Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
SailPoint Identity Security Cloud and IdentityIQ manage Living Security accounts through the SailPoint SCIM 2.0 connector. This guide connects a SCIM 2.0 source to Living Security and tests it with one account.
Living Security has not certified SailPoint in a live run. Living Security SCIM follows the SCIM 2.0 standard (RFC 7643 and RFC 7644). Its tests replay the requests the SailPoint SCIM 2.0 connector sends: schema discovery, account aggregation by page and by cursor, and active changes by PUT and PATCH. The SailPoint menu names below come from SailPoint documentation and can differ in your version. Check each step with the setup checklist and the Attributes tab.

What you need

  • A Living Security admin with permission to manage SSO and SCIM settings.
  • An administrator of SailPoint, or a setup link you send to one.
  • SSO is not required. If you use SSO, the SCIM userName must be the same value your SSO sends as the NameID: the person’s email address. See SSO and sub-organizations.

Set up the source

1

Create the SCIM token in Living Security

On the SCIM card, select Set up SCIM. Copy the SCIM base URL and the Bearer token. You can’t see the token again. See Set up a SCIM connection.
2

Create a SCIM 2.0 source

In SailPoint, create a source with the SCIM 2.0 connector. Name it Living Security.
3

Enter the connection

  1. Paste the SCIM base URL into Base URL.
  2. Set Authentication Type to API Token, and paste the SCIM token. SailPoint sends it as a bearer token.
  3. Select Test Connection.
The Living Security Checklist shows First request received and Connection test passed.
OAuth 2.0 with client credentials and Basic Authentication also work, but the SCIM card does not create them. Contact Living Security support if you need one. See API reference: Authentication.
4

Discover the schema

Run Discover Schema. SailPoint reads GET /Schemas and GET /ResourceTypes and builds the account and group schema from them. The schema includes the core user, the Enterprise extension and the Living Security extension.When your source sends a custom extension attribute for the first time, Living Security adds that extension to /Schemas. Run Discover Schema again to see it.
5

Aggregate accounts

Run an account aggregation. SailPoint reads every user with paged GET /Users requests. Living Security returns an exact totalResults, and supports both page numbers and cursors.
6

Create the provisioning policy

In the source’s Create Account policy, set these attributes:
7

Request one account

Grant access to the Living Security source for one test identity.

Test your setup

Follow Test your SCIM setup with one person first. In short:
  1. Select Test Connection on the source. On the Living Security Checklist tab, First request received and Connection test passed show Done.
  2. Grant access to the Living Security source for the test identity. First user received, then First user ready to sign in, show Done within a few minutes.
  3. Open the Attributes tab. Fix each item under What to fix, and check that Attributes received has the attributes you mapped. Compare with the SCIM attribute reference.
  4. To see the exact request SailPoint sent, look at Newest user on the Attributes tab, or search the SCIM events for the person’s email.
  5. Ask the test person to sign in. First sign-in by a SCIM user shows Done.
  6. Send one group. First group received shows Done.
  7. Disable the test account in SailPoint. The person shows as deactivated in Workforce → People.
When every step shows Done or Not used and the Health tab shows No warnings, widen the scope in SailPoint.

Troubleshoot

Each failed request has an LS-SCIM code in the error detail. SailPoint shows it in its provisioning logs. Open Troubleshoot SCIM → Health in Living Security for failed requests, held accounts and token expiry. Some changes succeed in SailPoint but are held in Living Security, for example a change that would remove your last owner. The SCIM card shows Held accounts. See Held changes. Every code is in the SCIM error reference. For a support request, select Copy diagnostics on the troubleshooting page. It has no names, email addresses or tokens.