Skip to main content

Configure SCIM Integration for Administrator Provisioning

Overview

Configure SCIM integration to enable automated provisioning and de-provisioning of Administrator accounts from your identity provider (IdP). This setup process connects your IdP to Druva and establishes the authentication and role mapping required for automated Administrator management.

Prerequisites

Ensure that the following requirements are met before initiating the configuration:

  • Only a Druva Cloud Administrator is authorized to manage SCIM Configuration.

  • Ensure the IdP supports SCIM 2.0 protocol.

  • Prepare a defined list of IdP groups to map to corresponding Druva Administrator roles.

Procedure

Step 1: Generate a SCIM token in Druva

A SCIM token is a secure authentication credential that authorizes your identity provider to communicate with Druva. Generate this token in the Druva console before configuring your IdP.

  1. From the Cloud Platform dashboard, go to the global navigation menu and select Druva Cloud settings.

  2. Select the Provisioning Mode from the left navigation pane and navigate to the SCIM section.

  3. Click the Generate Token option. Provide the confirmation the token will be generated.

Copy the generated token and store it securely. This will be required while integrating it with your IdP.

Step 2: Select SCIM for Administrator provisioning

  1. From the Cloud Platform, go to the global navigation menu and select Manage Administrator.

  2. On the left navigation pane, select the Provisioning tab.

  3. Under the SCIM section, click Use SCIM. A confirmation message for enabling SCIM for administrator management will appear.

  4. Select Continue. The SCIM protocol is now enabled.

Step 3: Configure your identity provider

You can configure SCIM with your identity provider to connect to the Cloud Platform using the access token. This enables automated provisioning, de-provisioning, and role synchronization.

Step 4: Create SCIM Mapping to Map Druva Administrator roles

Configure the SCIM mapping to ensure Administrators get appropriate permissions.

To add a SCIM mapping:

  1. From the Cloud Platform, go to the global navigation menu and select Manage Administrator.

  2. On the left navigation pane, select the Provisioning.

  3. Under the Mapping section, select the New Mapping option to create a new SCIM mapping. A Create New mapping window appears.

  4. Under the Mapping configuration section, enter a Mapping name for reference.
    ​

  5. Under Filter Administrator, specify the attribute type (either Enterprise, Core, Custom). For list of attribute, see Attributes for Filtering Administrator.
    ​

  6. Enter the attribute name and its corresponding value, then select Add.
    ​

    📝 Note:

    The attributes are case sensitive

  7. To add additional attributes, select the Add options and enter the required attribute names and values. Select Next.

  8. In the Administrator role section, select the appropriate Administrator role. For Product Administrator, select the Role for the respective product and set the Access

  9. Select Access control.

  10. Configure the required access control settings, then select Save. The SCIM mapping is now created successfully.

(Optional) Step 5: Define priority for the SCIM mapping

Administrator accounts are created automatically when IdP is integrated with Druva Cloud. When you define multiple SCIM mappings, it automatically classifies the Administrators, based on the filter parameters and role assigned while creating the SCIM mapping.

However, it may be a case, where the Administrator account falls under multiple SCIM mappings based on the defined criteria.

In such cases, Administrators can be defined by the priority for the mappings and Administrators are imported based on the mapping sequence.

When you create multiple SCIM Mappings, by default the oldest SCIM mapping is given the first priority. SCIM Mapping listed at the top has the highest priority while the one at the bottom has the lowest priority.

By default, the latest SCIM mapping is assigned the lowest priority.

Procedure

To change the priority order of Administrator SCIM mappings:

  1. From the Druva Cloud Platform, go to the Global Navigation Menu and select Manage Administrator.

  2. In the left navigation pane, select Provisioning.

  3. Under the Mapping section, view the list of configured mappings.

  4. Select the three-dot (more options) menu next to New Mapping, and then select Change Priority Order.

  5. In the Change Priority window, drag and drop the mappings to set the required priority order.

  6. Select Save to apply the changes.

Attributes for Filtering Administrator

SCIM attribute mapping defines which Administrators properties synchronize from your identity provider to Druva. The following attributes are synchronized:

To Assign Administrator to a respective group or category, you can filter the Administrators using Attributes while creating a SCIM Mapping in cloud Platform.

Core Attribute

It is the the mandatory SCIM user schema containing universal identity attributes like username, name, email, and active status.

Enterprise Attribute

It is the standard SCIM Enterprise User Extension containing organizational attributes such as department, employee number, manager, and cost center.
​

The following table outlines the attribute mappings including core schemas and enterprise extensions.

Extension

Field

Type

Example

Core

userName

string

abc.xyz@druva.com

Core

externalId

string

00u1abcd2EFGHijkL5d7

Core

active

boolean

true

Core

name.givenName

string

John

Core

name.familyName

string

Doe

Core

name.formatted

string

John Doe

Core

displayName

string

John Doe

Core

nickName

string

john.doe

Core

title

string

Senior Engineer

Core

userType

string

Employee

Core

preferredLanguage

string

en-US

Core

locale

string

en-US

Core

timezone

string

Asia/Kolkata

Core

emails.value

string

abx.xyz@example.com

Core

emails.type

string

work

Core

emails.primary

boolean

true

Core

phoneNumbers.value

string

1234567890

Core

phoneNumbers.type

string

work

Core

addresses.streetAddress

string

Tower 1, IT Park

Core

addresses.locality

string

Pune

Core

addresses.region

string

Maharashtra

Core

addresses.postalCode

string

411045

Core

addresses.country

string

IN

Core

addresses.primary

boolean

true

Enterprise

employeeNumber

string

EMP-10001

Enterprise

costCenter

string

CC-ENG-01

Enterprise

organization

string

Druva

Enterprise

division

string

Engineering

Enterprise

department

string

Platform

Enterprise

manager.value

string

ABC

Enterprise

manager.displayName

string

ABC

Manage SCIM Tokens

SCIM tokens are secure authentication credentials that authorize communication between your identity provider and Druva. Generate, rotate, and revoke tokens to maintain secure SCIM integration.

Generate new SCIM token

Generate a SCIM token when you first set up SCIM integration or when you need to replace an existing token.

  1. Log in to the Druva Cloud Platform Console navigate to Global Navigation menu -> Setting.

  2. Select Provisioning Mode on the Left navigation Pane. Under the SCIM section, click Generate New Token.

  3. Copy the token immediately and store it securely.

Token Expiry

SCIM tokens have a fixed 365-day validity. If a token expires, the Administrator synchronization process on the Identity Provider (IdP) side fails.

To resume synchronization, you must generate a new token, configure it in IdP, and manually retry the sync. To generate a token, see Generate SCIM Token.

Related Articles
Did this answer your question?