SCIM 2.0 Provisioning

BitDrip implements the SCIM 2.0 Users resource (RFC 7644) at /scim/v2. Use it to automate user provisioning and deprovisioning from Okta, Azure AD, or any SCIM-compatible identity provider.

Endpoint

https://your-policy-engine/scim/v2/Users

Authentication uses a static Bearer token set on the policy engine:

# Set the SCIM token in your environment
SCIM_TOKEN=<random-64-char-secret>

Pass this token in the Authorization header when configuring your IdP.

Operations

Method	Path	Description
GET	/scim/v2/Users	List users (supports filter=userName eq "...")
POST	/scim/v2/Users	Create a new user
GET	/scim/v2/Users/:id	Get a single user
PUT	/scim/v2/Users/:id	Replace a user
PATCH	/scim/v2/Users/:id	Update a user (set active: false to deactivate)

Attribute Mapping

SCIM attribute	BitDrip field
userName	email
name.givenName	firstName
name.familyName	lastName
active	Account enabled/disabled

The active: false signal disables the user account in BitDrip. The user's audit history is preserved.

Okta Configuration

1. In Okta Admin Console, go to Applications → Add Application → SCIM 2.0 Test App (Header Auth)
2. Set SCIM connector base URL to https://your-policy-engine/scim/v2
3. Set Authorization header to Bearer <SCIM_TOKEN>
4. Set Supported provisioning actions: Push new users, Push profile updates, Push user deactivation
5. Assign the app to the groups you want to sync

Azure AD Configuration

1. In Azure AD, open the enterprise application you created for BitDrip SSO
2. Go to Provisioning → Set up provisioning
3. Set Provisioning Mode to Automatic
4. Set Tenant URL to https://your-policy-engine/scim/v2
5. Set Secret Token to your SCIM_TOKEN
6. Click Test Connection, then save and start provisioning

Security Notes

• The SCIM token is compared using crypto.timingSafeEqual() — safe against timing attacks
• All SCIM operations are scoped to a single organisation; cross-org access is rejected
• SCIM operations do not affect existing JWT sessions — deactivated users are blocked at the auth middleware on their next request