> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/global-settings/security/identity-providers-sso/scim-configurations/pingone-scim-configuration.md).

# PingOne - SCIM - Configuration

{% hint style="success" %}

#### Important Note

The instructions in this article cover a third-party app and may not reflect the latest version. Please use these instructions as a guide to complete the task, but be aware that some screens, field names, and steps may have changed.
{% endhint %}

## ![](https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FSxcnKlaJKPzDqONWoDNv%2FSummary2-Small-Icon.svg?alt=media\&token=5e3253d0-a069-4ba5-9c06-83c70bd0b21d) Overview

This article provides details on configuring a PingOne identity provider to use Flosum's SCIM API. For more information about SCIM, see the following article.

* [Configuring SCIM for Flosum](/global-settings/security/identity-providers-sso/configuring-scim-for-flosum.md)

{% hint style="warning" %}

#### Customer-Hosted

Customers who host Flosum Apps on their own infrastructure will have a custom URL for logging into their apps. When using this documentation, replace any **Flosum Hosted URLs** with your own URLs.
{% endhint %}

## Prerequisites

Before setting up automated provisioning, ensure SAML-based SSO is properly configured and fully functional in your Flosum tenant.

Ensure your **Attribute mappings** are correctly set. See the screenshot and table below. 

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FJiSHfifWvgPmWS2e8UB5%2FUsingJitProvisioning-PingOne-01.png?alt=media&amp;token=7ea5c39a-0681-464f-9198-d4b0a114e98e" alt="" width="563"><figcaption></figcaption></figure></div>

| Claim Name   | Value         |
| ------------ | ------------- |
| userUniqueId | User ID       |
| firstName    | Given Name    |
| lastName     | Family Name   |
| email        | Email Address |

For instructions for adding and configuring a PingOne identity provider, see the following articles.

* [Adding an Identity Provider (SSO)](/global-settings/security/identity-providers-sso/adding-an-identity-provider-sso.md)

## Configure PingOne

{% stepper %}
{% step %}

### Create SCIM Outbound Connection

{% hint style="info" %}

#### SCIM Outbound Provisioning

This method allows identities to flow from PingOne to Flosum Cloud Apps, with changes occurring almost instantly. When a user account is changed in PingOne, Flosum immediately reflects the update.
{% endhint %}

1. Navigate to the **Integration** section in the left sidebar menu.
2. Click the **Provisioning** tab.
3. Click the **+** icon next to the **Provisioning** title.
4. Click **Select** for the **Identity Store** type.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FepNOl3aLm9WvQB9RyRTv%2FPingOneScimConfig-S01-01.png?alt=media&amp;token=6192dd43-ac50-4b8c-a31e-b0443cbb0ca6" alt=""><figcaption></figcaption></figure></div>
5. Select **SCIM Outbound** for the connection.
6. Click **Next**.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FBi2Fp8cFdgm2uzpTCBjT%2FPingOneScimConfig-S01-02.png?alt=media&amp;token=9810288e-95c3-449e-87e1-efdf14e5dc76" alt="" width="563"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### Name Connection

1. Complete the **Connection Icon**, **Name**, and **Description** fields to help identify this connection.
2. Click **Next**.
   {% endstep %}

{% step %}

### Configure Authentication

Refer to the screenshot for an example of configuring the authentication settings to connect to Flosum's SCIM API.

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FtmLDbtLtiMegfwRBG4ZN%2FPingOneScimConfig-S03-01.png?alt=media&amp;token=7c1a9d73-ec53-4a7c-889b-39741f12d57f" alt="" width="563"><figcaption></figcaption></figure></div>

1. In the **SCIM Base URL** textbox, enter the SCIM API URL for your region from the table below.

<table><thead><tr><th width="159.6666259765625">Region</th><th>SCIM API URL</th></tr></thead><tbody><tr><td>United States</td><td>https://global-us.flosum.app/api/v1/scim</td></tr><tr><td>Germany</td><td>https://global-de.flosum.app/api/v1/scim</td></tr><tr><td>Japan</td><td>https://global-jp.flosum.app/api/v1/scim</td></tr><tr><td>Australia</td><td>https://global-au.flosum.app/api/v1/scim</td></tr></tbody></table>

2. In the **Oauth Access Token** textbox, enter your Global Settings **API Token**. If you don't have an API Token, see the following article for instructions on creating one.
   1. [Creating an API Token](/global-settings/security/api-tokens/creating-an-api-token.md)
3. In the **Users Resource** textbox, enter **/Users**.

