SCIM and OAuth 2.0 Integration Guide

1. SCIM API Authentication (OAuth 2.0)

Our system acts as both:

• SCIM Service Provider (receiving provisioning requests)
• OAuth 2.0 Authorization Server (providing Bearer tokens for authentication)

Before configuring SCIM, you must obtain OAuth 2.0 client credentials or an Access token by contacting our support team. Once provided, you will enter these credentials in your IdP.

2. Configuring SCIM Provisioning

This section provides a step-by-step guide to configuring SCIM provisioning using OAuth 2.0 or Access token. The following screenshots illustrate the configuration process within an identity provider. Your UI may differ slightly, but the required fields will be similar.

Step 1: Create a New App Integration

A new SAML 2.0 application needs to be created in the identity provider.

SAML 2.0 should be used as the authentication method.

Step 2: Configure General Settings

The application requires a name and optional logo.

Step 3: Configure SAML Settings

SAML authentication settings require the correct endpoints.

Single Sign-On URL is the endpoint from which authentication requests are sent.

Audience URI uniquely identifies the system as a SAML service provider.

Application Username must be set to Email, as our SCIM integration uses email as the unique identifier.

Step 4: Configure SCIM Connection

In your identity provider, navigate to the SCIM connection settings and enter the following details:

🔹 Note: Group provisioning is not supported in this SCIM implementation, so leave "Push Groups" and "Import Groups" unchecked.

Step 5: Configuring Authentication

SCIM requests can be authenticated using the OAuth 2.0 flow. It is preferred to use the OAuth 2.0 flow as it provides a more secure and dynamic authentication method. However, if your identity provider does not support OAuth 2.0, you can use an access token as described in section 5.2.

5.1. OAuth 2.0 Flow.

The identity provider requires the correct OAuth 2.0 settings to issue Bearer tokens.

Click Test Connection or Authenticate to verify the integration. The access token endpoint is used to obtain a Bearer token, which is required for all SCIM API requests. Once configured, the identity provider will automatically request new tokens as needed.‍

5.2. Access token.

The identity provider requires the correct OAuth 2.0 settings to issue Bearer tokens.

Click Test Connection or Authenticate to verify the integration.

3. SCIM API Endpoints

SCIM Base URL

All SCIM operations use the following base URL: https://app.muchskills.com/scim/v2

Supported SCIM Operations

Filtering & Pagination

• Filtering: Supports eq (equals) on userName (email). Example:filter=userName eq "email@example.com"
• Pagination: Uses startIndex and count parameters.

Group Management

• The /Groups endpoint is available but only returns predefined roles (member, manager, admin).
• No support for custom groups or group membership management.

4. SCIM Field Mapping

SCIM allows mapping user attributes between your identity provider and MuchSkills. The table below maps SCIM user attributes to our internal system.

Enterprise User Extension

MuchSkills User Extension

5: Assign Users

1. Navigate to the Users or Assignments section in your identity provider.
2. Select users who should be provisioned in MuchSkills.
3. Click Assign or Enable SCIM Provisioning for selected users.
4. Enable automatic user provisioning if your identity provider has this setting.
5. Click Sync Now or Force Sync to trigger the initial synchronization.
6. Confirm that users appear in [Your App] under the Users section.

Details:

The following JSON schema represents a SCIM user object as used in our system. This example includes core user attributes, enterprise extension and MuchSkills extension fields.

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User",
    "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
    "urn:ietf:params:scim:schemas:extension:muchskills:2.0:User"
  ],
  "userName": "john.doe@example.com",
  "name": {
    "familyName": "Doe",
    "givenName": "John",
    "formatted": "John Doe"
  },
  "active": true,
  "title": "Software Engineer",
  "emails": [
    {
      "value": "john.doe@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "photos": [
    {
      "value": "https://example.com/avatars/john-doe.jpg",
      "type": "photo"
    }
  ],
  "addresses": [
    {
      "country": "UA",
      "region": "Ukraine",
      "locality": "Kyiv",
      "primary": true
    }
  ],
  "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
    "department": "Engineering",
    "manager": {
      "value": "jane.smith@example.com",
      "displayName": "Jane Smith"
    }
  },
  "urn:ietf:params:scim:schemas:extension:muchskills:2.0:User": {
    "profilePicture": "https://example.com/avatars/john-doe.jpg"
  }
}

7. Troubleshooting

The table below lists common issues encountered when integrating SCIM provisioning with OAuth 2.0 in identity providers like Okta and OneLogin.

Okta example:

‍

OneLogin example:

‍

‍

Microsoft Entra example: