SCIM 2.0 Configuration

SCIM (System for Cross-domain Identity Management) is an open standard used for automating user and group provisioning across systems.

SCIM 2.0 is the current version of the standard and defines REST-based APIs for identity provisioning and lifecycle management.

SCIM 2.0 Support in Kyvos

To meet enterprise identity management and security requirements, Kyvos supports SCIM 2.0 for automated user and group provisioning.

With SCIM 2.0 enabled, Kyvos integrates seamlessly with external Identity Providers (IdPs) with:

• Okta

• Microsoft Azure Entra ID, formerly Azure Active Directory (supported from Kyvos 2026.2.1 onwards)

This automatically creates, updates, deactivates, and manages users and groups in Kyvos.

Benefits

• Eliminates manual user administration

• Reduces operational overhead

• Improves security through centralized identity control

• Ensures compliance with enterprise IAM (Identity and Access Management) best practices

Important to know

• Kyvos supports Okta SCIM provisioning only for Kyvos Web Portal. It is not applicable to Kyvos Manager.

• Kyvos environment must be public to use it for SCIM provisioning.

• To configure SCIM in created SAML app. Refer to Add SCIM provisioning to app integrations | Okta Identity Engine

• Kyvos supports below authentication modes used in Okta SCIM app.

  • Basic Auth

  • OAuth2 with client credentials

 To configure a default role for SCIM users, perform the following steps.

1. For this, click the cluster name > Security > Kyvos Authentication on the navigation pane.

   Open

   

2. Click the Actions menu (…) > User Onboarding Configurations. The User Onboarding -Advanced Configurations dialog is displayed.

   Open

   

3. In the First Login Actions text box, enter the following configuration to define a default user role.

   {    "roleName": "Business User",    "sendWelcomeMailToUser": false,    "updatePreferences": false,    "defaultEntities": {     }  } 

4. Click Save to apply the configuration.

Okta SCIM 2.0 / SAML Application Configuration with Kyvos

This section describes how to configure SCIM 2.0 provisioning between Okta and Kyvos. You can configure provisioning using either of the following:

• Create a SCIM 2.0 Test Application directly in Okta, or

• Create a SAML application for Single Sign-On (SSO) and then enable SCIM provisioning on top of the SAML application.

1. Create an Application in Okta

1. Log in to the Okta Admin Console.

2. Navigate to Applications > Applications.

3. Click Create App Integration.

4. Select one of the following application types:

   • SCIM 2.0 Test App (Basic Auth)

   • SCIM 2.0 Test App (OAuth Bearer Token)

   • SAML 2.0 (if SAML-based SSO is required)

5. Complete the application creation process and save the application.

2. Enable SCIM Provisioning

1. Open the created application in Okta.

2. Navigate to the General tab.

3. Click Edit under App Settings.

4. Under Provisioning, select SCIM.

5. Save the configuration.

3. Configure SCIM Settings in the Provisioning Tab

1. Navigate to the Provisioning tab.

2. Open the Integration section and click Edit.

3. Configure the SCIM connector details as follows:

4. Select the required Supported Provisioning Actions, such as:

• Import New Users and Profile Updates

• Push New Users

• Push Profile Updates

• Push Groups

• Import Groups

5. Save the configuration.

4. Choose the Authentication Mode

Okta supports Basic Authentication and OAuth 2.0 for SCIM provisioning.

Option A – Basic Authentication

• If Basic Authentication is selected:

  1. Set Authentication Mode to Basic Auth.

  2. Provide the following credentials:

3. Save the configuration.

Option B – OAuth 2.0 (Client Credentials)

• If OAuth 2.0 is selected:

  1. Set Authentication Mode to OAuth 2.0.

  2. Set Grant Type to Client Credentials.

  3. Provide the following details:

4. Save the configuration.

5. Additional Requirement – Default Scope Configuration in Okta

When using OAuth 2.0 authentication, a default scope must be configured in Okta.

To configure default scope:

1. Navigate to Security > API > Authorization Servers in the Okta Admin Console.

2. Select the Authorization Server used for SCIM (for example, Default or a custom server).

3. Open the Scopes tab.

4. Click Add Scope.

5. Configure the following:

6. Save the configuration.

7. Ensure that the SCIM OAuth client is allowed to use this scope under Access Policies.

6. Enable Provisioning to Application

After the SCIM integration is successfully configured, Okta exposes two provisioning sections:

• To App

• To Okta

Configure Provisioning > To App

1. Navigate to Provisioning > To App.

2. Click Edit under Provisioning to App.

3. Enable the following options:

7. Kyvos OIDC Configuration Requirements

When using OAuth 2.0 authentication, the following configurations must be completed in Kyvos:

1. Configure a Confidential OIDC Application in Kyvos.

2. Enable the client_credentials grant type for the application.

3. Update the Kyvos OIDC configuration with:

   • Client Credentials Token Identifier

   • Mapped Kyvos Username associated with the token

Okta will obtain an access token using the client_credentials flow and include this token in the SCIM provisioning requests sent to Kyvos.

