> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up SCIM with OneLogin

> Connect a OneLogin SCIM app to Living Security SCIM: token, attribute mappings, a test user, and troubleshooting.

> [!NOTE]
>
> **Which SCIM setup applies to you?** These pages describe **Living Security SCIM**. Open the SCIM card in your settings. If the card shows **Set up SCIM**, or its **Mode** row says **Native SCIM**, these pages apply. If **Mode** says **Current SCIM**, your organization still uses the earlier SCIM setup. An admin can move it: see [Move from the earlier SCIM setup](https://docs.livingsecurity.com/features/settings/scim/connection.md#move-from-the-earlier-scim-setup). If the card says SCIM is set up and managed in the setup wizard, use [SCIM Provisioning](https://docs.livingsecurity.com/features/settings/scim.md).

OneLogin creates, updates and deactivates people in Living Security through SCIM. This guide connects a OneLogin SCIM app to Living Security and tests it with one person.

> [!NOTE]
>
> Living Security has not certified OneLogin in a live run. Living Security SCIM follows the SCIM 2.0 standard (RFC 7643 and RFC 7644). Its tests replay the requests OneLogin sends: `PUT` for every user change, group lookup by name, and delete on deprovision. The OneLogin menu names below come from OneLogin documentation and can differ in your version. Check each step with the [setup checklist](https://docs.livingsecurity.com/features/settings/scim/testing.md#the-setup-checklist) and the **Attributes** tab.

## What you need

* A Living Security admin with permission to manage SSO and SCIM settings.
* An administrator of OneLogin, or a [setup link](https://docs.livingsecurity.com/features/settings/scim/connection.md#send-a-setup-link-to-your-it-administrator) you send to one.
* SSO is not required. If you use SSO, the SCIM `userName` must be the same value your SSO sends as the NameID: the person's email address. See [SSO and sub-organizations](https://docs.livingsecurity.com/features/settings/scim/sso-and-sub-organizations.md).

## Set up provisioning

**1. Create the SCIM token in Living Security**

On the SCIM card, select **Set up SCIM**. Copy the **SCIM base URL** and the **Bearer token**. You can't see the token again. See [Set up a SCIM connection](https://docs.livingsecurity.com/features/settings/scim/connection.md).

**2. Add the SCIM app in OneLogin**

In OneLogin, open **Applications → Applications → Add App**. Search for **SCIM Provisioner with SAML (SCIM v2 Enterprise)** and add it. Name it `Living Security`.

If you already use a OneLogin app for Living Security SSO, you can keep using it for sign-in and use this app for provisioning only.

**3. Enter the connection**

On the app's **Configuration** tab:

1. Paste the SCIM base URL into **SCIM Base URL**.
2. Paste the token into **SCIM Bearer Token**.
3. Select **Save**, then **Enable** next to **API Connection**.

> [!TIP]
>
> The Living Security **Checklist** shows **First request received**.

**4. Turn on provisioning**

On the **Provisioning** tab, turn on **Enable provisioning**. Choose what OneLogin does when a user is deleted or suspended: select **Suspend** so that Living Security keeps the person's history. **Delete** also works. See [Delete](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md#delete).

Clear **Require admin approval** for create, update and delete if you want changes to go out at once.

**5. Map the attributes**

On the **Parameters** tab, check these mappings. Select a field to edit it, and select **Include in User Provisioning**.

| Living Security attribute | Source | Notes |
| - | - | - |
| `userName` | Email | **Required.** Use the email your SSO sends. |
| `emails[type eq "work"].value` | Email | **Required.** |
| `name.givenName`, `name.familyName` | First Name, Last Name | |
| `title` | Title | |
| `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department` | Department | Use the full URN as the SCIM name. |
| `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber` | Employee ID, or another field that holds it | Use the full URN. |

> [!WARNING]
>
> OneLogin sends every user change as a `PUT`, which replaces the whole user. An attribute that is not in the request is cleared in Living Security. Include every attribute you want to keep in user provisioning.

**6. Choose who to provision**

On the **Users** tab of the app, or with a role, assign the people to provision. Start with one test person. To send groups, map a group source on the **Parameters** tab and select the groups to push under **Rules** or **Provisioning**, as your OneLogin version offers.

