You are viewing limited content. For full access, please sign in.

Question

Question

SCIM user provisioning in LF Cloud

Laserfiche Cloud
Updated April 16
asked on April 16

Our Laserfiche cloud instance already has SSO/SAML set up for user accounts . We want to set up SCIM for automated user account provisioning and Group membership provisioning. Per the instructions, with SCIM, SSO is required to be set up first. Which is done.

The question that is not clear in the instructions is whether the first Run of  the SCIM provisioning will simply synch the existing SSO/SAML user accounts or whether it will create all new user accounts? 

0 0

Answer

SELECTED ANSWER
replied on April 16

If the SSO user accounts already have Federated ID populated, then SCIM should pair up any existing users with the corresponding Federated IDs.  I am pretty sure that changes the SCIM managed flag to Yes.

0 0

Replies

replied on April 16

In my experience, when SCIM is configured and the initial sync runs, it does not automatically convert or fully link existing SSO/SAML users. Those pre-existing accounts typically won’t have a Federated ID or be marked as SCIM-managed.

Users created through SCIM after that point will include a Federated ID and will be flagged as SCIM-managed.

For existing users, you generally have two options: either manually add the Federated ID to link them to SCIM, or remove and re-provision them through SCIM.

I haven’t seen cases where the first SCIM sync creates duplicate accounts for users that already exist with the same email address. It appears the system avoids duplication by recognizing existing accounts, though it doesn’t automatically convert them to SCIM-managed users.

0 0
replied on April 16

Hi Shawn,

Thanks for the reply. In this instance the existing SSO user accounts do indeed have a federated ID configured already. So do you think that means the first SCIM provisioning run will Synch with these existing accounts in Laserfiche and register them as SCIM manage? versus create new accounts? Even if we have to manually mark them as SCIM managed accounts, that would be OK.

0 0
SELECTED ANSWER
replied on April 16

If the SSO user accounts already have Federated ID populated, then SCIM should pair up any existing users with the corresponding Federated IDs.  I am pretty sure that changes the SCIM managed flag to Yes.

0 0
replied on April 16

Thanks! That's the answer I was looking for.

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.

Details
Related Posts
Loading ...