> For the complete documentation index, see [llms.txt](https://docs.siit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.siit.io/guides/workspace/how-do-i-set-up-scim-provisioning-with-onelogin.md).
# Set up SCIM with OneLogin
SCIM automates user account creation, updates, and deactivation in Siit based on your OneLogin directory. This guide shows you how to connect OneLogin to Siit using SCIM.
**Before you begin:**
* Your Siit workspace must be on the Pro plan
* You need OneLogin admin permissions
* Identify which OneLogin roles should map to Siit permissions
***
**Step 1: Create or open your Siit application in OneLogin**
**If you don't have a Siit app yet:**
1. Log into OneLogin Admin Console
2. Go to **Applications → Applications**
3. Click **Add App**
4. Search for **SCIM Provisioner with SAML (SCIM v2 Core)**
5. Select it
***
**Step 2: Get SCIM credentials from Siit**
1. Log into Siit and go to **Settings → Security → SCIM**
2. You'll see two values:
* **SCIM URL** (e.g., `https://back.siit.io/scim_v2`)
* **SCIM Token** (starts with `TOKEN_FROM_SIIT`)
3. Keep this page open for the next step
***
**Step 3: Connect OneLogin to Siit**
1. In your OneLogin Siit application, click the **Configuration** tab
2. Scroll to **API Connection**
3. Set **API Status** to **Enabled**
4. Paste the **SCIM Base URL** from Siit
5. In the **Custom Headers** field (if present), leave it empty
6. Paste the **SCIM Bearer Token** from Siit
7. Click **Save**
OneLogin will test the connection. If successful, you'll see a confirmation.
***
**Step 4: Enable provisioning (with approvals first)**
1. Click the **Provisioning** tab
2. Check **Enable provisioning**
3. Under **Workflow**, enable all three actions:
* ☑️ **Create user**
* ☑️ **Delete user**
* ☑️ **Update user**
4. **Important:** Leave **Require admin approval before this action is performed** checked for all three options (for now)
* This prevents automatic provisioning until you finish setup
5. Set deprovisioning behavior:
* **When users are deleted in OneLogin**: Select **Delete**
* **When user accounts are suspended in OneLogin**: Select **Suspend**
6. Click **Save**
***
**Step 5: Configure the username parameter**
1. Click the **Parameters** tab
2. Find **scimusername** in the list and click on it
3. Set **Value** to **Email**
4. Click **Save**
This ensures Siit uses email addresses as usernames.
***
**Step 6: Enable group synchronization**
1. Still in the **Parameters** tab, find the **Groups** parameter
2. Click on it to edit
3. Check **Include in User Provisioning**
4. Click **Save**
This allows OneLogin roles to sync to Siit as role assignments.
***
**Step 7: Create a role mapping rule**
1. Click the **Rules** tab
2. Click **Add Rule**
3. Configure the rule:
* **Name**: `Sync Groups` (or any name you prefer)
* **Conditions**: Leave empty (this applies to all users)
* **Actions**:
* Click **Set Groups in Siit**
* Select **Map from OneLogin**
* Set the condition: For each **role** with value that matches **`siit-.*`**
**About the pattern:**
* `siit-.*` matches roles starting with "siit-" (e.g., `siit-admin`, `siit-support`)
* Adjust this pattern to match your OneLogin role naming convention
* Examples:
* `Siit-.*` for roles like `Siit-Admin`, `Siit-Support`
* `support-.*` for roles like `support-admin`, `support-agent`
1. Click **Save**
***
**Step 8: Prepare matching roles in Siit**
Before approving users, create matching roles in Siit:
1. In Siit, go to **Settings → Roles**
2. For each OneLogin role that matches your pattern (e.g., `siit-admin`, `siit-support`):
* Create a role in Siit with the matching name (e.g., `admin`, `support`)
* The name must match exactly (case-sensitive), excluding the prefix pattern
3. Configure permissions for each role
**Example mapping:**
* OneLogin role: `siit-admin` → Siit role: `admin`
* OneLogin role: `siit-support` → Siit role: `support`
* OneLogin role: `siit-viewer` → Siit role: `viewer`
***
**Step 9: Remove approval requirements (optional)**
Once you're confident in your setup, you can enable automatic provisioning:
1. Return to the **Provisioning** tab
2. Under **Require admin approval before this action is performed**:
* Uncheck the boxes for Create user, Delete user, and Update user
* This allows automatic provisioning without manual approval
3. Click **Save**
**Note:** You can leave approvals enabled if you prefer manual control over provisioning.
***
**Step 10: Approve pending users**
1. Click the **Users** tab in your Siit application
2. You'll see users with **Pending** provisioning status
3. Click on **Pending**
4. Click **Bulk approve X pending login for the same app**
5. Confirm the approval
Users will be created in Siit within a few minutes.
***
**Step 11: Verify and assign new users**
**To verify successful provisioning:**
1. In Siit, go to **Settings → Team**
2. Check that the users appear in the team list
3. Verify their roles match their OneLogin role assignments
**To assign the Siit app to new users:**
1. In OneLogin, go to **Users → All Users**
2. Select a user
3. Click **Applications**
4. Click **+** and select your Siit application
5. The user will be automatically created in Siit (if auto-provisioning is enabled)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.siit.io/guides/workspace/how-do-i-set-up-scim-provisioning-with-onelogin.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
