Automated user provisioning with SCIM

Instead of creating and managing users manually in Terminalfour, you can connect Terminalfour to an identity provider such as Microsoft Entra ID or Okta. Users can then be automatically created, updated and deactivated in Terminalfour as their status changes in your organization.

This makes it easier to keep Terminalfour access aligned with your organization's user directory and reduces the administrative work involved in managing users.

What is SCIM?

SCIM stands for System for Cross-domain Identity Management.

SCIM is an open standard for automating the exchange of user identity information between systems. It provides a consistent way for an identity provider to tell an application that a user has been created, updated or deactivated.

SCIM 2.0 is the version supported by Terminalfour.

For example, when an employee joins your organization:

• The employee is added to your organization's identity provider.
• The identity provider sends their details to Terminalfour using SCIM.
• Terminalfour creates the corresponding user account.

If that employee subsequently leaves the organization:

• Their account is disabled or removed from the identity provider.
• The identity provider sends the change to Terminalfour.
• Terminalfour deactivates the corresponding user account.

What can you automate?

SCIM provisioning can be used to automate the management of Terminalfour user accounts.

Depending on the capabilities of your identity provider, you can:

• Create users: automatically create a Terminalfour user when they are provisioned from your identity provider.
• Update users: keep user information such as their name and email address up to date.
• Deactivate users: automatically deactivate a Terminalfour user when they are no longer provisioned.
• Reactivate users: provision a previously deactivated user again when they regain access.
• Manage users centrally: manage the lifecycle of Terminalfour users from your existing identity management system.

This means your identity provider becomes the place where you manage the user's identity and provisioning status, while Terminalfour receives those changes automatically.

How does SCIM provisioning work?

The integration consists of two systems:

Identity Provider (IdP)
Your organisation's identity management system, such as Microsoft Entra ID or Okta.

Terminalfour
The application receiving user provisioning information.

The identity provider acts as the SCIM client and Terminalfour acts as the SCIM service provider.

Once the integration has been configured, the identity provider communicates with Terminalfour through the SCIM 2.0 API.

For example, when a user is provisioned:

1. User added to identity provider
2. Identity provider provisions user
3. Terminalfour receives SCIM request
4. Terminalfour creates user

Changes to the user's account follow the same process.

Existing users are automatically matched

You don't necessarily need to start with a completely empty Terminalfour user directory.

Terminalfour includes intelligent soft-match logic that allows SCIM to identify existing Terminalfour users and associate them with their corresponding identity-provider accounts.

When a user is provisioned, Terminalfour can detect an existing account based on their username.

This allows the identity provider to effectively claim ownership of an existing Terminalfour user, rather than creating a duplicate account.

This is particularly useful when introducing SCIM to an existing Terminalfour installation where users have previously been managed manually.

Example

Suppose Terminalfour already contains a manually created user:

Username: jsmith

The same person is then provisioned from your identity provider.

Terminalfour uses the user's username to identify the existing account and associate it with the provisioned identity.

The existing Terminalfour user can therefore transition to SCIM management without creating a second account.

This makes it easier to introduce automated provisioning into an existing Terminalfour environment.

User lifecycle

SCIM provisioning is particularly useful for managing the complete user lifecycle.

New users

When a user is assigned to the Terminalfour application in your identity provider, they can be automatically provisioned in Terminalfour.

Changes to users

Changes made in the identity provider can be synchronised to the corresponding Terminalfour account.

For example, changing a user's name or email address in your identity provider can update their Terminalfour account.

Deactivated users

When a user is deprovisioned, Terminalfour receives the corresponding SCIM request and the user's Terminalfour account is deactivated.

This helps prevent former users from retaining access to Terminalfour.

What you need

To configure SCIM provisioning, you need:

1. A Terminalfour installation running version 8.4.5 or higher.
2. The SCIM URL to pass to your identity provider
   
   1. https://example.terminalfour.net/terminalfour/rs/scim/v2
3. An authentication token from an account with appropriate permissions to manage users in Terminalfour
4. An identity provider account with appropriate permissions to configure users in your identity provider.
5. A supported identity provider, such as Microsoft Entra ID or Okta.

The exact configuration process depends on your identity provider.

• Configure SCIM provisioning with Microsoft Entra ID

Before you start

Before configuring provisioning, decide which users should have access to Terminalfour.

We recommend using groups in your identity provider to control which users are provisioned. This allows you to manage access centrally without having to configure individual users.

Once SCIM provisioning is configured, changes made in your identity provider can automatically affect Terminalfour user accounts. Make sure you understand your identity provider's provisioning and deprovisioning settings before enabling automatic provisioning.