> ## Documentation Index > Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Set up SCIM with PingOne or PingFederate > Connect PingOne or PingFederate outbound provisioning to Living Security SCIM: authentication, attributes, a test user, and troubleshooting. > [!NOTE] > > **Which SCIM setup applies to you?** These pages describe **Living Security SCIM**. Open the SCIM card in your settings. If the card shows **Set up SCIM**, or its **Mode** row says **Native SCIM**, these pages apply. If **Mode** says **Current SCIM**, your organization still uses the earlier SCIM setup. An admin can move it: see [Move from the earlier SCIM setup](https://docs.livingsecurity.com/features/settings/scim/connection.md#move-from-the-earlier-scim-setup). If the card says SCIM is set up and managed in the setup wizard, use [SCIM Provisioning](https://docs.livingsecurity.com/features/settings/scim.md). PingOne and PingFederate create, update and deactivate people in Living Security through SCIM. This guide connects Ping outbound provisioning to Living Security and tests it with one person. > [!NOTE] > > Living Security has not certified PingOne or PingFederate in a live run. Living Security SCIM follows the SCIM 2.0 standard (RFC 7643 and RFC 7644). Its tests replay the requests Ping sends: HTTP Basic authentication over TLS, `externalId` matching, and `PUT` for every change, including deactivation and group changes. The PingOne or PingFederate menu names below come from PingOne or PingFederate documentation and can differ in your version. Check each step with the [setup checklist](https://docs.livingsecurity.com/features/settings/scim/testing.md#the-setup-checklist) and the **Attributes** tab. ## What you need * A Living Security admin with permission to manage SSO and SCIM settings. * An administrator of Ping, or a [setup link](https://docs.livingsecurity.com/features/settings/scim/connection.md#send-a-setup-link-to-your-it-administrator) you send to one. * SSO is not required. If you use SSO, the SCIM `userName` must be the same value your SSO sends as the NameID: the person's email address. See [SSO and sub-organizations](https://docs.livingsecurity.com/features/settings/scim/sso-and-sub-organizations.md). ## Choose the authentication | Ping product | Use | How to get it | | - | - | - | | PingOne | **OAuth 2 Bearer Token**, with the Living Security SCIM token as the token | Create it on the SCIM card. | | PingFederate | **Basic** authentication | The SCIM card does not create Basic credentials. Contact Living Security support. | The SCIM card creates bearer tokens only. Living Security SCIM also accepts HTTP Basic over HTTPS, and OAuth 2.0 client credentials with the `scim:provision` scope, when Living Security support turns them on for your connection. PingFederate's bearer token method asks a token endpoint for a token with a user name and password, which Living Security does not offer. Use Basic for PingFederate. See [API reference: Authentication](https://docs.livingsecurity.com/features/settings/scim/api-reference.md#authentication). `GET /ServiceProviderConfig` lists only the methods turned on for your connection. ## Set up PingOne **1. Create the SCIM token in Living Security** On the SCIM card, select **Set up SCIM**. Copy the **SCIM base URL** and the **Bearer token**. You can't see the token again. See [Set up a SCIM connection](https://docs.livingsecurity.com/features/settings/scim/connection.md). **2. Create the SCIM connection** In the PingOne admin console, open **Integrations → Provisioning**, add a **New Connection**, and choose the **SCIM Outbound** connector. Name it `Living Security`. **3. Enter the connection** 1. Paste the SCIM base URL into **SCIM Base URL**. 2. Set **Authentication Method** to **OAuth 2 Bearer Token**, and paste the token as the bearer token. 3. Set **Auth Type Header** to **Bearer**. 4. Select **Test Connection**, then save. > [!TIP] > > The Living Security **Checklist** shows **First request received** and **Connection test passed**. **4. Map the attributes** In the connection's rule, map these attributes: | Living Security attribute | Source | Notes | | - | - | - | | `userName` | Email, or the attribute your SSO sends | **Required.** The person's email address. | | `emails[type eq "work"].value` | Email | **Required.** | | `name.givenName`, `name.familyName` | Given Name, Family Name | | | `title` | Title | | | `active` | Enabled | Deactivates the person when Ping disables them. | | `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department` | Department | Use the full URN. | Ping sends every update as a `PUT`, which replaces the whole user. An attribute that is not mapped is cleared in Living Security. **5. Choose who to provision** Set the rule's user filter to one test person or one small group first. Turn on the rule. ## Set up PingFederate **1. Get Basic credentials** Contact Living Security support for HTTP Basic credentials for your SCIM connection. Copy the SCIM base URL from the SCIM card. **2. Create the provisioning target** In PingFederate, add an SP connection for Living Security with **Outbound Provisioning**, and choose the **SCIM** connector. On **Configure Channels**, set the target: 1. **SCIM URL**: the SCIM base URL. 2. **SCIM Version**: **2.0**. 