Entrust Identity as a Service™ Administrator Help
Click here to see this page in full context

Report errors or omissions

  1. Home >
  2. Manage provisioners using SCIM >
  3. Provision users from IDaaS

 

Provision users from IDaaS

Use this procedure to add users from IDaaS to your third-party application. The outbound provisioning process includes using groups and user attributes to identify the users that need to be provisioned. IDaaS integration templates include the mandatory user attributes needed for the user provisioning, but custom attributes can also be included as part of the provisioning process.

Step 1: Complete the prerequisitesStep 1: Complete the prerequisites

Before you begin, review and complete the following, as required:

Map IDaaS user attributes to the attributes that are expected by the third-party service. Consult your service documentation for help. If required, create custom user attributes in IDaaS. See Create and manage user attributes.

Identify the IDaaS users that need to be provisioned. In IDaaS, you select the users for provisioning using the Group option. If necessary, create the required groups and add the users to those groups. By default, provisioning searches all IDaaS users if no groups are selected. See Create and manage groups and Import groups.

Copy the information required to set up the OIDC relationship between IDaaS and the third-party service. To do this, open a text file with a text editor, copy and save the following information from the third-party service that you want to provision with IDaaS:

SCIM Server Endpoints (this is usually your domain, for example: mytenantID.mycompany.com

Client Secret of the third-party service

Issuer Client ID

Issuer URL

Step 2: Add the provisioner to IDaaSStep 2: Add the provisioner to IDaaS

Click > Resources > Provisioners. The Provisioners page appears.

Select Generic Integrations. The Add Provision page appears.

Enter a Name for the provisioner.

Select Enable to automatically enable the provisioner when it is created. By default, this setting is deselected.

Attention: Entrust recommends keeping this setting at the default (deselected) when in draft mode.

Select the Groups to provision all users from the selected groups. You can select more than one group.

Enter the SCIM Server Endpoints that you saved in Step 1: Prerequisites.

Example:
https://<tenantId.mycompany.com>/services/scim/v2/

where <tenantId.mycompany.com> is your service domain.

Note: SCIM Server Endpoints cannot be edited after the provisioner has been added to IDaaS.

Under User Attribute Mapping, do the following to map IDaaS user attributes to the attributes used by the third-party service:

Click . The SCIM Attribute dialog box appears.

Select the User Attribute Name from the drop-down list.

In the User Attribute to map to field, enter the user attribute value.

Click Save.

Repeat these steps to add more SCIM attributes.

Click Save. The provisioner appears on the Provisioner List page with an authorize () icon.

Step 3: Authorize and enable the provisionerStep 3: Authorize and enable the provisioner

Click next to the Provisioner you created in Step 2: Add the provisioner to IDaaS. The General Settings page appears.

Select the Authorization Method.

If you select OAuth as the Authorization Method, complete the following:

Enter the Client ID that you copied and saved in Step 1: Prerequisites.

Enter the Client Secret  that copied and saved in Step 1: Prerequisites.

Enter the Issuer URL that you copied and saved in Step 1: Prerequisites.

Open a text file and copy and paste the Redirect URI, and then save the file. You need it for Step 4: Add the IDaaS Redirect URI to your third-party service.

Click Fetch Configuration.

Click Authorize to acquire OAuth access and refresh tokens.

Follow the prompts that appear from your service to allow access. An Authorized message appears on the General Settings page to confirm successful authorization.

Click Send Test SCIM to do a SCIM call to your service. A message appears to confirm a successful SCIM call to your third-party service.

If you select API Key as the Authorization Method,do the following:

Enter the API Key from your provisioner.

Click Send SCIM Test to do a SCIM call to your service. A message appears to confirm a successful SCIM call to your third-party service.

Click Save to return to the Provisioners List page.

Note: If the Save fails, you may need to reauthorize and send a test SCIM again to save new refresh and access tokens.

On the  Provisioners List page, enable the provisioner as follows:

Under Actions for the new provisioner, click . The Enable Provisioner prompt appears.

Click Enable.

Step 4: Add the IDaaS Redirect URI to your third-party serviceStep 4: Add the IDaaS Redirect URI to your third-party service

If OAuth is used by your provisioner, you need to enter the IDaaS Redirect URI you copied in Step 2: Add a Provisioner to IDaaS to set up provisioning between IDaaS and your third-service. How you do this depends on the third-party service. Consult the third-party service documentation for more information.

Note: If you want to provision more than one IDaaS tenant, you must add the Redirect URI for each tenant.

The Redirect URI should be entered in the following format:

Example: https://<tenantname<.<locale>.trustedauth.com/api/web/v1/oauth/scim/redirect
where <tenantname>.<locale> is your IDaaS tenant name and locale code, for example, mycompany.us.

Step 5: Synchronize your usersStep 5: Synchronize your users

In IDaaS, click > Resources > Provisioners. The Provisioners List page appears.

Ensure that the provisioner is enabled.

Click and then select  . The Synchronize Provisioner dialog box appears.

Click Synchronize.

Recommendation: Check the Audit logs for errors after synchronizing your users for provisioning.

Note: Once a refresh token expires, you must re-authorize and repeat this step.

Step 6: Edit a provisionerStep 6: Edit a provisioner

In IDaaS, click > Resources > Provisioners. The Provisioners List page appears.

Click the name of the provisioner. The Edit Provisioner page appears.

Make your required changes and then click Save.

Attention: If you need to make edits to the provisioner, changing a group or attribute mapping triggers a large number of SCIM calls. Entrust recommends disabling the provisioner until you have completed all the required changes. When disabled, the only SCIM calls made are to are delete users or provisioners, as applicable. In addition, you may need to reauthorize the provisioner if an authentication configuration has changed.