## Test your setup

Follow [Test your SCIM setup](https://docs.livingsecurity.com/features/settings/scim/testing.md) with one person first. In short:

1. On the **Configuration** tab, select **Enable** for **API Connection**. OneLogin reads the connection. On the Living Security **Checklist** tab, **First request received** and **Connection test passed** show **Done**.
2. Assign the test person to the app. **First user received**, then **First user ready to sign in**, show **Done** within a few minutes.
3. Open the **Attributes** tab. Fix each item under **What to fix**, and check that **Attributes received** has the attributes you mapped. Compare with the [SCIM attribute reference](https://docs.livingsecurity.com/features/settings/scim/attributes.md).
4. To see the exact request OneLogin sent, look at **Newest user** on the **Attributes** tab, or search the [SCIM events](https://docs.livingsecurity.com/features/settings/scim.md#review-received-scim-requests) for the person's email.
5. Ask the test person to sign in. **First sign-in by a SCIM user** shows **Done**.
6. Send one group. **First group received** shows **Done**.
7. Remove the test person from the app, or suspend them in OneLogin. The person shows as deactivated in **Workforce → People**.

When every step shows **Done** or **Not used** and the **Health** tab shows **No warnings**, widen the scope in OneLogin.

## Troubleshoot

Each failed request has an `LS-SCIM` code in the error `detail`. OneLogin shows it in its provisioning logs. Open **Troubleshoot SCIM → Health** in Living Security for failed requests, held accounts and token expiry.

| Code | Meaning and fix |
| - | - |
| [LS-SCIM-1001](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1001) | Authentication failed. Copy the SCIM base URL and a current token from the SCIM card into OneLogin again. A token sent to another region's base URL also fails. |
| [LS-SCIM-1103](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1103) | A required attribute is missing. Map `userName` for users and `displayName` for groups. |
| [LS-SCIM-1104](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1104) | A value has the wrong type. Correct the mapping, for example `active` must be true or false. |
| [LS-SCIM-1107](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1107) | No usable email. Map the person's email to `emails[type eq "work"].value`. |
| [LS-SCIM-1108](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1108) | More than one primary email. Mark exactly one email as primary. |
| [LS-SCIM-1201](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1201) | The `userName` is already in use. Two OneLogin users map to the same `userName`, or OneLogin did not match an existing user. |
| [LS-SCIM-1305](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1305) | Unknown filter attribute. OneLogin filtered on an attribute that `/Schemas` does not list. Correct the SCIM name in the mapping. |
| [LS-SCIM-1601](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1601) | Rate limited. No action: OneLogin retries after the `Retry-After` time. |
| [LS-SCIM-1602](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1602) | Changes paused. No action: OneLogin retries. |
| [LS-SCIM-1604](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1604) | Internal error. Retry. If it continues, contact Living Security support with the output of **Copy diagnostics**. |

Some changes succeed in OneLogin but are held in Living Security, for example a change that would remove your last owner. The SCIM card shows **Held accounts**. See [Held changes](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md#held-changes).

Every code is in the [SCIM error reference](https://docs.livingsecurity.com/features/settings/scim/errors.md). For a support request, select **Copy diagnostics** on the troubleshooting page. It has no names, email addresses or tokens.

### Re-provision a deleted person

If OneLogin deleted a person and you assign them again, OneLogin creates them again with the same `userName`. Living Security links the new SCIM user to the same person by email, so their history stays. See [Create the person again](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md#create-the-person-again).

## Related

* [SCIM attribute reference](https://docs.livingsecurity.com/features/settings/scim/attributes.md)
* [Test your SCIM setup](https://docs.livingsecurity.com/features/settings/scim/testing.md)
* [SCIM error reference](https://docs.livingsecurity.com/features/settings/scim/errors.md)
* [API reference and limits](https://docs.livingsecurity.com/features/settings/scim/api-reference.md)


## Related topics

- [Set up SCIM with PingOne or PingFederate](https://docs.livingsecurity.com/features/settings/scim-ping.md)
- [Set up a SCIM connection](https://docs.livingsecurity.com/features/settings/scim/connection.md)
- [Living Security SCIM](https://docs.livingsecurity.com/features/settings/scim/overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.