Configure SCIM User and Group Sync

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Configure SCIM User and Group Sync from the Admin Settings UI instead of using the Django shell or contacting Alation Support. Alation provides this self-service configuration on Alation Cloud Service if you have the Server Admin role. It’s available in both the classic Alation experience and the new Alation experience (Neo).

Configuring SCIM User and Group Sync involves the following steps:

• Enable Directory Sync

• Select an Identity Provider

• Configure Authentication Credentials

Note

For customer-managed (on-premises) instances, SCIM configuration is performed using the Django shell. See Enable SCIM Integration for User and Group Management for the shell-based configuration procedure.

Prerequisites

Before configuring SCIM from the Admin UI, ensure the following:

• Your Alation instance is running on Alation Cloud Service. For customer-managed (on-premises) instances, use the Django shell procedure in Enable SCIM Integration for User and Group Management.

• You have configured and enabled SAML authentication as the active authentication method. SCIM handles user and group provisioning only — SAML remains required for user login. See Configure Authentication with SAML from Alation Shell for SAML setup instructions.

• You are logged in with a Server Admin role.

• Your identity provider supports SCIM 2.0.

Enable Directory Sync

To enable SCIM-based directory sync:

1. Log in to Alation as a Server Admin.

2. Click the Settings icon in the upper right to open Admin Settings.

3. Navigate to Authentication.

4. Locate the User & Group Sync section.

5. Toggle Enable Directory Sync to the on position.

1. Log in to Alation as a Server Admin.

2. In Alation, go to Admin Settings, then User & Group Sync.

3. Toggle Directory Sync to the on position.

Enabling directory sync automatically configures the SCIM protocol for user and group provisioning. Once enabled, the automatic sync process from your identity provider controls user and group management.

Important

Enabling directory sync disables signup moderation and certain manual user management capabilities. See Enable SCIM Integration for User and Group Management for a full comparison of capabilities with SCIM enabled versus disabled.

If you haven’t configured SAML yet, the toggle stays disabled and shows a message that SAML authentication must be enabled to use directory sync.

Select an Identity Provider

After enabling directory sync, select the Identity Provider (IdP) that you use to manage users and groups:

1. In the User & Group Sync section, locate the Identity Provider dropdown.

2. Select your IdP from the list:

   • Okta

   • Azure Active Directory

   • OneLogin

   • PingFederate

   • SailPoint

3. Alation saves your selection immediately.

1. On the User & Group Sync page, locate the Select Identity Provider dropdown.

2. Select your IdP from the list:

   • Okta

   • Azure Active Directory

   • OneLogin

   • PingFederate

   • SailPoint

3. Your selection saves immediately and shows a success message.

Change an Existing Identity Provider

If you need to switch to a different identity provider after one has already been configured:

1. Select the new IdP from the Identity Provider dropdown.

2. A confirmation dialog appears warning that changing the IdP is a destructive operation.

3. Review the impact:

   • Alation suspends all users synced from the current IdP.

   • Alation deletes all groups synced from the current IdP.

   • The new IdP reactivates users on its next sync.

4. Click Confirm to proceed with the change, or click Cancel to keep the current IdP.

5. After you confirm, a message shows the number of suspended users and deleted groups.

Warning

Changing the identity provider is a destructive operation. Alation suspends all users previously synced from the current IdP and deletes all synced groups. The new IdP reactivates users when it performs its first sync.

Configure Authentication Credentials

Your IdP needs credentials to authenticate with Alation when pushing user and group data over SCIM. Alation supports two authentication methods: basic authentication and bearer token.

Configure both methods at the same time — your IdP configuration determines whether it sends a Basic Auth header or a Bearer Token header with each SCIM request.

Choose Basic Authentication or Bearer Token using the radio buttons under Authentication Method. Switching the radio button does not delete the credentials you already saved for the other method.

Basic Authentication

To configure basic authentication credentials:

1. In the User & Group Sync section, locate the Basic Authentication area.

2. Enter a Username for the SCIM service account.

3. Enter a Password that meets the following requirements:

   • At least 16 characters long

   • Contains alphanumeric characters

   • Contains at least one special character

4. Click Save.

5. The status indicator displays Configured when credentials are set.

1. Under Authentication Method, select the Basic Authentication radio button.

2. Enter a Username for the SCIM service account. If you saved a username previously, it’s pre-filled.

3. Enter a Password that meets the following requirements:

   • At least 16 characters long

   • Contains alphanumeric characters

   • Contains at least one special character

   Click the Show password icon to confirm what you entered.

4. Click Save Credentials.

5. The status indicator displays Configured when credentials are set.

Note

The basic authentication credentials create a service account for SCIM communication only. They do not create a user in Alation, and you cannot use them to log in to the Alation UI.

Bearer Token

To generate a bearer token for SCIM authentication:

1. In the User & Group Sync section, locate the Bearer Token area.

2. Click Generate Token. If a token already exists, click Regenerate Token.

3. A dialog displays the generated token.

   Important

   Copy the token immediately. Alation shows the token only once — you can’t view it again after you close the dialog.

4. Click Copy to copy the token to your clipboard and store it in a secure location. You will need this token when configuring SCIM in your identity provider.

5. Click Close to dismiss the dialog.

6. The status indicator displays Active, expires <date> when a valid token exists. The token is valid for 6 months.

1. Under Authentication Method, select the Bearer Token radio button.

2. Click Generate Token. If a token already exists, click Regenerate Token.

3. A dialog displays the generated token.

   Important

   Copy the token immediately. Alation shows the token only once — you can’t view it again after you close the dialog.

4. Click Copy token to copy the token to your clipboard and store it in a secure location. You will need this token when configuring SCIM in your identity provider.

5. Click Close to dismiss the dialog.

6. The status indicator shows the expiration date once a valid token exists. The token is valid for 6 months.

Note

Generating a new token immediately revokes the previous token. Update your IdP configuration with the new token to avoid sync disruptions.

Important

Bearer tokens expire after 6 months. Monitor token expiration and regenerate before the token expires to avoid sync interruptions. The status indicator shows the expiry date for the active token.

Next Steps

After configuring SCIM in Alation, complete the setup on your identity provider side:

• Set Up SCIM Integration in Okta

• Set Up SAML and SCIM Integration in PingFederate

• Set Up SAML and SCIM Integration in Azure AD

• Set Up SCIM Integration in SailPoint IdentityIQ

• Set Up SCIM Integration in SailPoint IdentityNow

Once the IdP is configured, test the integration: Test SCIM Configuration.