System for Cross-Domain Identity Management (SCIM)

System for Cross-Domain Identity Management (SCIM) is a protocol for provisioning and managing users across applications. It lets you manage identities in one place and connect that source to identity providers and other systems.

With SCIM, you can create, update, and deactivate user accounts across platforms instead of doing that work by hand. That keeps access consistent when people join, change roles, or leave.

Benefits

Key benefits of SCIM User Provisioning include:

• Centralized User Management: Manage user identities from a single source, ensuring consistency across all applications.
• Automated Provisioning: Automatically create, update, or deactivate user accounts based on organizational changes, such as new hires or role changes.
• Enhanced Security: Reduce the risk of unauthorized access by ensuring that user accounts are promptly updated or removed as needed.
• Improved Efficiency: Streamline the onboarding and offboarding processes, allowing IT teams to focus on more strategic initiatives.

Configure SCIM in Chargebee

This guide explains how to configure SCIM provisioning in Chargebee:

1. Prerequisites
2. Provisioning Features
3. Configuration Steps
4. Chargebee's Group Name Format

Prerequisites

• SAML must be enabled before configuring Provisioning for Chargebee.
• After enabling SAML, you must reach out to Chargebee support to enable Provisioning on your site.

Provisioning Features

The following Provisioning features are supported:

• Push New Users
• Push Profile Updates
• Push User Deactivation
• Reactivate Users
• Push Groups
• Unlink Groups
• Push Groups or Push Group Updates

Configuration Steps

Setup in Chargebee

To obtain the API Token value for configuring Provisioning in Chargebee, follow these steps:

1. Log in to your Chargebee account using SAML.

2. Navigate to Settings > Team Members.

   

3. Click Get Started under User Identity Management.

   

4. Follow these steps.

   1. Select SCIM and click Next.
   2. Select OKTA and Bearer as authentication type and click Next.

5. Under Chargebee Credentials, copy the values of the Chargebee Site URL and Bearer Token. Use these values to add SCIM connection at the Provisioning tab of the Chargebee Okta Application.

   

Setup in Okta

To configure your provisioning settings in the Okta Application, follow these steps:

1. Log in to your Okta account and open the Okta admin console.

2. Select Applications from the left nav.

3. Select the Chargebee Okta application instance that is configured with SAML for the respective site. This is the instance created while enabling SAML, as described in Configure SAML in Chargebee.

4. Navigate to Provisioning tab and click Configure API Integration.

   

5. Complete the following steps:

   1. Select the Enable API Integration checkbox. Enter your Chargebee API Token from step 5 as mentioned above.
   2. Click Test API Credentials for testing your credentials. This step is optional.
   3. Click Save to apply the changes.

6. In Provisioning tab, select To App and click Edit to update the Provisioning to App section.

7. Select and save the following options:

   1. Create Users
   2. Update User Attributes
   3. Deactivate Users

8. Navigate to the Sign on tab and click Edit to update the Settings section.

9. Save the application by setting Application username format to Email under Credential Details.

   

Chargebee's Group Name Format

Chargebee requires the Okta group name to use this format:

• CB/<domain>/ROLE/<role_name>
  • CB is a standard prefix that will not change.
  • domain is your domain name.
  • ROLE is the standard prefix that will not change.
  • role_name is the access role name. For example, Admin or Analyst. Learn more about the access roles present in Chargebee.
• Chargebee does not support creating the Owner group. Owner transfer through SCIM is restricted.
• For the Multi Business Entity, treat the business entity as another dimension of a group. For example, CB/<domain>/BE/<business_entity_name>.