Set up SCIM provisioning with Ping Identity
Set up SCIM provisioning so that Ping Identity adds users to HP Insights and keeps their details up to date, which means you don't have to import or edit users by hand. For an overview of how provisioning works, see What is user and group provisioning with SCIM?
Users you create in Ping Identity are added to HP Insights, and changes to user attributes are synced to it. Ping Identity doesn't provision groups, so manage groups in HP Insights instead.
Before you begin
- Users sign in to HP Insights with OpenID Connect. SCIM with Ping Identity doesn't support other authentication types.
- The Account Settings > Settings and Secure > Settings pages are both unlocked. If either is locked, generating a token fails with an error that names the locked page. See Set up automatic user and group provisioning with SCIM.
- You can sign in to the PingOne admin console as an administrator.
Set up provisioning
Generate the SCIM credentials
In the web console, go to Account Settings > Settings, and in User and Group Sync, select Generate Token. If a token was generated before, the button is Regenerate Token, and you will need to update the new token anywhere the old one is used.
The SCIM Credentials dialog shows the Tenant URL and Token that Ping Identity needs to connect to HP Insights. Select Download to save them, rather than Copy, because if you open a new tab before you save them, a new token is generated and the values no longer match.
Create a SCIM connection
Sign in to the PingOne admin console with an administrator account. Under Connections, select Provisioning, and select + to add a connection.
Select SCIM and select Next.
Enter a Name for the connection and select Next.
Connect to HP Insights
In the Configure Authentication section:
- Enter the Tenant URL from step 1 in SCIM Base Url.
- In Authentication Method, select OAuth2 Bearer Token, and enter the Token from step 1.
Select Test Connection to check that PingOne can reach HP Insights, and then select Continue.
Set how users are identified
In the Configure Preferences section, set User Filter Expression to externalId Eq "%s" and set User Identifier to userName.
Select Finish. The connection is created, but it stays disabled until you set up the provisioning rule in the next step.
Create the provisioning rule
The rule decides which users are provisioned through the connection and how their attributes are mapped. On the Provisioning tab, select New Rule.
- Enter a name for the rule and select Create Rule.
- Under Available Connections, select + next to the connection you created, and select Save.
- In Custom Filter, set the filter to Enabled Equals true, so that only enabled users are provisioned.
- Set the attribute mappings to match the ones below.
- Turn the rule on with its toggle.
Add users
Go to Identities > Users, and select + to add the users you want to provision.
The users you added appear in HP Insights after PingOne provisions them.
Keep the connection working
The SCIM token is valid for one year. When it's about to expire, or has expired, a message appears in Account Settings > Settings > User and Group Sync. Regenerate the token and update it in your identity provider before it expires, because provisioning stops when the identity provider can no longer authenticate. See Set up automatic user and group provisioning with SCIM.