Skip to content
IT Canvass
Menu
ServiceNow
SailPoint
SAP
TutorialsContact
Connectors · Lesson

SCIM

Quick answer

The Web Services connector governs apps that expose REST APIs, using configurable operations for aggregation and provisioning.

Key takeaways

  • SCIM connector type: the standards-based SCIM 2.0 connector
  • Onboarding: aggregate then correlate
  • You define create/update/delete/enable/disable operations as REST calls with mapped responses.
  • Common issues covered in troubleshooting

The Web Services connector is the swiss-army knife for governing applications that expose a SCIM 2.0 API but have no dedicated connector. Instead of writing Java, you configure each operation, aggregate, create, update, delete, enable, disable, as an HTTP call with mapped responses.

Connector type and how it connects

The SCIM integration is the standards-based SCIM 2.0 connector. It is configured per operation with HTTP requests, authentication (token/OAuth/basic) and response mappings, rather than being hard-coded to one application. As with every connector, the flow is the same: authenticate to SCIM, read accounts and entitlements during aggregation, and write changes during provisioning.

Onboarding the source

  • 1. Configure the connection and credentials for SCIM.
  • 2. Map the account schema, defining the aggregation request and mapping the JSON/XML response fields to account and entitlement attributes.
  • 3. Set the correlation logic so SCIM accounts attach to the right identities (typically on a stable key such as employee ID or email).
  • 4. Run account aggregation and confirm accounts and entitlements load.
  • 5. Verify correlation, watching for uncorrelated/orphan accounts.

Provisioning capabilities

SailPoint performs provisioning by invoking the configured create/update/delete/enable/disable operations as HTTP requests, with response handling to confirm success. This makes almost any modern SaaS or in-house SCIM-enabled app governable without custom code.

Entitlements and what to govern

What counts as an entitlement depends on the application; map whatever the API exposes as assignable access (roles, groups, permissions) into entitlement attributes.

Troubleshooting

When SCIM aggregation or provisioning fails, work through the usual causes in order:

  • Test each configured operation against the API independently (for example with Postman).
  • Verify authentication (token/OAuth) and its refresh behaviour.
  • Check the response mapping matches the actual payload structure.
  • Confirm rate limits are respected to avoid throttling.

Common pitfalls

  • Credential expiry (tokens/secrets/certs) silently breaking the connector.
  • Insufficient rights on the SCIM service account for the operations you need.
  • Schema or correlation misconfiguration leaving accounts uncorrelated.

Want to learn this properly?

Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.

See the courseAsk a question

Check your understanding

  1. What type of connector is SCIM?

    • A. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
    • B. Credentials, network/firewall access and schema mapping.
    • C. the standards-based SCIM 2.0 connector. It is configured with per-operation HTTP requests and response mapping.
    Show answer

    C. the standards-based SCIM 2.0 connector. It is configured with per-operation HTTP requests and response mapping.

    the standards-based SCIM 2.0 connector. It is configured with per-operation HTTP requests and response mapping.

  2. What is the first onboarding step for SCIM?

    • A. the standards-based SCIM 2.0 connector. It is configured with per-operation HTTP requests and response mapping.
    • B. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
    • C. Credentials, network/firewall access and schema mapping.
    Show answer

    B. Configure the connection and credentials, then aggregate accounts and correlate them to identities.

    Configure the connection and credentials, then aggregate accounts and correlate them to identities.

  3. Where do most SCIM connector issues come from?

    • A. the standards-based SCIM 2.0 connector. It is configured with per-operation HTTP requests and response mapping.
    • B. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
    • C. Credentials, network/firewall access and schema mapping.
    Show answer

    C. Credentials, network/firewall access and schema mapping.

    Credentials, network/firewall access and schema mapping.

Frequently asked questions

What does the term SCIM connector refer to in SailPoint?

The Web Services connector is the swiss-army knife for governing applications that expose a SCIM 2.0 API but have no dedicated connector. Instead of writing Java, you configure each operation, aggregate, create, update, delete, enable, disable, as an HTTP call with mapped responses.

What is involved in setting up SCIM connector?

SailPoint performs provisioning by invoking the configured create/update/delete/enable/disable operations as HTTP requests, with response handling to confirm success.

What is the role of aggregation in SCIM connector?

1. Configure the connection and credentials for SCIM. 2. Map the account schema, defining the aggregation request and mapping the JSON/XML response fields to account and entitlement attributes. 3.

What tends to go wrong with SCIM connector?

Credential expiry (tokens/secrets/certs) silently breaking the connector. Insufficient rights on the SCIM service account for the operations you need. Schema or correlation misconfiguration leaving accounts uncorrelated.
CallWhatsAppEnquire