8. Final Validation

1. Use Test API Credentials in Okta to verify connectivity.

2. Assign users or groups to the application.

3. Verify that user creation, updates, and deactivation are correctly reflected in Kyvos.

Points to know

• Okta can integrate with Kyvos using SCIM 2.0 directly or SAML + SCIM provisioning.

• SCIM endpoint:

• Supported authentication methods:

  • Basic Authentication (Kyvos user name and password): SCIM-provisioned users (with basic authentication configured in the IdP) can log in to Kyvos using SAML or OAuth, provided that the corresponding authentication configurations are properly set up in Kyvos.

  • OAuth 2.0 Client Credentials (recommended for enterprise deployments)
    OAuth configuration requires:

    • A Confidential OIDC application configured in Kyvos. SCIM-provisioned users (with OAuth 2.0 Client Credentials configured in the IdP) can log in to Kyvos only through OAuth configured in Kyvos.

    • A default scope configured on the Okta Authorization Server

Once these configurations are completed, Okta–Kyvos SCIM provisioning will be successfully enabled.

Kyvos SCIM Provisioning with Microsoft Azure Entra ID (OAuth 2.0)

This section contains step-by-step process to configure SCIM provisioning between Microsoft Azure Entra ID (formerly Azure Active Directory) and Kyvos using OAuth 2.0 authentication.

Prerequisites

Ensure the following prerequisites are completed before starting the configuration:

• Administrator access to the Microsoft Azure Entra ID portal.

• Public URL of the Kyvos environment

• SCIM endpoint: <KYVOS_URL>/rest/scim/v2

• OAuth Client ID and Client Secret generated from the Azure Entra ID application

• OAuth token endpoint from the Azure Entra ID application

Kyvos Configuration Requirements

Before configuring provisioning in Azure, ensure the following configurations are completed in Kyvos:

• A Confidential OIDC configuration must be created in Kyvos. User must first create an application in the same tenant where the enterprise application will be created for SCIM. For more information, refer to Kyvos documentation.

• The same configuration used for Confidential OIDC in Kyvos must also be used in the Provisioning Configuration screen.

• Configure the Client Credentials Token Identifier and mapped Kyvos Username associated with the token while creating the Confidential OIDC configuration.

• Configure User Onboarding settings in Kyvos to assign a default role for provisioned users.

Step 1: Create an Enterprise Application in Azure Entra ID

1. Log in to the Azure Portal.

2. Navigate to Microsoft Entra ID.

3. Go to Enterprise Applications.

4. Click New Application.

5. Select Create your own application.

6. Enter the application name. For example: Kyvos SCIM Provisioning.

7. Select Integrate any other application you don't find in the gallery (Non-gallery).

8. Click Create.

Step 2: Configure Provisioning

1. Open the newly created Enterprise Application.

2. Navigate to Provisioning from the left panel.

3. Click New Configuration.
   
   

   Open

   

    

4. On the New Provisioning Configuration screen, configure the following fields.

5. Click Test Connection. If the credentials are correct, Azure will display Connection Successful.
   
   

   Open

   

    

6. Click Create. After successful configuration, you will be redirected to the Provisioning Overview page.

Step 3: Provisioning Overview

1. Navigate to the Provisioning Overview page.

2. The Provisioning Status will be Off by default.

3. Verify the Scope from the Properties tab: Sync only assigned users and groups

Step 4: Attribute Mapping (Mappings Tab)

1. Navigate to Provisioning > Mappings.

2. Verify the attribute mappings between Azure Entra ID and Kyvos. Ensure the attributes required for SCIM provisioning are correctly mapped.
   
   

   Open

   

Step 5: Assign Users and Groups

1. Navigate to Users and Groups.
   
   

   Open

   

    

2. Click Add User/Group.
   
   

   Open

   

    

3. Select the required users or groups.
   
   

   Open

   

    

4. Click Assign.

Step 6: Start Provisioning

1. Navigate to Provisioning > Overview.

2. Set Provisioning Status to On.
   
   

   Open

   

    

3. Click Save.

Azure will start the SCIM provisioning process.

Provisioning typically runs automatically every ~40 minutes. However, you can test provisioning immediately using Provision on Demand.

Step 7: Provision on demand

1. Navigate to the Provision on Demand tab.

2. Search for the user you want to provision.
   
   

   Open

   

    

3. Select the user.

4. Click Provision. Azure will immediately provision the selected user.
   
   

   Open

   

    

5. Once provisioning is complete:

   1. The user account will be automatically created in Kyvos with its default role.
      
      

      Open

      

   2. Provisioned users can log in to Kyvos only through the OAuth configuration configured in Kyvos.