Set up SCIM with OneLogin

Step-by-step guide to connect OneLogin to Scrydon via SCIM 2.0 for automated user and group provisioning.

This guide walks you through connecting OneLogin to Scrydon so that users and groups in OneLogin are automatically provisioned into your Scrydon organization.

Prerequisites

Scrydon org admin role.
OneLogin account with Super User or Account Owner privileges.
SSO already configured between OneLogin and Scrydon. Finish SSO setup from Settings → Platform → Identity → Single Sign-On before continuing.

OneLogin doesn't have a dedicated Scrydon app in its catalog. We use the generic SCIM Provisioner with SAML (SCIM v2 Core) connector, which supports any RFC 7644-compliant SCIM target — Scrydon included.

Part 1 — Generate a Scrydon SCIM token

Open the Identity settings page

Switch to the Provisioning tab

Click the Provisioning (SCIM) tab next to Single Sign-On.

Copy the SCIM endpoint URL

Under SCIM Endpoint, copy the Tenant URL. It looks like:

https://auth.YOUR-TENANT.scrydon.com/api/auth/scim/v2

Generate a provisioning token

Click Generate Token. Enter a label such as onelogin-prod and click Generate.

The raw token is shown exactly once. Copy it immediately. Scrydon cannot display it again.

Part 2 — Add the SCIM provisioner app in OneLogin

Open the OneLogin admin portal

Search for the SCIM connector

In the search box, enter SCIM Provisioner with SAML (SCIM v2 Core). Select it from the results.

Save the initial app

Give the connector a clear name like Scrydon (SCIM) and click Save. OneLogin creates the app and reveals its configuration tabs.

Part 3 — Configure the SCIM connection

Open the Configuration tab

Click the Configuration tab in the new SCIM app.

Paste the Scrydon SCIM URL

Find the field labeled SCIM Base URL (OneLogin sometimes labels this as Subdomain depending on the connector version). Paste the Tenant URL from Scrydon:

https://auth.YOUR-TENANT.scrydon.com/api/auth/scim/v2

Paste the Scrydon provisioning token

Find the SCIM Bearer Token field and paste the raw token you generated in Part 1.

Enable the API connection

Under API Connection, click Enable. OneLogin tests the connection by calling Scrydon's /scim/v2/ServiceProviderConfig endpoint with the bearer token.

On success, the status indicator turns green.

If authentication fails: verify the SCIM Base URL ends in /scim/v2 (no trailing slash), the bearer token has no whitespace, and the token has not been revoked in Scrydon.

Save the configuration

Click Save at the top of the page.

Part 4 — Enable provisioning

Open the Provisioning tab

Click the Provisioning tab on the Scrydon SCIM app.

Turn on provisioning

Under Workflow, check Enable provisioning.

Set admin approval requirements

Configure whether OneLogin admins must approve Create, Delete, and Update operations before they are pushed to Scrydon.

Scrydon recommends enabling approval during the initial rollout so you can catch any unexpected provisioning actions before they hit production. Turn off approval once you're confident the sync is behaving correctly.

Set user deletion behavior

Under When users are deleted in OneLogin, perform the following in the app:

Select Delete.

Even though this setting says "Delete", Scrydon performs a soft delete: the user is deactivated (banned + sessions revoked + org membership removed) but the user record is preserved in Scrydon for audit purposes. This is the safest option and matches how OneLogin's "Delete" semantic behaves with most enterprise SCIM targets.

Under When user accounts are suspended in OneLogin, select Suspend — this also maps to Scrydon's soft-delete behavior.

Save and continue

Click Save.

Part 5 — Configure group provisioning

Refresh the entitlements

Still on the Provisioning tab, scroll to the Entitlements section and click Refresh. OneLogin queries Scrydon for the list of available groups via GET /scim/v2/Groups.

Open the Parameters tab

Click the Parameters tab.

Enable the Groups parameter

Under Optional Parameters, click Groups. In the dialog, check Include in User Provisioning and click Save.

Create a rule for automatic group assignment

Click the Rules tab, then click New Rule.

Example rule that syncs OneLogin users from the Engineering role into the Scrydon engineering team:

Field	Value
Rule name	`Engineering → Scrydon team`
Condition	`Roles → include → Engineering`
Action	`Set Groups in Scrydon to → engineering`

Save the rule. OneLogin will automatically assign matching users to the specified Scrydon team during sync.

Part 6 — Assign users and run the first sync

Assign users to the Scrydon app

Navigate to Users → Users in OneLogin. Select a user, scroll to the Applications section, and click +. Add the Scrydon SCIM app.

Repeat for each user you want to provision, or use a OneLogin role-based mapping to bulk-assign.

Trigger the initial sync

From the Scrydon SCIM app page, click More Actions → Sync logins. OneLogin pushes all assigned users to Scrydon.

Verify in Scrydon

In Scrydon, check Settings → Organization → Members for the provisioned users and Settings → Organization → Teams for the synced groups.

Check Settings → Platform → Audit Logs filtered on scim.* events to see the provisioning activity.

Managing the integration

Removing a user

Either:

Unassign the user from the Scrydon app in OneLogin (go to the user's Applications section and click the trash icon next to Scrydon), or
Suspend / delete the user in OneLogin — the app's deletion behavior kicks in (see Part 4, Step 5).

Both paths result in Scrydon performing a soft delete: the user is deactivated but the record is preserved.

If the same user is later re-added in OneLogin, Scrydon automatically reactivates the existing record — audit history and owned resources are restored. No manual Scrydon-side action required.

Rotating the token

In Scrydon, go to Settings → Platform → Identity → Provisioning (SCIM) and generate a new token with a new label (e.g. onelogin-rotated-2026-04-08).
In OneLogin, go to the Scrydon SCIM app → Configuration → paste the new token into SCIM Bearer Token → Save.
Click More Actions → Sync logins to verify the new token works.
Once confirmed, go back to Scrydon and revoke the old token.

Troubleshooting

Common error messages

Error	Meaning	Fix
`401 Unauthorized`	Token invalid or revoked	Regenerate token in Scrydon, update OneLogin configuration
`400 mutability: email is immutable via SCIM`	Tried to change an existing user's email	Delete and re-create the user instead
`400 mutability: userName is immutable via SCIM`	Tried to change `userName`	Same as above
`507 Insufficient Storage`	Scale cap reached	Contact support
`409 uniqueness`	Duplicate externalId or two OneLogin identities mapping to the same Scrydon email	Resolve the conflict in OneLogin
`429 Too Many Requests`	Rate limit exceeded	OneLogin retries automatically

Operation	Behavior
Changing a user's email via OneLogin	Rejected with `400`
Changing a user's `userName` via OneLogin	Rejected with `400`
Renaming a synced group in OneLogin	OneLogin PATCH accepted, Scrydon Team name not updated
Nested OneLogin roles → single Scrydon team	OneLogin rules match users with the role directly assigned. Users who inherit the role via a parent/child relationship are not synced unless the parent role is also targeted by a rule. For truly nested group hierarchies, Scrydon supports up to 3 levels of SCIM group nesting — structure your rules in OneLogin accordingly.
Nested group depth beyond 3	Rejected by Scrydon with `400 invalidValue` (`"nested group depth exceeds 3"`)
Service principals / machine accounts	Not synced

Set up SCIM with OneLogin

On this page