Guides

SCIM provisioning

On the hosted service's Business and Enterprise plans, your identity provider can manage who is in a workspace with SCIM 2.0: Okta, Microsoft Entra ID, OneLogin, JumpCloud and anything else that provisions apps over SCIM. People you assign to OpenRows join the workspace, changes to their names and groups follow, and when you deactivate or unassign someone they leave the workspace and are signed out. Owners set it up on the workspace's Single sign-on page, under SCIM provisioning. Self-hosted OpenRows doesn't offer SCIM.

Before you start

Provisioned people need an email address on one of the workspace's verified domains (see Single sign-on, "Verify your email domains"). OpenRows refuses addresses on other domains, so an identity provider can only manage people whose domain the workspace has proved it owns.

Set it up

1. On Single sign-on → SCIM provisioning, select Generate token and copy it. It is shown only once; OpenRows keeps only a hash of it.
2. In your identity provider's OpenRows app, turn on SCIM provisioning and enter:
   • SCIM base URL (also called tenant URL or connector base URL): the URL the page shows, https://app.openrows.io/scim/v2.
   • Authentication: HTTP header / bearer token, with the token from step 1.
   • Unique identifier: userName (the person's email address).
3. Turn on creating, updating and deactivating users, and push the groups you want to map to roles.

Rotate token makes a new one and stops the old one at once: enter the new one in your identity provider straight away. Revoke stops provisioning until you generate another token; people already provisioned stay as they are.

What provisioning does

• New people join the workspace with a role (below). Someone who hasn't signed in to OpenRows yet joins at their first sign-in with that address.
• Roles come from groups. Each group your identity provider pushes is listed on the settings page; pick the role its members get (Creator, Editor, Commenter or Read only). A person in several mapped groups gets the highest of their roles; people in no mapped group get the Role for people in no mapped group (Editor unless you change it). Provisioning never makes anyone an owner.
• Deactivating or deleting someone removes them from the workspace, including their roles on single bases, and ends all their OpenRows sessions. Reactivating them brings them back with their role.
• Owners are never changed. Provisioning doesn't change the role of, remove or sign out a workspace owner, so a mistake at the identity provider can't lock you out. Manage owners in OpenRows.
• Seats follow: people who join with an editor role or above count as editors on your plan, and your subscription's seats are updated as they come and go. When the plan has no seat left, the identity provider is told so and can retry later.
• Audit log (Enterprise): every change is recorded with "Identity provider (SCIM)" as the actor: users and groups created, changed and deleted, people joining, changing role and leaving. Token changes and group role mappings are recorded as the owner who made them.

What's supported

OpenRows implements the parts of RFC 7643 and RFC 7644 identity providers use: /Users and /Groups with create, read, replace (PUT), PATCH (add, replace and remove, with paths such as emails[type eq "work"].value and members[value eq "…"]) and delete; filters (eq, ne, co, sw, ew, pr, gt, ge, lt, le, and, or, not); pagination with startIndex and count (at most 200 per page); and /ServiceProviderConfig, /ResourceTypes and /Schemas. Bulk operations, sorting, ETags and password changes aren't supported. A workspace can have up to 10,000 SCIM users and 1,000 groups.