Skip to main content

SCIM setup — OneLogin

OneLogin is a community-tier vendor.

Prereqs​

  • MOD tenant with SCIM enabled.
  • OneLogin admin access.
  • A SCIM bearer token from MOD Dashboard → Admin → SCIM tab.

Steps​

1. Add a custom connector​

  1. OneLogin admin portal → Applications → Add App.
  2. Find "SCIM Provisioner with SAML (Core Schema)".
  3. Configure → Display Name: MOD.

2. Configuration tab​

  1. SCIM Base URL: https://api.modtechlabs.com/scim/v2
  2. SCIM JSON Template: leave default ({}).
  3. SCIM Bearer Token: the plaintext.
  4. API Connection: Enable.
  5. Click Enable.

3. Provisioning tab​

  1. Enable provisioning for: Users, Groups.
  2. Actions on User Deletion: De-provision.
  3. Save.

4. Test​

  1. Users → assign a test user to the MOD app.
  2. Expected: MOD receives POST /scim/v2/Users within a minute.

Known OneLogin-specific behaviours​

  • active=false PATCH doesn't drop memberships — per the SCIM spec, deactivation ≠ deletion. MOD respects this: the user is marked INACTIVE but their group memberships stay. Deleting the user (DELETE /Users/:id) soft-deletes the user row but doesn't by itself purge membership rows; removing a member from a group is what drops that membership.

Troubleshooting​

symptomlikely causefix
"Invalid base URL"Trailing slash on Base URLUse /scim/v2 without trailing slash
Sync skips a userOneLogin's "App Login" not enabledSet the user's App Login to enabled

Screenshots​

See CORE/docs-site/docs/assets/scim-onelogin-*.png.