About SCIM | YSoft SAFEQ documentation

Relevant Products

SCIM is available in PRO PRINT PRO MFD

What is SCIM

SCIM (System for Cross‑domain Identity Management) is a standard protocol that enables automated exchange of identity information between systems. With SCIM integration, user and group creation, updates, and deactivation in an Identity Provider (for instance, in Microsoft Entra ID) are automatically synchronized/provisioned to SAFEQ Cloud.
SCIM is not authentication nor SSO — SCIM handles only provisioning, meaning user account lifecycle management.

How SCIM works

SAFEQ Cloud provides an SCIM endpoint (URL).
Identity Provider regularly synchronizes user and group changes via that SCIM endpoint.
SAFEQ Cloud applies the changes (creates, updates, or deletes the users and groups).

High-level architecture

SCIM is one‑way: changes flow from Identity Provider to SAFEQ Cloud (SCIM Push mode).

Supported User and Group attributes

SCIM schema defines many user and group attributes that can be synchronized via the SCIM protocol (see RCF 7643, Section 4 for a complete overview).
SAFEQ Cloud supports a subset of these attributes. Further, SAFEQ Cloud extends the SCIM schema with print-specific user attributes.

SAFEQ Cloud supports the following basic user SCIM attributes:

id
displayName
emails[type eq "work"].value
active
userName

Further, SAFEQ Cloud defines and supports the following print-specific user SCIM attributes:

urn:ietf:params:scim:schemas:extension:print:2.0:User:department
urn:ietf:params:scim:schemas:extension:print:2.0:User:nameAlias
urn:ietf:params:scim:schemas:extension:print:2.0:User:homeFolder
urn:ietf:params:scim:schemas:extension:print:2.0:User:pin
urn:ietf:params:scim:schemas:extension:print:2.0:User:cardNumbers

SAFEQ Cloud supports the following basic group SCIM attributes:

displayName
externalId
members

Fallback during outages

If SAFEQ Cloud is unavailable (e.g., maintenance, outage, deployment):

An Identity Provider logs an error, but provisioning does not stop.
After some time, it retries sending the changes.
Once SAFEQ Cloud becomes available again, provisioning continues where it left off.

Changes are not lost — only delayed.

Limitations

Authentication methods

In the authentication provider defined in the SAFEQ Cloud Web UI, several authentication methods are available.

SCIM is supported in combination with the OIDC authentication method; SCIM extends the OIDC authentication capabilities by allowing users to log in at the MFD terminal using their company cards and PINs stored in an Identity Provider.

SCIM is not supported in combination with the Service Account authentication method, SSO, or Client-based authentication.

There are several authentication types available in the SAFEQ Cloud Client:

The deprecated type “Manual login to SAFEQ Cloud server“ is not supported for the OIDC authentication method, so it is not supported for the OIDC + SCIM authentication method.

The deprecated type “Manual login to SAFEQ Cloud server“ is supported only for the Service Account authentication method.

Possible data divergence

SCIM provisioning is one‑way and sends only changes originating in an Identity Provider.

This means:

Manual user edits in SAFEQ Cloud may cause inconsistencies.

If data becomes inconsistent, it is necessary

Either restart provisioning in the Identity Provider, which triggers a full synchronization of all users and groups
or execute provisioning on demand for that specific user/group in the Identity Provider

Divergence from the SCIM specifications

SCIM is defined in these specifications:

SAFEQ Cloud SCIM implementation diverges from the specification in these points:

SQC SCIM implementation does not support modifying resources via HTTP PUT (RCF 7644, Section 3.5.1). Users and groups can be modified only via HTTP PATCH.
SQC SCIM implementation does not support BULK updates (RCF 7644, Section 3.7)
SQC SCIM implementation ignores the query parameter attributes (RCF 7644, Section 3.4.2.5)