You are viewing an earlier version of the admin guide. For the latest version, please visit EmpowerID Admin Guide v7.211.0.0.

Connect to SCIM Applications

Owned by Phillip Hanegan
Last updated: Jun 07, 2023
5 min read

Step 1 – Create an account store in EmpowerID

  1. From the navbar of the EmpowerID Web interface, expand Admin > Applications and Directories and select Account Stores and Systems.

  2. Select the Actions tab and then click Create Account Store.


    This opens the System Types look up.

  3. Search for SCIM Connector.

  4. Click the SCIM Connector record to select it, and then click Submit.

     
    This opens the SCIM connector form.

     

  5. Enter the following information in the SCIM connector form:

    • Name – Name of the connector

    • Base URL – URL for the site hosting the SCIM microservice. For example, enter the URL for the app service if the microservice is hosted in an Azure app service.

    • Client Secret – If using OAuth authentication, enter the Client Secret for the app.

    • Client ID – If using OAuth authentication, enter the Client ID for the app.

    • Certificate – If using certificate-based authentication, enter the thumbprint of the certificate.

  6. When ready, click Submit.

Step 2 – Verify resource system parameters

  1. Navigate to the Find Account Store page (Admin > Applications and Directories > Account Stores and Systems) and search for the SCIM account store you just created.

  2. Click the Account Store link to navigate to the details page for the account store.

     

  3. Click the Resource System tab and then expand the Configuration Parameters accordion.

    The accordion contains the following parameters, some of which may not pertain to your specific implementation.

     

  4. Edit the parameters as needed. To do so, click the Edit button for the parameter to be updated, as shown below.

     

  5. Enter the appropriate value for the parameter in the Value field and click Save. 

  6. Repeat for each parameter that needs to be updated.

Step 2 – Configure attribute flow

EmpowerID supports the configuration of attribute synchronization rules for flowing attribute changes between directories and the EmpowerID Identity Warehouse. Attribute Flow rules are visually configured and are always relative to the relationship between an attribute in a directory and the corresponding attribute in the EmpowerID Identity Warehouse. Attribute Flow rules define the specific fields and attributes that are synchronized between the EmpowerID Identity Warehouse person objects and the external user accounts to which they are linked. Additionally, Attribute Flow rules can be weighted by account store. For example, if you have connected EmpowerID to an HR system as well as Active Directory, and you want any changes made to an attribute in the HR system to take priority over changes made in Active Directory or EmpowerID (while allowing changes to be made in any system), you would give a higher score for each CRUD operation originating from the HR account store and correspondingly lower scores for the Active Directory account store.

The following flow rules are available:

  • No Sync – When this option is selected, no information flows between EmpowerID and the native system.

  • Bidirectional Flow  – When this option is selected, changes made within EmpowerID update the native system and vice-versa. For most attributes, this is the default setting.

  • Account Store Changes Only – When this option is selected, changes can only be made in the native system and are then passed to EmpowerID.

  • EmpowerID Changes Only  – When this option is selected, changes can only be made in EmpowerID and are then passed to the native system.

The following CRUD operations are available:

  • Create – This operation is used to create an attribute value for an existing attribute when the value of that attribute is null.

  • Update – This operation is used to update the value of an attribute.

  • Delete – This operation is used to delete the value of an attribute.

  1. On the Account Store Details page for the SCIM app account store, select the Attribute Flow Rules tab.

  2. To change the flow for an attribute, click the Attribute Flow drop-down located between the Person Attribute column and the External Directory Attribute column, and select the desired flow direction from the context menu.

  3. To change the score for any of the available CRUD operations (Create, Update and Delete), enter the new score in the appropriate field. By default, scores are weighted evenly, which means that a change to an attribute originating in one connected external directory has the same authority as a change to an attribute occurring in another connected external directory.

EmpowerID only considers scores for attribute CRUD operations when multiple account stores with the same user records are connected to EmpowerID, such as would be the case if an HR System and this account store were being inventoried by EmpowerID.

Now that the attribute flow has been set, the next steps include configuring the account store and enabling EmpowerID to inventory it.

Step 3 – Configure account store settings

  1. On the Account Store and Resource System page, click the Account Store tab and then click the pencil icon to put the account store in edit mode.


    This opens the edit page for the account store. This page allows you to specify how you want EmpowerID to handle the user information it discovers during inventory. Settings that can be edited are described in the below table.


  2. Edit the account store as needed and then click Save to save your changes.

Next, enable the Account Inbox permanent workflow to allow the Account Inbox to provision or join the user accounts in ServiceNow to EmpowerID Persons as demonstrated below.

EmpowerID recommends using the Account Inbox for provisioning and joining.

Step 4 – Enable the Account Inbox Permanent Workflow

Step 5 – Monitor Inventory

IN THIS ARTICLE

Â