3. **Authentication Method**: **Basic Authentication**, with the user name and password from Living Security support. **3. Map the attributes** Map the same attributes as in the PingOne table above. Make the source of `userName` the email your SSO sends. **4. Choose who to provision** On the channel's source settings, limit the source to one test person or a small group first. Activate the channel. ### How Ping matches users Ping can match existing users on `externalId`. In Living Security, `externalId` is case-sensitive: `A123` and `a123` are different values. Keep the source of `externalId` stable, and do not change its case. `userName` matching is not case-sensitive. ## Test your setup Follow [Test your SCIM setup](https://docs.livingsecurity.com/features/settings/scim/testing.md) with one person first. In short: 1. Select **Test Connection** in PingOne, or activate the PingFederate channel. On the Living Security **Checklist** tab, **First request received** and **Connection test passed** show **Done**. 2. Put the test person in the rule's scope. **First user received**, then **First user ready to sign in**, show **Done** within a few minutes. 3. Open the **Attributes** tab. Fix each item under **What to fix**, and check that **Attributes received** has the attributes you mapped. Compare with the [SCIM attribute reference](https://docs.livingsecurity.com/features/settings/scim/attributes.md). 4. To see the exact request Ping sent, look at **Newest user** on the **Attributes** tab, or search the [SCIM events](https://docs.livingsecurity.com/features/settings/scim.md#review-received-scim-requests) for the person's email. 5. Ask the test person to sign in. **First sign-in by a SCIM user** shows **Done**. 6. Send one group. **First group received** shows **Done**. 7. Disable the test person in Ping. The person shows as deactivated in **Workforce → People**. When every step shows **Done** or **Not used** and the **Health** tab shows **No warnings**, widen the scope in Ping. ## Troubleshoot Each failed request has an `LS-SCIM` code in the error `detail`. Ping shows it in its provisioning logs. Open **Troubleshoot SCIM → Health** in Living Security for failed requests, held accounts and token expiry. | Code | Meaning and fix | | - | - | | [LS-SCIM-1001](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1001) | Authentication failed. Copy the SCIM base URL and a current token from the SCIM card into Ping again. A token sent to another region's base URL also fails. | | [LS-SCIM-1103](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1103) | A required attribute is missing. Map `userName` for users and `displayName` for groups. | | [LS-SCIM-1104](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1104) | A value has the wrong type. Correct the mapping, for example `active` must be true or false. | | [LS-SCIM-1107](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1107) | No usable email. Map the person's email to `emails[type eq "work"].value`. | | [LS-SCIM-1108](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1108) | More than one primary email. Mark exactly one email as primary. | | [LS-SCIM-1201](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1201) | The `userName` is already in use. Two Ping users map to the same `userName`, or Ping did not match an existing user. | | [LS-SCIM-1601](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1601) | Rate limited. No action: Ping retries after the `Retry-After` time. | | [LS-SCIM-1602](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1602) | Changes paused. No action: Ping retries. | | [LS-SCIM-1604](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1604) | Internal error. Retry. If it continues, contact Living Security support with the output of **Copy diagnostics**. | Some changes succeed in Ping but are held in Living Security, for example a change that would remove your last owner. The SCIM card shows **Held accounts**. See [Held changes](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md#held-changes). Every code is in the [SCIM error reference](https://docs.livingsecurity.com/features/settings/scim/errors.md). For a support request, select **Copy diagnostics** on the troubleshooting page. It has no names, email addresses or tokens. ## Related * [SCIM attribute reference](https://docs.livingsecurity.com/features/settings/scim/attributes.md) * [Test your SCIM setup](https://docs.livingsecurity.com/features/settings/scim/testing.md) * [SCIM error reference](https://docs.livingsecurity.com/features/settings/scim/errors.md) * [API reference and limits](https://docs.livingsecurity.com/features/settings/scim/api-reference.md) ## Related topics - [Set up a SCIM connection](https://docs.livingsecurity.com/features/settings/scim/connection.md) - [Living Security SCIM](https://docs.livingsecurity.com/features/settings/scim/overview.md) - [Set up SCIM with OneLogin](https://docs.livingsecurity.com/features/settings/scim-onelogin.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.