SCIM 2.0 provisioning

PLUR Enterprise implements SCIM 2.0 for automated user and group provisioning. Your IdP creates and disables users, syncs group memberships, and updates profile attributes — without anyone touching the PLUR admin UI.

What SCIM gives you

• Joiner — a new hire shows up in your IdP, PLUR account created automatically.
• Mover — they switch teams in your IdP, group membership updates in PLUR.
• Leaver — they’re disabled in your IdP, the PLUR account is disabled (engrams retained for audit).

Endpoints

SCIM lives under /scim/v2/ (separate from the public API for protocol compliance):

Path	Purpose
GET /scim/v2/ServiceProviderConfig	SCIM capabilities advertisement
GET /scim/v2/ResourceTypes	Supported resources
GET /scim/v2/Schemas	User + Group schemas
/scim/v2/Users	User CRUD (create, list, get, patch, delete)
/scim/v2/Groups	Group create, list, delete

The surface conforms to RFC 7644 (SCIM 2.0 Protocol) and RFC 7643 (Schema).

Authentication

SCIM uses its own bearer token type — distinct from API keys for users. Tokens are managed at /admin/scim-tokens:

1. Log in to /admin.
2. Open SCIM tokens.
3. Click New token.
4. Copy the token; it won’t be shown again.
5. Paste into your IdP’s SCIM configuration.

SCIM tokens are scoped to provisioning operations only — they cannot read engrams or sign in as a user.

Okta setup

1. Okta admin → Applications → your PLUR app → Provisioning → To App.
2. Enable: Create Users, Update User Attributes, Deactivate Users.
3. Connection settings:
   • SCIM connector base URL: https://plur.your-org.com/scim/v2
   • Unique identifier field: userName
   • Authentication mode: HTTP Header
   • HTTP Header value: Bearer <token from /admin/scim-tokens>
4. Test connection.
5. Map attributes (Okta → SCIM): userName, email, givenName, familyName, groups.

Microsoft Entra (Azure AD) setup

1. Entra → Enterprise applications → your PLUR app → Provisioning.
2. Mode: Automatic.
3. Tenant URL: https://plur.your-org.com/scim/v2
4. Secret token: <token from /admin/scim-tokens>
5. Test connection.
6. Map attributes per the Entra defaults; the SCIM schema PLUR advertises is the standard one.

Group provisioning

Groups in your IdP map to PLUR groups in the permission graph, which controls which scopes members can read and write. Teams in the PLUR dashboard are read-only — the IdP is the source of truth.

Honest limitation: with OIDC alone (no SCIM), team→scope mapping is limited — OIDC login establishes identity but does not sync group memberships, and groups cannot be managed manually from the dashboard. Use SCIM (or GitHub/GitLab sync) if you need team-scoped memory.

Disabling users

When the IdP disables a user, SCIM sends PATCH /scim/v2/Users/{id} with active: false. PLUR marks the account disabled and retains the user’s engrams and episodes (audit trail). Re-enabling restores access without data loss.

DELETE /scim/v2/Users/{id} is a soft delete — per SCIM convention it marks the user inactive, same as active: false. There is no hard-delete mode.

Auditing

Every SCIM operation is recorded in audit_log. Query it from /admin/audit or directly with SQL — see Audit log.

Troubleshooting

• 401 from Okta/Entra — token wrong or revoked. Re-issue at /admin/scim-tokens and update the IdP config.
• 409 on user create — userName collides with an existing account. Pre-link or rename.
• Slow updates — IdPs batch SCIM calls. Okta is near-real-time; Azure runs on a 40-minute cycle by default.