SCIM User Provisioning Setup

• Enable SCIM/Directory Sync for your organization
• Receive your unique SCIM configuration portal link
• Ensure SSO is properly configured

1. Choose your identity provider from the list
2. The portal displays provider-specific instructions
3. Note the SCIM connection details you’ll need

• Okta: SCIM 2.0 endpoint and bearer token
• Azure AD: Automatic provisioning setup
• Google Workspace: Directory API configuration
• Authentik: SCIM endpoint and token configuration

​

For Okta:

1. In Okta Admin Console, go to Applications → Your Wolfia App
2. Click the “Provisioning” tab
3. Click “Configure API Integration”
4. Enter the SCIM Base URL and API Token from the portal
5. Test the connection
6. Enable provisioning features: “Create Users”, “Update User Attributes”, “Deactivate Users”
7. Configure attribute mappings (email, firstName, lastName)

​

For Azure AD (Entra ID):

1. In Azure Portal, go to Enterprise Applications → Wolfia
2. Click “Provisioning” in the left menu
3. Set Provisioning Mode to “Automatic”
4. Enter the Tenant URL and Secret Token from the portal
5. Test the connection
6. Configure attribute mappings
7. Set Provisioning Status to “On”

​

For Google Workspace:

1. The configuration portal will guide you through OAuth authorization
2. Grant Wolfia access to your Google Workspace directory
3. Select which organizational units to sync
4. Configure user and group sync settings

​

For Authentik:

1. In Authentik Admin Interface, create a new Provider
2. Choose “SCIM Provider” as the type
3. Enter the SCIM endpoint URL from the portal
4. Configure the bearer token
5. Set up property mappings for user attributes
6. Create an Application and bind the provider

​

For JumpCloud:

1. In JumpCloud Admin Portal, go to Applications
2. Click ”+ Add Application” and select “Custom Application”
3. Choose “SAML with SCIM User Provisioning”
4. Enter the SCIM Base URL and API Token from the portal
5. Test the connection to verify connectivity
6. Configure attribute mappings:
   • Email: Required - Maps to user’s email address
   • First Name: Maps to givenName
   • Last Name: Maps to surname
   • Role: Critical for automatic role assignment (see below)
7. Configure the role attribute:
   • In Attribute Mapping section, add a custom attribute named “role”
   • Set the source to a JumpCloud user attribute or group membership
   • Value must be one of: “ADMIN”, “EXPERT”, or “USER”
   • Example: Map customAttributes.wolfiaRole to “role” in SCIM payload
8. Enable provisioning features:
   • Create Users: Automatically create users when assigned
   • Update User Attributes: Sync attribute changes
   • Deactivate Users: Remove access when unassigned
   • Push Groups: Sync group memberships (required for role assignment)
9. Assign users or groups to the Wolfia application

• Option 1 - User Attribute: Set a custom user attribute (e.g., wolfiaRole) in JumpCloud user profiles with values “ADMIN”, “EXPERT”, or “USER”
• Option 2 - Group-Based: Use JumpCloud’s group membership to determine roles, then map those groups to the role attribute in the SCIM configuration
• The role value flows through the SCIM payload and Wolfia automatically assigns permissions based on this value
• Users without a role attribute default to “Standard User” role

• Administrator: Full access to all features, settings, and user management
• Expert: Advanced access to create content, manage integrations, and handle questionnaires
• Standard User: View and interact with shared content, participate in questionnaires

1. After connecting your directory, you’ll see a “Role Assignment” section
2. For each group you want to map:
   • Select a group from your identity provider
   • Choose the corresponding Wolfia role
3. Review your role mappings

IT Administrators    → Administrator
Security Team        → Expert
Compliance Team      → Expert
Engineering Team     → Standard User
Sales Team           → Standard User

• Create users automatically when assigned to Wolfia
• Update user attributes (name, email) when changed
• Deactivate users when unassigned from Wolfia

• Sync group memberships to Wolfia
• Update group assignments in real-time
• Map groups to Wolfia roles (configured in the portal)

1. Assign users to the Wolfia application
2. Assign groups to the Wolfia application (if using role assignment)
3. Users will be automatically created in Wolfia within minutes

• Go to Applications → Wolfia → Assignments
• Click “Assign” and choose “Assign to People” or “Assign to Groups”

• Go to Enterprise Applications → Wolfia → Users and groups
• Click ”+ Add user/group” and select users or groups

• Users are automatically synced based on organizational unit selection

• Assign users or groups to the Wolfia application
• Ensure users have the necessary permissions

1. Click “Finish Setup” in the configuration portal
2. The system validates the SCIM connection
3. Initial user sync begins automatically

1. Assign a test user to Wolfia in your IdP
2. Wait 2-5 minutes for sync to complete
3. Check the Wolfia Admin Panel → Users section
4. Verify the user appears with correct role
5. Test login with the user’s SSO credentials