Troubleshoot SCIM Administrator Provisioning Issues
Connection test fails
Symptom: The connection test in your identity provider fails when testing the SCIM endpoint.
Cause: The SCIM endpoint URL or authentication token is incorrect. Network connectivity issues may also prevent the connection.
Resolution:
Verify the SCIM endpoint URL is correct:
Verify the SCIM token is correct:
Generate a new token if you're unsure the current token is valid
Ensure no extra spaces were copied with the token
Check that your identity provider can reach the Druva SCIM:
Verify the token has not expired or been revoked.
Administrator not provisioned
Symptom: You assigned an Administrator in your identity provider, but the administrator account does not appear in Druva.
Cause: The Administrator may not be in a mapped group. Provisioning may be disabled. A sync may not have occurred yet.
Resolution:
Verify the Administrator is assigned to the Druva application in your IdP.
Check that provisioning is enabled in your IdP's Druva application settings.
Wait for the next sync cycle or trigger a manual sync in your IdP.
Check the provisioning logs in your identity provider for errors.
Inputs Required: Where to check SCIM logs in Druva, if available]
Administrator provisioned with wrong role
Symptom: The Administrator account was created, but with an incorrect role.
Cause: The IdP group-to-role mapping is incorrect, or the admin is in the wrong group.
Resolution
Verify the Administrator's group membership in your identity provider.
Verify the group-to-role mapping configuration.
Move the Administrator to the correct group.
Wait for the next sync cycle to update the role.
If the Administrator account has not been activated, you must delete the Administrator from the Cloud platform. After doing so, reassign the IdP application to the Administrator with the correct attributes to ensure accurate mapping and proper role assignment.
If the role is changed manually and the administrator is not mapped to the correct mapping, the admin account may be disabled later if the associated mapping is deleted or if the user's attributes no longer match any valid mapping.
Administrator not de-provisioned
Symptom: You removed an Administrator from the Druva application in your IdP, but the administrator account still exists in Druva.
Cause: De-provisioning may be disabled, or a sync has not occurred.
Resolution:
Verify if de-provisioning is enabled in your IdP's Druva application settings.
Wait for the next sync cycle or trigger a manual sync.
Check the provisioning logs in your identity provider for errors.
Authentication errors
Symptom: Provisioning requests fail with authentication errors.
Cause: The SCIM token is invalid, expired, or revoked.
Resolution:
Generate a new SCIM token in Druva.
Update the token in your identity provider's Druva application configuration.
Test the connection.
Attribute mapping errors
Symptom: Administrator accounts are created, but some attributes are missing or incorrect.
Cause: The attribute mapping in your identity provider does not match Druva's expected attributes.
Resolution:
Review the attribute mapping configuration in your identity provider.
Verify required attributes are mapped:
Verify attribute values meet Druva's requirements:
SCIM Error Codes
SCIM error codes indicate specific issues with provisioning requests. Use the following table to identify and resolve errors.
Error | Description | Action Required |
403 | SCIM provisioning is not enabled for this tenant. Current provisioning mode is {method}. | Enable SCIM provisioning for the tenant in Druva. |
403 | Cannot Provision Inactive User | New Administrator cannot be created as inactive. Create as active, then deactivate in a follow-up update if needed. |
403 | The user does not meet tenant provisioning eligibility criteria. No source mapping matched the provided attributes. | Administrator attributes do not match any SCIM provisioning rule. Review provisioning filters in Druva and align IdP attribute mappings. |
403 | User no longer matches any configured source mapping. The administrator has been disabled and will be removed after the retention period. | Administrator was disabled because they no longer match provisioning rules. Correct attributes or update provisioning rules. |
403 | Tenant administrator limit reached. | Administrator limit is reached. Remove unused administrators. |
403 | This administrator is not managed by SCIM and cannot be modified. | Administrators were not provisioned through SCIM. Manage this administrator outside SCIM. |
404 | Resource not found | SCIM-managed users do not exist. Verify the user was previously provisioned through SCIM. |
409 | A user with userName {email} already exists and is managed outside SCIM. | An administrator with this email already exists outside SCIM. Use a different email or manage that user outside SCIM. |
409 | A user with userName {email} already exists. | A SCIM-managed user with this email already exists. Update the existing user instead of creating a new one. |
FAQs for Administrator Management using SCIM
What version of SCIM does Druva support?
Druva supports SCIM 2.0 protocol.
Can I use SCIM alongside manual Administrator creation?
Yes
Can I modify SCIM-provisioned Administrator attributes in Druva?
Yes, updates can be made manually, though future synchronizations from the identity provider (IdP) may overwrite these modifications to match the IdP state.
How do I assign different roles to different Administrators?
When you create a mapping and filter Administrator based on attributes, they receive the corresponding role. See Configure SCIM Integration for Administrator Provisioning for detailed steps.
What happens if an Administrator belongs to multiple groups mapped to different roles?
If the Administrator is added to multiple mapping, the Administrators role will be defined by the priority for the mappings.
What happens when an administrator is deprovisioned
Upon deprovisioning, the administrator account remains in a disabled state for the configured duration before permanent deletion.cThe default duration for disabled account retention is 2 days.
Deprovisioning scenarios
The following table describes how different IdP actions affect administrator accounts in Druva.
Scenario | Action in IdP | Result in Druva |
Administrator removed from SCIM App integrated in your IdP | Remove membership | Administrator Account is disabled |
Administrator unassigned from Druva application | Unassign application | Administrator Account is disabled |
Administrator deactivated in IdP | Deactivate Administrator account | Administrator Account is disabled |
Administrator deleted in IdP | Delete Administrator account | Administrator Account is disabled |
Verify de-provisioning
Confirm the administrator account was removed or deactivated in Druva.
From the Cloud Platform console, go to Global Navigation menu -> Manage Administrator
Verify the administrator account no longer appears or shows as deactivated.