfilePhoto}"
         },
         {
           "key": "Phone",
           "value": "{$parameters.Phone}"
         },
         {
           "key": "ManagerEmail",
           "value": "{$parameters.ManagerEmail}"
         },
         {
           "key": "Company",
           "value": "{$parameters.Company}"
         },
         {
           "key": "Department",
           "value": "{$parameters.Department}"
         },
         {
           "key": "Title",
           "value": "{$parameters.Title}"
         }
       ]
     }
   }

   Copy
6. Under API Status, select Enable and click Save.
   
7. Go to the Provisioning tab.
8. Select Enable provisioning.
9. Deselect "Require admin approval" for create, delete, and update users if you do not want to manually approve these actions in OneLogin.
10. Click Save.
    
11. Go to the Parameters tab.
12. For each custom parameter that you would like to update automatically:
    1. Select the parameter.
    2. Select "Include in User Provisioning".
    3. Click Save.
       
13. Select the scimusername parameter.
    1. Select Email name part from the Value dropdown.
       
    2. Click Save.
14. Click Save.
    
    
    

Step 2: Configure SCIM Data Mappings in Axero

1. In your Axero site, go to Control Panel > System > System Properties.
2. Enable the following SCIM system properties:
   1. Set SCIMCustomAttributesEnabled = true
   2. Set SCIMCustomAttributesURNSchema = urn:scim:your-axero-site.com:custom:schema (Replace the highlighted placeholder with your Axero site URL. Do not include the http:// or https://)
      
3. Go to System > Single Sign-On.
4. Click the Data Mapping tab and select SCIM from the dropdown.
   
5. Delete existing mappings by clicking the trash icon next to each one.
6. Click Add and configure any of the following mappings that you want to sync automatically:

   Property Name	Field
   FirstName	First name
   LastName	Last name
   Email	Email
   ProfilePhoto	Profile photo
   Phone	Phone
   ManagerEmail	Reports to
   Company	Company
   Department	Department
   Title	Occupation

7. Add any additional attribute mappings that match your SAML configuration.
8. Click Update to save your changes.
   

Step 3: Test the Integration

1. In OneLogin, go to Users and select or create a test user.
2. Click Applications and assign the Axero application to this user.
3. Wait 2-3 minutes for provisioning to complete.
4. Verify in Axero that:
   • The user account was created with the correct attributes.
   • Updating the user's information in OneLogin syncs to Axero.
   • Removing the application from the user in OneLogin deletes their Axero account.

Troubleshooting

• Provisioning Issues: If provisioning fails for a user, go to the Users tab in OneLogin, select the user, scroll down, and click Reset login.
• Existing Axero Users: Users already in Axero won't be provisioned. Add them manually to the OneLogin application.
• Switching from SAML to SCIM: For users previously provisioned via SAML, reset their logins in OneLogin to enable SCIM provisioning.
• SCIM Deactivation: Only users provisioned via SCIM can be deactivated using SCIM.
• Sync Time: Changes between systems typically take 2-3 minutes. If changes haven't propagated after 5 minutes, check your configuration.