Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
OneLogin creates, updates and deactivates people in Living Security through SCIM. This guide connects a OneLogin SCIM app to Living Security and tests it with one person.
Living Security has not certified OneLogin in a live run. Living Security SCIM follows the SCIM 2.0 standard (RFC 7643 and RFC 7644). Its tests replay the requests OneLogin sends: PUT for every user change, group lookup by name, and delete on deprovision. The OneLogin menu names below come from OneLogin documentation and can differ in your version. Check each step with the setup checklist and the Attributes tab.

What you need

  • A Living Security admin with permission to manage SSO and SCIM settings.
  • An administrator of OneLogin, or a setup link you send to one.
  • SSO is not required. If you use SSO, the SCIM userName must be the same value your SSO sends as the NameID: the person’s email address. See SSO and sub-organizations.

Set up provisioning

1

Create the SCIM token in Living Security

On the SCIM card, select Set up SCIM. Copy the SCIM base URL and the Bearer token. You can’t see the token again. See Set up a SCIM connection.
2

Add the SCIM app in OneLogin

In OneLogin, open Applications → Applications → Add App. Search for SCIM Provisioner with SAML (SCIM v2 Enterprise) and add it. Name it Living Security.If you already use a OneLogin app for Living Security SSO, you can keep using it for sign-in and use this app for provisioning only.
3

Enter the connection

On the app’s Configuration tab:
  1. Paste the SCIM base URL into SCIM Base URL.
  2. Paste the token into SCIM Bearer Token.
  3. Select Save, then Enable next to API Connection.
The Living Security Checklist shows First request received.
4

Turn on provisioning

On the Provisioning tab, turn on Enable provisioning. Choose what OneLogin does when a user is deleted or suspended: select Suspend so that Living Security keeps the person’s history. Delete also works. See Delete.Clear Require admin approval for create, update and delete if you want changes to go out at once.
5

Map the attributes

On the Parameters tab, check these mappings. Select a field to edit it, and select Include in User Provisioning.
OneLogin sends every user change as a PUT, which replaces the whole user. An attribute that is not in the request is cleared in Living Security. Include every attribute you want to keep in user provisioning.
6

Choose who to provision

On the Users tab of the app, or with a role, assign the people to provision. Start with one test person. To send groups, map a group source on the Parameters tab and select the groups to push under Rules or Provisioning, as your OneLogin version offers.

Test your setup

Follow Test your SCIM setup with one person first. In short:
  1. On the Configuration tab, select Enable for API Connection. OneLogin reads the connection. On the Living Security Checklist tab, First request received and Connection test passed show Done.
  2. Assign the test person to the app. First user received, then First user ready to sign in, show Done within a few minutes.
  3. Open the Attributes tab. Fix each item under What to fix, and check that Attributes received has the attributes you mapped. Compare with the SCIM attribute reference.
  4. To see the exact request OneLogin sent, look at Newest user on the Attributes tab, or search the SCIM events for the person’s email.
  5. Ask the test person to sign in. First sign-in by a SCIM user shows Done.
  6. Send one group. First group received shows Done.
  7. Remove the test person from the app, or suspend them in OneLogin. The person shows as deactivated in Workforce → People.
When every step shows Done or Not used and the Health tab shows No warnings, widen the scope in OneLogin.

Troubleshoot

Each failed request has an LS-SCIM code in the error detail. OneLogin shows it in its provisioning logs. Open Troubleshoot SCIM → Health in Living Security for failed requests, held accounts and token expiry. Some changes succeed in OneLogin but are held in Living Security, for example a change that would remove your last owner. The SCIM card shows Held accounts. See Held changes. Every code is in the SCIM error reference. For a support request, select Copy diagnostics on the troubleshooting page. It has no names, email addresses or tokens.

Re-provision a deleted person

If OneLogin deleted a person and you assign them again, OneLogin creates them again with the same userName. Living Security links the new SCIM user to the same person by email, so their history stays. See Create the person again.