Permissions & RBAC

Provision users with SCIM

Let your identity provider add, update, and deactivate ITVA members, and give them permissions through SCIM groups.

SCIM lets your identity provider (IdP) manage ITVA members for you. The IdP adds people, keeps their names up to date, and deactivates them when they leave. ITVA gives each person permissions from the SCIM groups they belong to. In this guide, you connect your IdP to ITVA and give your groups a role and tags.

How SCIM works in ITVA

When your IdP	ITVA
Adds a user	Adds a member with the user's email, first name, and last name. If a user with that email already exists, ITVA uses that user.
Updates a user	Updates the member's email, first name, last name, or external ID.
Deactivates or deletes a user	Deactivates the member. The member cannot sign in. ITVA keeps the member's history.
Adds a group	Adds a SCIM group with the group's name and external ID. The group gets the Default role and no tags until you change it.
Adds or removes group members	Replaces each changed member's permissions with one permission for each of their groups.
Deletes a group	Deactivates the SCIM group.

SCIM does not sign people in. To let members sign in with your IdP, also set up single sign-on.

Caution: For members that SCIM manages, the SCIM groups are the source of their permissions. When ITVA syncs a member's groups, it removes permissions that you set with Manage Permissions.

Before you begin

You are an administrator in ITVA.
Your IdP supports SCIM 2.0 provisioning with a bearer token.
The roles and tags that you want to give each group already exist. See Roles and permissions.

Copy the SCIM details from ITVA

Select your initials at the top right of the portal, then select Settings.
Under Administrator, select Users, then select the SCIM tab.
In the SCIM card, copy the Tenant URL and the Secret Token. The Tenant URL has this form:

https://<YOUR_ITVA_HOST>/scim/v2

Caution: The secret token lets anyone add and deactivate members in your organization. Keep it secret. Paste it only into your IdP.

You cannot change the secret token in the portal. If the token leaks, contact support to get a new one.

Connect your IdP

For Microsoft Entra ID, see Use Microsoft Entra ID as your identity provider. For other IdPs:

In your IdP, turn on SCIM provisioning for the ITVA app.
Enter the Tenant URL as the SCIM base URL, and the secret token as the bearer token.
Map the user attributes as shown in the table below. The most important one is userName, which must be the person's email address.
Assign the groups whose members need ITVA, and push the groups to ITVA.
Start provisioning.

SCIM attribute	ITVA field	Notes
userName	Email	Required. Must match the email the person uses to sign in.
name.givenName	First name
name.familyName	Last name
externalId	External ID
active	Active	false deactivates the member.
Group displayName	SCIM group Name
Group externalId	SCIM group External ID	ITVA uses it to match the group.
Group members	SCIM group Users	Add and Remove operations.

ITVA ignores other attributes. It supports these filters: userName eq, name.givenName eq, name.familyName eq, active eq, and displayName eq.

Give each group a role and tags

A group that your IdP adds starts with the Default role and no tags, so its members cannot see much. You can set up a group before or after your IdP sends it.

To change a group that your IdP already sent:

On the SCIM tab, open the group in the Groups card.
Select Edit.
In Role, select the role. In Tags, select the tags.
Select Save. ITVA updates the permissions of every member of the group at once.

To set up a group before your IdP sends it, select New Group. In External ID, enter the exact external ID that your IdP sends for the group. When the IdP sends the group, ITVA matches it by that ID and keeps your role and tags. For the other fields, see Roles and permissions.

SCIM does not make members administrators. To make a member an administrator, use Manage Permissions on their membership.

Check that it worked

On the SCIM tab, the Groups card shows your groups, with their Role, Tags, and Users.
On the Memberships tab, the people from your IdP show in the list. Permissions (Group / Role) shows the role and tags from their groups.

Troubleshooting

If your IdP shows an HTTP 401 error, the secret token is wrong. Copy it again from the SCIM card and send it as a bearer token.
If a member can sign in but sees almost nothing, their groups have the Default role or no tags. Give the groups a role and tags.
If permissions that you set by hand disappear, the member is managed by SCIM. Change the member's groups in your IdP, or the role and tags of the group in ITVA.
If a person cannot sign in with SSO after SCIM adds them, the userName from SCIM is different from the email that SSO sends. Map userName to the same email in your IdP.
If a member is deactivated by mistake, activate the user in your IdP. ITVA activates the member on the next sync.