{% hint style="info" %}
The Flosum SCIM API does not support Group provisioning at this time, so leave the **Group Resources** textbox blank.
{% endhint %}

4. Click **Test Connection**.
5. If the test connection was successful, click **Next**.

{% hint style="info" %}
If you don't receive a connection confirmation, check the **SCIM Base URL** and ensure it isn't blocked by firewalls or other network traffic interceptors. Then verify that the **API Token** is correct.
{% endhint %}
{% endstep %}

{% step %}

### Configure Preferences

Refer to the screenshot for an example of configuring the preferences for connecting with Flosum's SCIM API.

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FahqeJWB3haA4UH5gJkD5%2FPingOneScimConfig-S04-01.png?alt=media&amp;token=8bb2b39f-ae5e-493c-9923-5902b0548823" alt="" width="563"><figcaption></figcaption></figure></div>

{% hint style="warning" %}
Flosum uses the email address as the username. Make sure the **User Identifier** is mapped to `workEmail`.
{% endhint %}

1. Select **workEmail** for the **User Identifier** dropdown.&#x20;
2. Select either option for **Group Membership Handling**, since group provisioning is not supported by the Flosum SCIM API.
3. Check the **Enable users creation** checkbox.
4. Check the **Enable users updation** checkbox.
5. (Optional) When the **Enable users disable** setting is enabled, users disabled in PingOne are automatically disabled in Flosum.
6. Check the **Enable users deprovision** checkbox. When checked, users deleted in PingOne are automatically deleted in Flosum.
7. Select the **Delete** or **Disable** in the **Remove Action** dropdown.
8. (Optional) When Deprovision on rule deletion is enabled, all users provisioned by this rule in Flosum will be removed (**deleted** or **disabled**) when the rule is deleted.
9. Click **Save**.
   {% endstep %}

{% step %}

### Create Rule

Create a rule for the connection created above.

1. Choose PingOne as the **Source**.
2. Choose the connection you created for Flosum's SCIM API as the **Target**.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FyrF0oEyaCTdoaB66upqt%2FPingOneScimConfig-S05-01.png?alt=media&amp;token=48bdf793-0e7d-41aa-88fc-6b6bb2242c48" alt="" width="563"><figcaption></figcaption></figure></div>
3. Enter a **Name** for the rule.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FJD4As5dYdMWS7jxWDHBf%2FPingOneScimConfig-S05-02.png?alt=media&amp;token=45043d3b-6c8b-4bff-acbe-afcd1ce02d54" alt="" width="563"><figcaption></figcaption></figure></div>
4. Configure directory settings for outbound provisioning. Choose which users to sync from PingOne to Flosum, based on population or user attributes.
5. Map attributes between PingOne and Flosum to ensure users are provisioned correctly. See the screenshot and table below on how to set the correct attribute mappings.

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FmShFEQOTx5DhZeKJJx8R%2FPingOneScimConfig-S05-03.png?alt=media&amp;token=9bf30f3e-7659-4e96-8501-14cc9890444c" alt="" width="563"><figcaption></figcaption></figure></div>

| PingOne Attribute | Flosum API Attribute |
| ----------------- | -------------------- |
| Enabled           | active               |
| Family Name       | familyName           |
| GivenName         | givenName            |
| EmailAddress      | userName             |
| EmailAddress      | workEmail            |
| Timezone          | timeZone             |

6. Click **Save**.
   {% endstep %}

{% step %}

### Enable Provisioning

Once you've set up the rule and connection for the Flosum SCIM API, turn on both to enable provisioning. In PingOne, provisioning occurs immediately after you create, delete, or edit users.
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flosum.com/global-settings/security/identity-providers-sso/scim-configurations/pingone-scim-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.