Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
PingOne and PingFederate create, update and deactivate people in Living Security through SCIM. This guide connects Ping outbound provisioning to Living Security and tests it with one person.
Living Security has not certified PingOne or PingFederate in a live run. Living Security SCIM follows the SCIM 2.0 standard (RFC 7643 and RFC 7644). Its tests replay the requests Ping sends: HTTP Basic authentication over TLS, externalId matching, and PUT for every change, including deactivation and group changes. The PingOne or PingFederate menu names below come from PingOne or PingFederate documentation and can differ in your version. Check each step with the setup checklist and the Attributes tab.

What you need

  • A Living Security admin with permission to manage SSO and SCIM settings.
  • An administrator of Ping, or a setup link you send to one.
  • SSO is not required. If you use SSO, the SCIM userName must be the same value your SSO sends as the NameID: the person’s email address. See SSO and sub-organizations.

Choose the authentication

The SCIM card creates bearer tokens only. Living Security SCIM also accepts HTTP Basic over HTTPS, and OAuth 2.0 client credentials with the scim:provision scope, when Living Security support turns them on for your connection. PingFederate’s bearer token method asks a token endpoint for a token with a user name and password, which Living Security does not offer. Use Basic for PingFederate. See API reference: Authentication. GET /ServiceProviderConfig lists only the methods turned on for your connection.

Set up PingOne

1

Create the SCIM token in Living Security

On the SCIM card, select Set up SCIM. Copy the SCIM base URL and the Bearer token. You can’t see the token again. See Set up a SCIM connection.
2

Create the SCIM connection

In the PingOne admin console, open Integrations → Provisioning, add a New Connection, and choose the SCIM Outbound connector. Name it Living Security.
3

Enter the connection

  1. Paste the SCIM base URL into SCIM Base URL.
  2. Set Authentication Method to OAuth 2 Bearer Token, and paste the token as the bearer token.
  3. Set Auth Type Header to Bearer.
  4. Select Test Connection, then save.
The Living Security Checklist shows First request received and Connection test passed.
4

Map the attributes

In the connection’s rule, map these attributes:Ping sends every update as a PUT, which replaces the whole user. An attribute that is not mapped is cleared in Living Security.
5

Choose who to provision

Set the rule’s user filter to one test person or one small group first. Turn on the rule.

Set up PingFederate

1

Get Basic credentials

Contact Living Security support for HTTP Basic credentials for your SCIM connection. Copy the SCIM base URL from the SCIM card.
2

Create the provisioning target

In PingFederate, add an SP connection for Living Security with Outbound Provisioning, and choose the SCIM connector. On Configure Channels, set the target:
  1. SCIM URL: the SCIM base URL.
  2. SCIM Version: 2.0.
  3. Authentication Method: Basic Authentication, with the user name and password from Living Security support.
3

Map the attributes

Map the same attributes as in the PingOne table above. Make the source of userName the email your SSO sends.
4

Choose who to provision

On the channel’s source settings, limit the source to one test person or a small group first. Activate the channel.

How Ping matches users

Ping can match existing users on externalId. In Living Security, externalId is case-sensitive: A123 and a123 are different values. Keep the source of externalId stable, and do not change its case. userName matching is not case-sensitive.

Test your setup

Follow Test your SCIM setup with one person first. In short:
  1. Select Test Connection in PingOne, or activate the PingFederate channel. On the Living Security Checklist tab, First request received and Connection test passed show Done.
  2. Put the test person in the rule’s scope. First user received, then First user ready to sign in, show Done within a few minutes.
  3. Open the Attributes tab. Fix each item under What to fix, and check that Attributes received has the attributes you mapped. Compare with the SCIM attribute reference.
  4. To see the exact request Ping sent, look at Newest user on the Attributes tab, or search the SCIM events for the person’s email.
  5. Ask the test person to sign in. First sign-in by a SCIM user shows Done.
  6. Send one group. First group received shows Done.
  7. Disable the test person in Ping. The person shows as deactivated in Workforce → People.
When every step shows Done or Not used and the Health tab shows No warnings, widen the scope in Ping.

Troubleshoot

Each failed request has an LS-SCIM code in the error detail. Ping shows it in its provisioning logs. Open Troubleshoot SCIM → Health in Living Security for failed requests, held accounts and token expiry. Some changes succeed in Ping but are held in Living Security, for example a change that would remove your last owner. The SCIM card shows Held accounts. See Held changes. Every code is in the SCIM error reference. For a support request, select Copy diagnostics on the troubleshooting page. It has no names, email addresses or tokens.