Set up PingIdentity SCIM for airfocus

SAML setup

1. Login into airfocus
2. At the bottom left, click on your profile and team settings
   
3. Go to the Security/SSO tab and click on manage next to single sign-on
   
4. Click on set up SAML SSO
   
5. Keep track of the single sign-on URL and entity ID; you will need it when setting up SAML in PingIdentity
   
6. Open PingIdentity and navigate to your environment. Then open navigate to the Applications = Applications page.
7. Begin the setup for a new SAML application by clicking the create button (a “+” icon at the top of the page).
   
8. Give the application a descriptive name (e.g. “airfocus SAML”), select “SAML Application” under Application Type, then click “Configure.”
   
9. Select “Manually Enter” and input the the following:
   • “ACS URLS” = use the “SP Single sign-on URL” copied from airfocus earlier
   • “Entity ID” = use the “SP Entity ID” copied from airfocus earlier
     
10. Click “Save” to create the SAML application.
11. Navigate to the “Attribute Mappings” tab for your SAML application and click the pencil icon in the top right to edit the mappings.
    
12. Add the following mappings to your SAML application and click “Save.”
    
13. On the “Overview” page for your SAML application, scroll down and click “Download Metadata” to download a configuration file to upload to airfocus.
    
14. Enable the SAML application by clicking the toggle in the top right corner.
    
15. Navigate back to the airfocus SAML configuration page and click “Upload” in the IDP definition field under “SAML identity provider configuration” to upload the SAML configuration file you downloaded from PingIdentity. Then, click “Test” to test the connection with PingIdentity.
    
16. After verifying the connection is successful, click “Apply” to save the SAML/SSO settings for your airfocus team.

SCIM setup

1. Navigate to the Integrations = Provisioning page in PingIdentity.
2. Begin the setup for a new integration by clicking the create button (a “+” icon at the top of the page).
   
3. Select “Identity Store”
   
4. Select “SCIM Outbound” as the identity provisioning store, then click “Next”
   
5. Name the connection “airfocus SCIM Connection” and click “Next”
   

Now we need to create a SCIM token in airfocus that we can use in PingIdentity to sync users.

1. Login into airfocus
2. At the bottom left, click on your profile and team settings
   
3. Go to the Security/SSO tab and click on manage next to single sign-on
   
4. Enable SCIM and keep track of the base URL, and generated token/secret
   
5. Input the base URL and generated token from above into the corresponding PingIdentity fields.
6. Select “OAuth 2 Bearer Token” and enter the SCIM token into the “Oauth Access Token” field. Ensure the “Auth Type Header” field is set to “Bearer.”
   
7. Click “Test Connection” to verify that PingIdentity can connect to your airfocus team successfully, then click “Next”
   
8. Use the following values for the fields in “Configure Preferences”
   • User Filter Expression: username Eq “%s”
   • User Identifier: workEmail
   • Custom Attribute Schema URNs: (blank)
   • Group Membership Handling: Overwrite
     
9. Under “Actions”, configure the behavior according to what your organization needs are. If you’re unsure, you can use the default settings.
   
10. Click “Save” to save the configuration for your SCIM connection.
11. Enable the connection by navigating to the “Connections” tab on the “Provisioning” page and clicking the connection.
    
12. Click the toggle in the top right corner for the connection.
    

At this point, your connection to airfocus is dormant. In order for it to be active and actually sync users, we need to set up a Rule in PingIdentity to specify which users should be synced. We'll show you how to make a rule that adds any active users in PingIdentity to airfocus via the SCIM connection. You may want to customize the rule you create to best fit the needs of your organization.

1. Create a rule by navigating to the Integrations = Provisioning page and clicking the “+” icon at the top.
   
2. Give your rule a descriptive name and click “Create Rule”
   
3. Add the airfocus SCIM connection to the rule by clicking it, navigating to the “Configuration” tab, clicking "Target", then clicking your airfocus SCIM connection in the list below. Click “Save.”"
4. Create a user filter to control which users will be synced to airfocus by clicking the pencil icon next to “User Filter.”
   
5. For this example, we’ll make a rule that syncs all enabled users to airfocus.
   
6. Now configure the Attribute Mapping for your new rule. For the userName field in airfocus, select "Email address" on the left side. For the other fields, you can leave the default selections.
7. After you create your rule condition(s), click “Save” to finalize the rule.
8. Enable the rule by clicking the toggle in the top right corner. This will set the rule to an active state, and syncing to airfocus will begin based on the rule conditions.
   

Give feedback on this article