› How to › How to set up SCIM provisioning

How to set up SCIM provisioning

System for Cross-domain Identity Management (SCIM) is a standard protocol that identity providers use to provision users and groups to the applications your organization uses. With SCIM, your identity provider sends users, groups, and group membership to Printix as the changes occur, instead of Printix requesting the information from your directory. You decide which users and groups your identity provider sends, and your identity provider records each provisioning operation, so you can audit what was shared.

Set up SCIM provisioning if your organization requires this level of control over the information that Printix receives from your directory. SCIM provisioning replaces scheduled synchronization for the directory or domain you set it up for, so your identity provider becomes the only source of group information. Otherwise, continue to use scheduled synchronization, which requires no configuration in your identity provider. See How to enable Microsoft Entra groups.

Microsoft Entra ID and Okta both support SCIM provisioning. You must be a system manager in Printix, and an administrator in your identity provider, to complete the setup. Groups provisioned with SCIM appear on the Groups page and work the same way as groups that are synchronized on a schedule.

Nested groups are not supported.

Perform the following:

See also:

Set up SCIM provisioning in Printix

Start here. This procedure produces the values required to configure your identity provider.

Your identity provider must already be connected. See How to enable Microsoft Entra authentication or How to enable Okta authentication.

  1. In Printix Administrator on the Authentication Authentication page, select the Microsoft Entra ID tab or the Okta tab.
  2. Start the group synchronization setup:

    • On the Microsoft Entra ID tab, select Set up SCIM provisioning.

    • On the Okta tab, in the card for your Okta domain, select Get started next to Group synchronization. If you have connected more than one Okta domain, set up SCIM provisioning for each domain separately.

    The Group synchronization with SCIM dialog box appears.

  3. Under Select authentication method, select the method your identity provider supports:

    • Configure SCIM with OAuth client credentials, which is selected by default. Printix provides a Client ID, a Client secret, a Token endpoint, and the SCIM url. Okta supports this method with the client credentials grant.

    • Configure SCIM with long lived access token. Printix provides a SCIM token and the SCIM url. Select this method for Microsoft Entra ID, which authenticates with a token that you paste into Secret Token. Okta also supports this method.

  4. Select Disable scheduled synchronization and use SCIM instead.

    Continue remains unavailable until you select the checkbox. SCIM provisioning replaces scheduled synchronization, so from now on, your identity provider is the only source of group information for this directory or domain.

  5. Select Continue.

    The values for the method you selected appear.

  6. Copy the values and store them where you can retrieve them, then select Close.

    The SCIM token starts with px_. The Token endpoint and the SCIM url identify the region of your Printix Home, for example:

    https://auth.printix.net/oauth/token

    https://scim.printix.net/scim/v2

    The Client secret and the SCIM token are shown only once. If you lose either, you must reset SCIM provisioning to obtain new values.

The identity provider tab shows Group synchronization with the type, the URL, and the date the credentials were created.

Microsoft Entra ID settings

In Microsoft Entra ID, create an enterprise application for Printix, assign the users and groups you want Printix to receive, and set the application to provision them automatically. You must have the global administrator or application administrator role in Microsoft Entra ID.

For the steps to create an enterprise application and configure provisioning, refer to Microsoft Entra application provisioning in the Microsoft documentation. Use the following values:

  • Provisioning Mode

    Select Automatic.

  • Tenant URL

    Paste the SCIM URL you copied in step 6.

  • Secret Token

    Paste the SCIM token you copied in step 6.

  • Scope

    Select Sync only assigned users and groups. Every member of a group you assign must also be within the scope of the application, or Microsoft Entra ID cannot provision the group membership.

Verify that the user attribute mappings match the following table.

Attribute Microsoft Entra ID attribute
userName userPrincipalName
active Switch([IsSoftDeleted], , "False", "True", "True", "False")
displayName displayName
emails[type eq "work"].value mail
name.givenName givenName
name.familyName surname
name.formatted Join(" ", [givenName], [surname])
externalId objectId

Verify that the group attribute mappings match the following table.

Attribute Microsoft Entra ID attribute
displayName displayName
externalId objectId
members members

Printix matches users by externalId, so the mapping to objectId must be present and must not be blank. Without it, each synchronization creates duplicate users.

When you turn provisioning on, Microsoft Entra ID starts an initial cycle that provisions every assigned user and group. Later cycles provision only the changes and can take up to 40 minutes to reach Printix. Microsoft Entra ID can also provision a single user on demand.

