SCIM

Identity Management

Overview

A Brinqa connector for syncing identity data (Users and Groups) from any SCIM 2.0 compliant service provider.

This connector implements the SCIM 2.0 protocol (RFC 7643/7644) to retrieve User and Group resources and map them to the Brinqa Unified Data Model. It extends the HTTP connector framework (AbstractHttpConnector) and supports both full and incremental sync via SCIM's meta.lastModified filtering, as well as create and update operations via SCIM POST and PUT.

Data retrieved from SCIM

Connector Object	Required	Maps to Data Model
User	Yes	Person
Group	Yes	Team

Model relationships

note

For detailed steps on how to view the data retrieved from SCIM in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select SCIM from the Connector dropdown and provide the following:

Setting	Required	Default	Description
SCIM API URL	Yes	—	The base URL of the SCIM 2.0 service provider (e.g. https://example.com/scim/v2).
Client ID	Yes	—	The OAuth2 client ID for authenticating with the SCIM service provider.
Client Secret	Yes	—	The OAuth2 client secret for authenticating with the SCIM service provider.
Token Endpoint	Yes	—	The OAuth2 token endpoint URL for client credentials authentication (e.g. https://idp.example.com/oauth/token).
Page size	No	100	Maximum number of resources to retrieve per API request. Default is 100.
Maximum retries	No	5	The maximum number of retry attempts before giving up on a failed request.

Authentication

The connector uses OAuth 2.0 Client Credentials flow to obtain a Bearer token.

Endpoint

Method	URL
POST	<tokenEndpoint> (e.g., https://idp.scim.dev/oauth/token)

Request Headers

Header	Value
Content-Type	application/x-www-form-urlencoded

Request Body

grant_type=client_credentials&client_id=<clientId>&client_secret=<clientSecret>

Sample Response

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGci...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Response Fields

Field	Type	Description
access_token	String	JWT access token
token_type	String	Token type (always Bearer)
expires_in	long	Token validity in seconds

Usage

The connector automatically fetches and caches the access token. It is refreshed 5 seconds before expiry. All subsequent API requests include:

Authorization: Bearer <access_token>
Accept: application/scim+json
Content-Type: application/scim+json

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain SCIM credentials

Generate OAuth 2.0 credentials

The SCIM connector uses the OAuth 2.0 Client Credentials flow to authenticate. To obtain the required credentials, follow these steps:

1. Log in to your identity provider's (IdP) administration console.

2. Register a new OAuth 2.0 application or locate an existing one that is configured for SCIM access.

3. Note the Client ID and Client Secret assigned to the application.

4. Locate the Token Endpoint URL in your IdP's documentation or application settings.

Note: The exact steps to obtain OAuth 2.0 credentials vary depending on your identity provider. Consult your provider's documentation for specific instructions.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

User

Source Field Name	SDM Attribute
active	STATUS
active	EMPLOYMENT_STATUS
displayName / userName	NAME
displayName / userName	DESCRIPTION
emails[].value	EMAILS
Enterprise department	DEPARTMENT
Enterprise division	LOCATION
Enterprise manager.displayName / manager.value	MANAGERS
groups[].value	GROUPS
id	UID
meta.created	SOURCE_CREATED_DATE
meta.lastModified	SOURCE_LAST_MODIFIED
name.familyName	LAST_NAME
name.givenName	FIRST_NAME
phoneNumbers[].value	PHONE_NUMBERS
title	JOB_TITLE
userName	USERNAME
—	CATEGORIES
—	LAST_CAPTURED

Group

Source Field Name	SDM Attribute
displayName	NAME
displayName	DESCRIPTION
id	UID
members[]	MEMBER_COUNT
members[].value	MEMBERS
meta.created	SOURCE_CREATED_DATE
meta.lastModified	SOURCE_LAST_MODIFIED
—	CATEGORIES
—	STATUS
—	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

User

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on meta.lastModified.

API

• Type: REST/HTTP · Endpoint: GET /Users

Group

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on meta.lastModified.

API

• Type: REST/HTTP · Endpoint: GET /Groups

Changelog

Changelog

The SCIM connector has undergone the following changes:

Version	Description	Migration Steps
3.0.0	Overview The SCIM connector integrates with any SCIM 2.0 compliant identity service provider to synchronize user accounts and groups into Brinqa. It supports both full and incremental synchronization so that identity data stays current across connected systems. Category: Identity Management Models	N/A