SCIM User and Group Provisioning

Match SCIM and OIDC User Identities

Hive Console matches an OIDC login to a provisioned user by comparing the configured OIDC User ID Claim with the user's SCIM externalId.

In your identity provider, configure the SCIM externalId attribute and an OIDC claim to return the same stable, unique value for a user. Then open your organization Settings, manage the OIDC provider, and set User ID Claim to the name of that OIDC claim.

If no User ID Claim is is configured, Hive Console uses the standard OIDC sub claim. This works when your identity provider sends the same value as the synced SCIM externalId.

Create a Provisioning Access Token

Create an organization access token for the identity provider:

1. Open your organization Settings and select Access Tokens.
2. Create an organization access token with a descriptive name and an expiration policy appropriate for your organization.
3. In the SCIM permission group, select Provision users and groups (scim:provision).
4. Do not grant unrelated permissions.
5. Copy the token when it is displayed and store it in your identity provider.

The token identifies the organization that receives the provisioned users and groups.

Configure the Identity Provider

Create or open the SCIM 2.0 integration in your identity provider and enter these values:

Enable the provisioning actions required by your organization. Hive Console supports creating, reading, updating, disabling, and re-enabling users, as well as creating, reading, updating, and deleting groups and synchronizing their memberships.

Use your identity provider's connection test before assigning users or groups. If the test fails, verify that the token is sent as Authorization: Bearer <ACCESS_TOKEN> and includes the scim:provision permission.

Provision Users and Groups

Assign users and groups to the Hive Console integration in your identity provider, then start a provisioning sync.

Provisioned users appear in the organization Members page with a SCIM indicator. Their active state and group memberships are controlled by the identity provider. Synchronized groups appear under Members > Groups.

If a user is provisioned without any mapped group, the user exists in Hive Console but receives no permissions from group mappings.

Assign Roles and Resources to Groups

Open your organization Members page and select Groups. For each synchronized group:

1. Expand the group.
2. Select Add role mapping.
3. Select a predefined or custom Hive role.
4. Grant the role on all resources or select the projects, targets, services, and app deployments to which it applies.
5. Select Create Role Assignment.

You can add multiple mappings to a group and edit or remove existing mappings. Changes apply to all active users in the group.

Groups themselves, their names, and their memberships remain managed by the identity provider and cannot be created manually in Hive Console.

Require SCIM Provisioning

After you have successfully tested provisioning and assigned the required group mappings, open the organization's OIDC settings. In User Provisioning, select Managed via SCIM.

This restricts organization access to active users that were provisioned through SCIM. Organization administrators are excluded from this restriction to preserve administrative access.

Create or Select an Enterprise Application

In the Microsoft Entra admin center, open Enterprise applications and select New application. You can also use the enterprise application that already provides OIDC SSO for your Hive organization.

On the Browse Microsoft Entra Gallery page, select Create your own application.

Enter a descriptive name, select the option to integrate an application not found in the gallery, and create the application.

Configure the SCIM Connection

Open the application's provisioning settings, then open Connectivity and enter these values:

Test the connection, then save the configuration.

Configure User Attribute Mappings

Open Attribute mapping, select Users, and configure these mappings:

This configuration uses userPrincipalName as the SCIM externalId. Ensure that the OIDC claim configured as Hive Console's User ID Claim returns the same value, as described in Match SCIM and OIDC User Identities.

Configure Group Attribute Mappings

On the Attribute mapping page, select Groups and configure these mappings:

Configure the Provisioning Scope

Open Scoping filters and edit the scope settings. Enable user and group provisioning, then select these object actions:

• For users, select Create and Update.
• For groups, select Create, Update, and Delete.

Save the configuration.

Assign Users and Groups

Assign the users and groups that you want to provision to the enterprise application, then enable provisioning. The initial synchronization can take some time. When it finishes, the provisioned users and groups appear in Hive Console.

Open Members > Groups in Hive Console and create the required role mappings for each provisioned group.

Create an App Integration

In the Okta Admin Console, open Applications > Applications and select Create App Integration.

Select SWA - Secure Web Authentication, then select Next. This application provides the SCIM integration; users continue to authenticate to Hive Console through your organization's OIDC provider.

Configure the Application

Enter a descriptive app name and the Hive Console URL that users should open. You can use your organization's OIDC sign-in URL so that selecting the application directs users to the correct authentication flow.

Under How will your users sign in?, use email as the application username and allow Okta to update it when the application is created or updated. Then select Finish.

Enable SCIM Provisioning

On the application's General tab, edit the app settings. Under Provisioning, select SCIM, then save the configuration. Okta adds a Provisioning tab to the application.

Configure the SCIM Connection

Open Provisioning > Integration, edit the SCIM connection, and enter these values:

Select the supported provisioning actions shown in the screenshot: Import New Users and Profile Updates, Push New Users, Push Profile Updates, Push Groups, and Import Groups.

Select Test Connector Configuration. After the connection test succeeds, save the configuration.

Enable User Provisioning Actions

Open Provisioning > To App, edit the settings, and enable these actions:

• Create Users
• Update User Attributes
• Deactivate Users

Verify User Attribute Mappings

On the To App page, verify that the user attributes include these mappings:

The customExternalId mapping sends the stable Okta user ID as the SCIM externalId. Ensure that the OIDC claim configured as Hive Console's User ID Claim returns the same Okta user ID, as described in Match SCIM and OIDC User Identities.

Assign Users and Push Groups

On the application's Assignments tab, assign the users and groups that should access Hive Console. To synchronize group objects and memberships, also configure Push Groups for each group that Hive Console should receive.

The initial synchronization can take some time. When it finishes, the provisioned users and groups appear in Hive Console. Open Members > Groups and create the required role mappings for each provisioned group.