Skip to main content

Set up SCIM for automatic user provisioning

Automate user onboarding and offboarding, and sync collaborator roles, by connecting Ledgy to your identity provider using SCIM

Written by Support Team

Introduction

SCIM (System for Cross-domain Identity Management) keeps Ledgy in sync with your identity provider (IdP). Ledgy accounts are created automatically when people are given access in your IdP, and removed when access is revoked. You can also use IdP groups to give people collaborator roles in Ledgy.

Note: SCIM is only available on the Enterprise plan.

Identity providers we support

SCIM can currently be turned on for Okta. If you use another identity provider, please reach out to [email protected].

Before you start

  • SSO is set up, with at least one email domain on every SSO provider.

  • Require SSO is switched on for every SSO provider.

Until both are done, the SCIM switch stays greyed out.

How SCIM works at Ledgy

  • Name, email and address are kept up to date from your IdP.

  • When someone is given access to Ledgy in your IdP, we create a Ledgy account for them. It isn't linked to any equity stake until you invite them as a stakeholder.

  • When their access is revoked in your IdP, they lose access to Ledgy and are logged out everywhere. If they should keep access to their equity stake, re-invite them using a personal email address outside your company's email domain. They can then log in with email and password.

  • If group sync is on, IdP groups can add people to collaborator roles and remove them (see below).

Getting started

  1. Go to Company Settings > General > Security.

  2. If you have more than one SSO provider, choose one under SCIM provider.

  3. Switch on SCIM and confirm. You may be asked to confirm your identity.

  4. Under Bearer token, click Reveal and copy the token.

  5. Paste the token into your IdP application, as shown in the Okta guide below.

Sync collaborator roles with groups

Once SCIM is on, you can let your IdP groups manage who has which collaborator role in Ledgy.

  1. Switch on Group sync. It's off by default.

  2. By default, each IdP group is matched to the Ledgy collaborator role with the same name. To match a group to a role with a different name, click Edit mappings.

  3. Push the groups from your IdP. People in a mapped group get that role, and people removed from the group lose it.

Note: Each IdP group can be mapped to only one role. If you switch off group sync, roles stop changing, but user provisioning keeps working.

Okta guide

Before setting up SCIM, either a SAML or OIDC application needs to be set up from within the Okta admin panel. If you've configured SSO you'll already have this.

  1. From the provisioning menu in your application, select Enable SCIM provisioning:

  2. Go to the Provisioning tab and click Edit:

  3. Enter the following configuration details, replacing orgSlug with your organizational slug and entering the bearer token from Ledgy's Company Settings > Security under HTTP Header:

  4. Test your connection.

  5. Select the To App tab on the left and configure the settings below, ensuring your mappings are correct for the user's name, email and address:

Did this answer your question?