PingOne SCIM

PingOne SCIM provisioning is a paid feature.

Feedback
Configure PingOne OIDC for Hanzo KMS

In Hanzo KMS, head to the Single Sign-On (SSO) page and select the Provisioning tab. Under SCIM Configuration, press the Enable SCIM provisioning toggle to allow PingOne to provision/deprovision users for your organization.

Next, press Manage SCIM Tokens and then Create to generate a SCIM token for PingOne.

Next, copy the SCIM URL and New SCIM Token to use when configuring SCIM in PingOne.

Inside your PingOne environment, navigate to Directory > Users. Add any users and/or groups to your application that you would like to be provisioned over to Hanzo KMS.

1. Create a new connection

In PingOne, head to Integrations > Provisioning, and inside provisioning, press the Connections tab. Here you'll see a plus icon to add a new connection.

Select the "Identity Store" option.

Search for the "SCIM Outbound" option to start the configuration process for SCIM. Finally, press the Next button. Give the connection a name and optionally add a description.

2. Configure the connection

Once you have selected the SCIM Outbound option, you'll be prompted to enter the authentication details that PingOne will use to authenticate with Hanzo KMS SCIM. This is the SCIM URL and New SCIM Token from the previous step.

Set the following fields:

• SCIM BASE URL: Input the SCIM URL from the previous step.
• Users Resource: Leave as default, /Users.
• Groups Resource: Leave as default, /Groups.
• SCIM Version: Leave as default, 2.0.
• Authentication Method: Select OAuth 2 Bearer Token.
• Oauth Access Token: Input the New SCIM Token from step 1.
• Auth Type Header: Select Bearer.

Once this is done, you can press the Test Connection button to check that SCIM is configured properly. You should see a success message saying "Connection Successful". If the connection is successful, press the "Next" button.

In the final step, you'll be prompted to configure the mappings for the connection.

Set the following fields:

• User Filter Expression: email.value Eq "%s".
• User Identifier: workEmail.
• Deprovision on Rule Deletion: Enabled.

Once this is configured, press the "Save" button.

3. Enable the connection

Finally, remember to enable the connection by pressing the enable toggle.

1. Create a new rule

After creating a connection, you can now access the "Rules" tab under the Provisioning section. Here you can configure the rules for the connection.

Select the "New Rule" button and choose a name for the rule, then press the "Create Rule" button.

2. Configure the rule connection

Once you have created a rule, you now need to configure the connection to use for the rule.

Select the connection you created in the previous step and press the "Save" button.

3. Configure the rule user filter

Select the Edit pencil icon to open the user filter configuration. This step dictates which users will be provisioned to Hanzo KMS.

In this case, we are provisioning all users that are enabled in PingOne. Configure your user filter to match your desired users, and then press the "Save" button.

4. Configure Groups

This step is optional and only relevant if you want to provision PingOne groups to Hanzo KMS.

Open the "Group Provisioning" tab and press the "Add Groups" button to select which groups will be provisioned to Hanzo KMS.

Select the groups you want to provision to Hanzo KMS and press the "Save" button.

5. Enable the rule

Once you have configured the rule, you can enable it by pressing the "Enable" toggle.

Hanzo KMS's SCIM implementation accounts for retaining the end-to-end encrypted architecture of Hanzo KMS because we decouple the authentication and decryption steps in the platform.

For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets.