Skip to main content

Automatic user provisioning via SCIM

For Cloud customers whose identity provider isn't Microsoft Entra ID or Okta, this generic guide helps you set up — and test — provisioning from any System for Cross-domain Identity Management (SCIM) 2.0–compatible provider.

Prerequisites​

  • Administrator access to the iGrafx Process DesignProcess Design The discipline of explicitly modeling business processes to document, analyze, and optimize them. In Process360 Live, process design is the authoring side that complements mining's data-driven view. module in iGrafx Cloud, with the Manage user directories server permission.
  • A SCIM 2.0–compatible identity provider.

Steps​

Create the SCIM directory in iGrafx Process Design​

  1. Sign in to iGrafx Process360 LiveProcess360 Live iGrafx's cloud platform for end-to-end process management — combining process design, mining, simulation, and automation in a single environment. Process DesignProcess Design The discipline of explicitly modeling business processes to document, analyze, and optimize them. In Process360 Live, process design is the authoring side that complements mining's data-driven view..
  2. Go to Administration → User Management → Directories.
  3. Click Add new directory, enter a name, and select directory type SCIM.
  4. Click Create directory.
  5. Record your SCIM secret token and SCIM Tenant URL. (To view the URL or generate a new token, click Edit on the SCIM directory, then Generate new token.)

Configure your identity provider​

  1. Create or configure an application integration that connects to iGrafx.

  2. Set the SCIM Connector Base URL to your SCIM Tenant URL.

  3. Set the authentication method to HTTP Header with Bearer token, using your SCIM secret token as the value.

  4. Set the unique identifier field for users to userName.

  5. Enable these provisioning actions: Create Users, Update Users, Deactivate Users (and, optionally, Provision Groups and Group Membership).

  6. Define the user attribute mappings:

    iGrafx attributeMapping typeSource attribute (IdP)Target attribute
    UsernameDirectmailuserName
    EnabledExpressionNot([IsSoftDeleted])active
    EmailDirectmailemails[type eq "work"].value
    First nameDirectgivenNamename.givenName
    Last nameDirectsurnamename.familyName

    Delete any other default mappings your provider creates — iGrafx ignores them.

    Optionally, to provision groups and group membership (requires group create, update, and delete):

    Mapping typeSource attribute (IdP)Target attribute
    Directmembersmembers
    DirectobjectIdexternalId

Assign users and groups​

  1. Assign the users and groups to provision to the SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials./SCIM application in your identity provider.
  2. Confirm provisioning syncs to iGrafx — start with an empty group and/or a single user. Usernames must be unique in iGrafx; a user whose name already exists is skipped.
  3. SCIM provisioning runs on your provider's own schedule — check its logs for status.

Provisioned users are created, updated, or disabled in iGrafx according to your identity provider; disabled users don't consume a license. The sync is one-way — manual changes in iGrafx aren't sent back to your identity provider.

Troubleshooting​

  • A user is skipped — usernames must be unique in iGrafx. If the name already exists, delete the local user and restart provisioning; the user is recreated in the SCIM directory.
  • An error in the provisioning logs (for example a BadRequest / invalidSyntax 400) — check the most common causes first, then contact Support with a screenshot of the provisioning logs including the timestamp.