SCIM 2.0
Employee accounts are read from an identity provider that speaks SCIM 2.0 and matched with leak records.
How it works
SCIM is a standard protocol. Every provider that supports it works without a separate integration: Ping Identity, CyberArk, JumpCloud, SailPoint, Workday, OneLogin and others.
The connection uses a bearer token; read permission is enough. If a user has several addresses, the one marked primary is taken.
The provider may clamp the requested page size to its own maximum. Paging advances from the total record count, so no account is skipped when that happens.
Limits
SCIM has no session termination operation; this connection only does matching.
Accounts are not created, changed or deleted.
The token is not given write permission.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.