Okta settings

In Okta, create an app integration for Printix, enable SCIM provisioning on it, and assign the users and groups you want Printix to receive. You must have the super administrator or application administrator role in Okta.

Okta cannot provide SCIM provisioning from an OpenID Connect (OIDC) app integration, so you cannot add SCIM to the app integration you created for Printix single sign-on. Leave that app integration unchanged and create a separate one for SCIM provisioning.

For the steps to create an app integration and add SCIM provisioning to it, refer to Okta Help Center. Use the following values:

  • SCIM connector base URL

    Paste the SCIM URL you copied in step 6.

  • Unique identifier field for users

    Enter userName. You cannot change this value after you create the app integration. If you enter another value, provisioning fails and you must delete the app integration and create it again.

  • Authentication Mode

    Select the mode that matches the authentication method you selected in Printix, and enter the values you copied in step 6.

    • For the long lived access token, select HTTP Header, and in Bearer, paste the SCIM token.

    • For OAuth client credentials, select OAuth 2. In Grant Type, select Client Credentials. In Access token endpoint URI, paste the token endpoint, then paste the client ID and the client secret.

  • Supported provisioning actions

    Select Push New Users, Push Profile Updates, and Push Groups.

  • To App

    Select Create Users, Update User Attributes, and Deactivate Users. These options are separate from Supported provisioning actions and are cleared by default. Provisioning fails if you leave them cleared.

  • Assignments

    Assign the users and groups you want Printix to receive. Assigning a group provisions the members of the group as users. It does not create the group in Printix.

  • Push Groups

    To create the groups in Printix, push them by name or by rule. Every member of a group you push must also be assigned to the app integration, or Okta cannot provision the group membership.

Verify that the user attribute mappings match the following table.

Attribute Okta value
userName user.login
emails[primary eq true].value user.email
displayName user.displayName
name.formatted user.firstName + " " + user.lastName

The default Okta mappings are already correct, so no action is needed unless you have changed them. Okta maps active from the user status automatically.

Okta provisions assigned users and pushed groups when you assign or change them, rather than on a fixed schedule. The first time Okta pushes a group, Printix matches the group by name. Printix then returns an identifier that Okta uses for later updates. Renaming a group that you have already pushed is therefore safe, and the new name appears in Printix Administrator. An exception occurs if you rename a group while SCIM provisioning is disabled in both Printix and Okta. When you enable provisioning again, Printix receives a name it does not recognize and creates a second group.

Reset SCIM provisioning

Reset SCIM provisioning to obtain new credentials, for example, if you lose the Client secret or the SCIM token, or need to replace either. The previous credentials stop working immediately, and your identity provider cannot provision users and groups until you enter the new ones in its provisioning settings.

  1. In Printix Administrator on the Authentication Authentication page, select the identity provider tab.
  2. Under Group synchronization, select Reset.
  3. Copy the new values, then select Close.
  4. Enter the new values in the provisioning settings of your identity provider.

    In Microsoft Entra ID, the token is Secret Token. In Okta, the token is Bearer.

Troubleshooting

The connection test fails

The credentials are incorrect, they do not match the authentication method you selected in Printix, or SCIM provisioning was reset after you entered them in your identity provider.

Resolution: Verify the SCIM URL and the authentication method, then reset SCIM provisioning to obtain new credentials and enter them in your identity provider.

Users appear twice

The users already existed in Printix because they signed in or were added before you set up SCIM provisioning, so Printix has no identifier to match them with. In Microsoft Entra ID, the externalId attribute mapping can also be missing or blank, so each cycle creates a user.

Resolution: In Microsoft Entra ID, verify the externalId attribute mapping, then remove the duplicate users on the Users page.

A group has no members

The members of the group are not within the scope of the application or app integration, so your identity provider provisions the group but not its membership. Users are always provisioned before group membership, so the membership of a new group can also be incomplete until the initial cycle finishes.

Resolution: Assign the users to the application in Microsoft Entra ID or to the app integration in Okta.

A user is signed out and cannot sign in

Your identity provider reported the user as inactive because the user was deleted or deactivated there. Printix signs an inactive user out everywhere and records the user as inactive, but does not remove the user.

Resolution: Activate the user in your identity provider. To remove the user from Printix instead, remove the assignment to the application or app integration.