OIPA SCIM Synchronization

OIPA also supports a scheduled SCIM sync when SSO is enabled.

Configure the cron expression in PAS.properties:

scim.schedule.time=0 30 0 * * *

Default Behavior

1. The scheduled job runs daily at 12:30 AM local time.

2. The implementation uses the client_credentials grant to obtain an access token.

3. The implementation calls oidc.scimUri.

4. The implementation reads SCIM Resources.

5. The implementation creates active users that do not exist.

6. The implementation updates user active and inactive statuses.

7. The implementation adds, reactivates, or dates out security group memberships.

SCIM-to-OIPA Attribute Mapping

SCIM Attribute	OIPA Mapping
active	OIPA user status
groups	OIPA security group names
name.familyName	Last name
name.givenName	First name
Primary email	Email
userName	OIPA client number