Free EditionAs enterprises steadily shift to cloud services and remote work, their usage of SaaS applications for productivity and scalability has greatly increased. Efficiently managing user identities across multiple applications is crucial for cybersecurity. System for Cross-domain Identity Management (SCIM) is a lightweight REST- and JSON-based standard developed to systematically manage identities across multiple platforms. User life cycle management becomes seamless with the use of SCIM user provisioning across enterprise applications.
ADSelfService Plus provides automated, real-time, just-in-time (JIT) user provisioning for enterprise applications using the SCIM protocol. Users can enjoy smooth access to the applications assigned to them right from their first login.
Without JIT provisioning, IT administrators must manually create accounts for users within each assigned application. This method is taxing, error-prone, and time-consuming, especially when numerous users and applications are involved. Using CSV files and custom APIs to perform this operation is also inefficient as it still consumes time, resources, and expenses. Moreover, manual provisioning hinders users' productivity as they depend on the IT team for first-time app access.
JIT provisioning, which is based on SAML, involves automatically creating accounts for users when they access an application for the first time. It overcomes the challenges of manual provisioning and allows users to securely and seamlessly access necessary enterprise applications.
SCIM provisioning involves a client and a service provider (SP). The client is any identity provider (IdP) such as ADSelfService Plus, and the SP is any enterprise SaaS app where users are provisioned. In SCIM, user and group identities are represented by a defined schema, known as the SCIM environment, containing encoded SCIM objects like usernames, roles, and addresses. The SCIM client or IdP stores and manages this SCIM environment while monitoring the user directory for changes.
When user identity creations, changes, or deletions are detected or triggered by the SCIM client, the SCIM objects exchange necessary information within the SCIM environment via REST APIs to provision users in the SP accordingly. REST APIs leverage common HTTP request methods, such as POST, GET, PUT, and DELETE, to perform create, read, update, and delete operations on identities. This makes SCIM a simple, easy-to-implement provisioning technique.
The following flow diagram shows how SCIM provisioning works when a user tries to log in to the Slack application for the first time.
ADSelfService Plus automates user provisioning for enterprise applications in real time using SCIM. It automatically creates accounts for users in applications assigned to them during their initial login. For instance, when a user who is assigned the Slack application through ADSelfService Plus logs in to Slack for the first time, an account is automatically created for them in Slack. With ADSelfService Plus, users can effortlessly access enterprise apps upon their initial login through secure SSO without waiting for an IT administrator to perform manual provisioning.
Enable JIT provisioning for necessary enterprise apps using ADSelfService Plus.
Easily configure JIT provisioning with a simple, user-friendly UI
