Skip to main content

SSO SCIM Provisioning Configuration in Thoropass

C
Written by Claudio Morsella
Updated over 10 months ago

Overview:

SCIM is an SSO configuration that automatically sends user data from an SSO provider, to our Thoropass application. SCIM allows users to be automatically added to Thoropass, or deactivated in Thoropass, based on the provisioning in the SSO provider.

This document is a technical resource for SSO administrators who want to set up SCIM provisioning in Thoropass.

Getting Started:

Prerequisites needed before SCIM can be configured:

  1. Thoropass SSO login must be configured, before SCIM can be enabled
    See Thoropass SSO Setup Start Guide
    SSO login does not need to be enabled, but the SSO configuration in Thoropass will need to be in progress.

  2. A Thoropass API key is needed
    ​Please contact your Customer Success representative to request an API key for SCIM provisioning

Thoropass uses the SCIM 2.0 API, which is supported by most providers. This guide includes instructions for Azure and Okta, but the process is similar in other providers.

Note: Currently, Google Workspace does not support SCIM 2.0.

  1. Azure SCIM Setup Guide

  2. Okta SCIM Setup Guide

Azure SCIM Setup Guide

  1. In the Azure Portal, click Enterprise applications -> Thoropass SSO app

  2. Click Provisioning on the left sidebar and then click Provisioning again.

  3. Set Provisioning Mode to “Automatic”

  4. Set Tenant URL to the URL: https://api.thoropass.com/scim/v2

  5. Set the Secret Token to the Thoropass API key provided by your Thoropass Customer Success Manager.

  6. Once the configuration is “Saved”, ensure Provisioning Status is set to “On”.

Once Azure SCIM is Provisioned:

  • New Azure SSO users will auto-appear in Thoropass as Active Users

  • Deactivated SSO users will automatically be deactivated in Thoropass

Okta SCIM Setup Guide

  1. Go to Okta -> Applications -> select Thoropass

  2. In the General tab, click the edit button of App Settings

  3. Check Enable SCIM provisioning and click on save

  4. Click the tab “Provisioning”

  5. Set SCIM connector value to: https://api.thoropass.com/scim/v2

  6. Set Unique identifier value to: email

  7. Under support provisioning action select:

    1. Push New Users

    2. Push Profile Updates

    3. Push Groups

  8. On Authentication Mode select HTTP Header

  9. Set Authorization to the Thoropass API key provided by your Thoropass Customer Success Manager.

Once Okta SCIM is Provisioned:

  • New Okta SSO users will auto-appear in Thoropass as Active Users

  • Deactivated SSO users will automatically be deactivated in Thoropass

Did this answer your question?