SailPoint IIQ: Pathfinder SCIM setup guide
Context
While standalone BeyondTrust products including Password Safe, Endpoint Privilege Management (EPM) for Windows & Mac, and Privileged Remote Access (PRA) have a SCIM API, PathFinder provides a unified or global SCIM API that supports provisioning Users and Groups that can be consume by each individual products within PathFinder.
This guide is a complement to Documentation: SCIM provisioning and covers SailPoint IdentityIQ or IIQ .
Replace {organization-id} in Url https://api.beyondtrust.io/api/{organization-id}/platform/auth/scim/v2 and provide the token. Test Connection should be successful.
Script values are:
- script: identity.getAttribute("email");
- script: identity.getAttribute("email");
- script: identity.getAttribute("firstname");
- script: identity.getAttribute("lastname");
- Value: true
All String except Boolean for active.
Note: skipGrpUpdate is not visible in IIQ 8.1 Application panel, but may be visible in newer versions.
IMPORTANT: With skipGrpUpdate set to default of true, IIQ attempts to PATCH /Users/{user_id} to user User groups, but this is silently ignored. With false, it correctly sends a PATCH to /Groups/{group_id} to update members.
Testing
At this point the user should be added to Pathfinder with the SCIM Group membership.
