What’s SCIM?
System for Cross-domain Identity Management (SCIM) allows you to easily manage users and groups at scale on the O’Reilly learning platform through your organization’s SCIM-enabled identity provider (IdP)—so you have one less user management system to maintain.
The O’Reilly SCIM experience
The O’Reilly SCIM API is based on version 2.0 of the SCIM standard. With SCIM, you control the complete user lifecycle directly through your identity provider (IdP). SCIM is best used alongside SSO so you can manage user access and users can easily sign in to the O’Reilly learning platform, all through your IdP.
Once SCIM has been enabled, all user and group management will be done through your IdP, freeing account managers from duplicating their access management steps in the learning platform’s admin console. To ensure that all user management is controlled through your IdP, just-in-time user provisioning and no-touch reactivation features are disabled.
The O’Reilly SCIM API supports all common management operations for both users and groups: create, read, update, and delete. Additionally, a user’s access to O’Reilly can be revoked without deleting the user by updating their “active” status to “false.” Deleting a user is permanent and performs a GDPR-compliant data wipe of all identifying information.
O’Reilly customers with an active SSO connection can add SCIM support by following our documentation independently or working with our integration team to ensure a smooth transition to automated user management.
Identity provider configuration
Both admin access to your O’Reilly account and the ability to configure your organization’s IdP will be needed to complete setup.
The first step is to ensure that the current users in your O’Reilly account exactly match the users who are assigned to O’Reilly on your IdP. If needed, detailed steps are available in the Prerequisites section below.
Once the prerequisite user alignment is complete, use the token creator on the Integrations page of your Admin Console to generate the required SCIM API token. If you don’t have access or if you run into any issues, please reach out to your customer success manager. Then follow the steps in the configuration guide for your organization’s IdP to set up the integration. If your IdP isn’t listed below, you can always integrate with our SCIM API directly.
Configuration guides:
Prerequisites
The goal of adding SCIM to your existing SAML SSO integration is to have your IdP become the sole “source of truth” for user access to the O’Reilly learning platform at your organization.
When your IdP is the source of truth, the following principles apply:
- If a user is assigned to the O’Reilly SAML application in your IdP, they have access to O’Reilly and occupy an O’Reilly seat/license.
- If a user is not assigned to the O’Reilly SAML application in your IdP, they do not have access to O’Reilly and do not occupy an O’Reilly seat/license.
After configuring your IdP to use SCIM with O’Reilly, you should no longer use O’Reilly’s User Management page in the Admin Console to manage users. Once your IdP manages your O’Reilly users automatically via SCIM, any user changes made outside of your IdP cause misalignment between your IdP and O’Reilly.
Misalignment can result in a number of issues, including:
- Failure to automatically remove users who are no longer members of your organization
- Duplicating (rather than updating) an O’Reilly user whose email address has changed
- Running out of O’Reilly licenses unexpectedly
- Throttling or temporary blocking of SCIM API access
Prior to enabling SCIM on your IdP, it is necessary to align your O’Reilly and IdP user access lists. Complete the following steps:
- Confirm the maximum number of seats/licenses in your organization’s O’Reilly account
- Review which users at your organization are currently activated in the O’Reilly learning platform
- Review which users at your organization are currently assigned to the O’Reilly SAML application in your IdP
- Compare the two lists of users to ensure that the activated users in O’Reilly are identical to the users assigned to the O’Reilly SAML application in your IdP
User alignment steps
These steps must be performed by your O’Reilly account admin (who has access to the User Management page) in cooperation with your IdP administrator (who manages identity and access management for your organization).
Step 1: Determine maximum O’Reilly seats
Your O’Reilly account admin can determine your organization’s maximum number of O’Reilly seats by doing the following:
- Log in to the O’Reilly learning platform and click Admin in the top-right corner
- Click the Account tab
- Check the number in the Max user access field
Step 2: Download active O’Reilly user list
Your O’Reilly account admin can download a CSV of your organization’s currently activated users by doing the following:
- Log in to the O’Reilly learning platform and click Admin in the top-right corner
- Click User Management
- Verify that the filter Show: Activated is selected
- Click the Download List button
Step 3: Export assigned user list from your IdP
Your IdP administrator should export a list of users at your organization who are currently assigned to the O’Reilly SAML application in your identity provider dashboard.
Step 4: Reconcile user access lists
Your O’Reilly account admin and IdP administrator should compare their O’Reilly and IdP user access lists to ensure that the activated users in the O’Reilly learning platform match the users assigned in your IdP.
Once a one-to-one user relationship has been established between O’Reilly and your IdP, your IdP administrator may proceed with enabling SCIM.
Have a problem or question? Reach out.
For issues and support regarding your O’Reilly account, please contact your O’Reilly customer success manager directly or email the customer support team at